From b9dc0a5a4b61b6d18341aec93bb7f06cc1b9489a Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:08:27 +0200 Subject: [PATCH 01/26] feat(ocsf): add compiled OCSF schema loader and model Loads the OCSF 1.8.0 export/v2 compiled schema (classes, objects, dictionary, types, enums) into typed Go. Fixture fetched from schema.ocsf.io/1.8.0/export/v2/schema. Errors on a missing schema version. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/go.mod | 15 + ocsf/go.sum | 16 + ocsf/internal/ocsf/schema/schema.go | 647 ++++++++++++++++++ ocsf/internal/ocsf/schema/schema_test.go | 196 ++++++ .../ocsf/schema/testdata/ocsf-1.8.0.json | 1 + 5 files changed, 875 insertions(+) create mode 100644 ocsf/go.mod create mode 100644 ocsf/go.sum create mode 100644 ocsf/internal/ocsf/schema/schema.go create mode 100644 ocsf/internal/ocsf/schema/schema_test.go create mode 100644 ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json diff --git a/ocsf/go.mod b/ocsf/go.mod new file mode 100644 index 0000000..cdd7ea5 --- /dev/null +++ b/ocsf/go.mod @@ -0,0 +1,15 @@ +module github.com/redpanda-data/common-go/ocsf + +go 1.24.3 + +require ( + github.com/stretchr/testify v1.10.0 + google.golang.org/protobuf v1.36.11 +) + +require ( + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect + github.com/davecgh/go-spew v1.1.1 // indirect + github.com/pmezard/go-difflib v1.0.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect +) diff --git a/ocsf/go.sum b/ocsf/go.sum new file mode 100644 index 0000000..57299fc --- /dev/null +++ b/ocsf/go.sum @@ -0,0 +1,16 @@ +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg= +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= +github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= +google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/ocsf/internal/ocsf/schema/schema.go b/ocsf/internal/ocsf/schema/schema.go new file mode 100644 index 0000000..cd043a1 --- /dev/null +++ b/ocsf/internal/ocsf/schema/schema.go @@ -0,0 +1,647 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package schema provides Go types and a loader for the compiled OCSF +// (Open Cybersecurity Schema Framework) schema export. +// +// The loader supports the v2 export format returned by: +// +// GET https://schema.ocsf.io/1.8.0/export/v2/schema +// +// In the v2 export, profile attributes are pre-merged into class and object +// attribute maps, extends chains are flattened, and enum values are inlined. +// The top-level shape differs from the legacy v1 export: +// - types live under dictionary.types.attributes (not top-level "types") +// - dictionary attributes live under dictionary.attributes (not top-level "dictionary_attributes") +// - base_event is a member of the classes map (not a separate top-level key) +// - attribute "profile" (singular *string) became "profiles" ([]string) +// +// This package normalises all of the above so the exported Go types (Schema, +// Class, Object, Attribute, etc.) remain stable regardless of which v2 export +// is loaded. +package schema + +import ( + "encoding/json" + "errors" + "fmt" + "io" + "os" + "path/filepath" + "sort" + "strconv" +) + +// Schema is the top-level compiled OCSF schema export. +type Schema struct { + // Version is the OCSF schema version, e.g. "1.8.0". + Version string + + // Classes is the map of event-class name to Class definition. + // Each class corresponds to one row in the OCSF class taxonomy + // (e.g. "api_activity", "entity_management"). + Classes map[string]*Class + + // Objects is the map of reusable complex-type name to Object definition. + Objects map[string]*Object + + // Types is the map of scalar primitive-type name (e.g. "string_t", + // "integer_t") to its descriptor. + Types map[string]*TypeDef + + // DictionaryAttributes is the global attribute dictionary. It maps + // attribute name to its dictionary-level definition (type, caption, + // description). In the compiled export this lives under + // "dictionary_attributes". + DictionaryAttributes map[string]*DictAttr + + // BaseEvent holds the compiled base-event pseudo-class that carries the + // attributes common to all event classes. + BaseEvent *BaseEvent +} + +// Class represents a compiled OCSF event class. +// +// The UID field equals what OCSF documentation calls "class_uid": +// it is CategoryUID*1000 + the within-category ordinal, giving values like +// 6003 (API Activity) or 3004 (Entity Management). +type Class struct { + // Name is the machine-readable snake_case class name. + Name string + + // Caption is the human-readable class name. + Caption string + + // Description is the human-readable class description. + Description string + + // UID is the fully-qualified numeric class identifier + // (equivalent to "class_uid" in OCSF docs). It equals + // CategoryUID*1000 + within-category ordinal. + UID int + + // CategoryUID is the numeric category this class belongs to. + CategoryUID int + + // Category is the snake_case category name (e.g. "application", "iam"). + Category string + + // CategoryName is the human-readable category name. + CategoryName string + + // Extends is the name of the parent class this class extends, if any. + Extends string + + // Profiles lists the OCSF profile names merged into this class in the + // compiled export. + Profiles []string + + // Attributes is the fully-resolved attribute map for this class. + // Profile attributes are already merged in. + Attributes map[string]*Attribute + + // Constraints holds optional validation rules; nil when none are defined. + Constraints *Constraints +} + +// Constraints captures the optional validation rules on a class or object. +// +// Only the constraint types present in the compiled OCSF 1.x export are +// represented here. Both fields are nil (not empty slice) when absent. +type Constraints struct { + // AtLeastOne lists attribute names where at least one must be present + // in a valid instance. + AtLeastOne []string + + // JustOne lists attribute names where exactly one must be present. + JustOne []string +} + +// Object represents a reusable complex-type (object) in OCSF. +type Object struct { + // Name is the machine-readable object name. + Name string + + // Caption is the human-readable object name. + Caption string + + // Description is the human-readable object description. + Description string + + // Extends is the name of the parent object this object extends, if any. + Extends string + + // Observable is the optional observable type ID for this object. + Observable int + + // Attributes is the resolved attribute map for this object. + Attributes map[string]*Attribute + + // Constraints holds optional validation rules; nil when none are defined. + Constraints *Constraints +} + +// classConstraints converts a raw constraints pointer to the public type. +// Returns nil when raw is nil or both slices are empty (keeps Constraints +// absent rather than present-but-empty, for forward-compatibility). +func classConstraints(raw *rawConstraints) *Constraints { + if raw == nil { + return nil + } + if len(raw.AtLeastOne) == 0 && len(raw.JustOne) == 0 { + return nil + } + return &Constraints{ + AtLeastOne: raw.AtLeastOne, + JustOne: raw.JustOne, + } +} + +// Attribute is a field definition within a Class or Object. +type Attribute struct { + // Name is the machine-readable attribute name (same as the map key). + Name string + + // Caption is the human-readable attribute label. + Caption string + + // Description is the human-readable description. + Description string + + // Type is the OCSF primitive type name (e.g. "string_t", "integer_t", + // "object_t"). + Type string + + // TypeName is the human-readable type label (e.g. "String", "Integer"). + TypeName string + + // IsArray indicates the attribute holds a list of values. + IsArray bool + + // Requirement is one of "required", "recommended", or "optional". + Requirement string + + // Group is the display-group hint (e.g. "primary", "classification"). + Group string + + // Profile is the profile name this attribute was merged from, or empty + // for attributes defined directly on the class/object. + Profile string + + // ObjectType is the name of the OCSF Object this attribute references + // when Type == "object_t". It is the key to look up in Schema.Objects. + ObjectType string + + // ObjectName is the human-readable name of the referenced Object. + ObjectName string + + // Sibling is the name of the companion string attribute for enum + // attributes (the _id → _name relationship). + Sibling string + + // Enum holds the ordered enum members when the attribute has enumerated + // values. Members are sorted by ascending integer key. + Enum []EnumMember + + // Observable is the optional observable type ID for this attribute. + Observable int +} + +// EnumMember is a single entry in an OCSF enum. +// +// Most OCSF enums use integer keys (e.g. severity_id, activity_id). A small +// number use string keys (e.g. TLP values in osint.tlp, CVSS depth). +// When IntKey is true the Key field holds the integer value; otherwise +// StrKey holds the raw string value. +type EnumMember struct { + // Key is the integer enum value. Valid only when IntKey is true. + Key int + + // StrKey is the raw string enum key. Valid only when IntKey is false. + StrKey string + + // IntKey reports whether this member has an integer key. + IntKey bool + + // Caption is the short human-readable label (e.g. "Unknown", "Allow"). + Caption string + + // Description is the longer explanation for this enum value. + Description string +} + +// TypeDef describes a scalar primitive type in the OCSF type system. +type TypeDef struct { + // Caption is the human-readable type name. + Caption string + + // Description is the human-readable description. + Description string + + // Type is the base primitive type this type derives from, e.g. "string_t" + // for ip_t, "long_t" for timestamp_t. Empty for base types (string_t, + // integer_t, long_t, float_t, boolean_t, json_t) that have no parent. + Type string +} + +// DictAttr is a global-dictionary attribute descriptor. +type DictAttr struct { + // Type is the primitive type name. + Type string + + // TypeName is the human-readable type label. + TypeName string + + // Caption is the human-readable attribute label. + Caption string + + // Description is the description from the global dictionary. + Description string +} + +// BaseEvent is the compiled OCSF base-event pseudo-class. +type BaseEvent struct { + // Name is "base_event". + Name string + + // Caption is the human-readable label. + Caption string + + // Description is the human-readable description. + Description string + + // Attributes are the base-event attributes common to all event classes. + Attributes map[string]*Attribute +} + +// --------------------------------------------------------------------------- +// JSON wire types (unexported) — v2 export format +// --------------------------------------------------------------------------- + +// rawSchema models the v2 export top-level object: +// +// { +// "version": "1.8.0", +// "compile_version": 1, +// "classes": { ... }, +// "objects": { ... }, +// "dictionary": { "attributes": {...}, "types": { "attributes": {...} } }, +// "profiles": { ... }, +// "categories": { ... }, +// "extensions": { ... } +// } +// +// base_event is a member of classes with uid=0, extracted by convertSchema. +type rawSchema struct { + Version string `json:"version"` + Classes map[string]rawClass `json:"classes"` + Objects map[string]rawObject `json:"objects"` + Dictionary rawDictionary `json:"dictionary"` +} + +// rawDictionary holds the "dictionary" block from the v2 export. +type rawDictionary struct { + Attributes map[string]rawDictAttr `json:"attributes"` + Types rawDictTypes `json:"types"` +} + +// rawDictTypes holds the "dictionary.types" block. The actual type +// definitions are nested one level deeper under "attributes". +type rawDictTypes struct { + Attributes map[string]rawTypeDef `json:"attributes"` +} + +type rawConstraints struct { + AtLeastOne []string `json:"at_least_one"` + JustOne []string `json:"just_one"` +} + +type rawClass struct { + Name string `json:"name"` + Caption string `json:"caption"` + Description string `json:"description"` + UID int `json:"uid"` + CategoryUID int `json:"category_uid"` + Category string `json:"category"` + CategoryName string `json:"category_name"` + Extends string `json:"extends"` + Profiles []string `json:"profiles"` + Attributes map[string]rawAttribute `json:"attributes"` + Constraints *rawConstraints `json:"constraints"` +} + +type rawObject struct { + Name string `json:"name"` + Caption string `json:"caption"` + Description string `json:"description"` + Extends string `json:"extends"` + Observable int `json:"observable"` + Attributes map[string]rawAttribute `json:"attributes"` + Constraints *rawConstraints `json:"constraints"` +} + +// rawAttribute models a single attribute entry in v2. +// +// Key changes from the legacy format: +// - "profile" (*string) → "profiles" ([]string): the attribute now carries +// a list of profile names it was merged from, not a single pointer. +// - "observable" is absent from class-level attributes in v2 (still present +// on some object-level attributes; parsed but harmless if missing). +// - Additional v2 keys ("suppress_checks", "references", "source", +// "extension", "extension_id", "@deprecated") are intentionally ignored. +type rawAttribute struct { + Caption string `json:"caption"` + Description string `json:"description"` + Type string `json:"type"` + TypeName string `json:"type_name"` + IsArray bool `json:"is_array"` + Requirement string `json:"requirement"` + Group string `json:"group"` + // Profiles lists the profile(s) this attribute was merged from (v2 format). + // The legacy "profile" (*string) field is no longer emitted by the server. + Profiles []string `json:"profiles"` + ObjectType string `json:"object_type"` + ObjectName string `json:"object_name"` + Sibling string `json:"sibling"` + Enum map[string]rawEnumMember `json:"enum"` + Observable int `json:"observable"` +} + +type rawEnumMember struct { + Caption string `json:"caption"` + Description string `json:"description"` +} + +type rawTypeDef struct { + Caption string `json:"caption"` + Description string `json:"description"` + // Type is the base type name for derived types (e.g. "string_t" for ip_t). + // The OCSF v2 export uses the key "type" for this link under + // dictionary.types.attributes. + Type string `json:"type"` +} + +type rawDictAttr struct { + Type string `json:"type"` + TypeName string `json:"type_name"` + Caption string `json:"caption"` + Description string `json:"description"` +} + +// --------------------------------------------------------------------------- +// Loader +// --------------------------------------------------------------------------- + +// Load parses a compiled OCSF schema export JSON from r. +// +// The caller is responsible for closing r. +func Load(r io.Reader) (*Schema, error) { + var raw rawSchema + dec := json.NewDecoder(r) + if err := dec.Decode(&raw); err != nil { + return nil, fmt.Errorf("ocsf schema: decode JSON: %w", err) + } + return convertSchema(&raw) +} + +// LoadFile opens path and calls Load. +func LoadFile(path string) (*Schema, error) { + f, err := os.Open(filepath.Clean(path)) + if err != nil { + return nil, fmt.Errorf("ocsf schema: open %q: %w", path, err) + } + defer f.Close() + return Load(f) +} + +// --------------------------------------------------------------------------- +// Conversion helpers +// --------------------------------------------------------------------------- + +func convertSchema(raw *rawSchema) (*Schema, error) { + if raw.Version == "" { + return nil, errors.New("ocsf schema: missing or empty \"version\" field") + } + + // In the v2 export, base_event is a member of the classes map with uid=0. + // Extract it before iterating over regular classes. + rawBE, hasBaseEvent := raw.Classes["base_event"] + + classCount := len(raw.Classes) + if hasBaseEvent { + classCount-- // base_event is not a real class + } + + s := &Schema{ + Version: raw.Version, + Classes: make(map[string]*Class, classCount), + Objects: make(map[string]*Object, len(raw.Objects)), + Types: make(map[string]*TypeDef, len(raw.Dictionary.Types.Attributes)), + DictionaryAttributes: make(map[string]*DictAttr, len(raw.Dictionary.Attributes)), + } + + for name, rc := range raw.Classes { + if name == "base_event" { + continue + } + cls, err := convertClass(name, &rc) + if err != nil { + return nil, fmt.Errorf("ocsf schema: class %q: %w", name, err) + } + s.Classes[name] = cls + } + + for name, ro := range raw.Objects { + obj, err := convertObject(name, &ro) + if err != nil { + return nil, fmt.Errorf("ocsf schema: object %q: %w", name, err) + } + s.Objects[name] = obj + } + + // Types live under dictionary.types.attributes in the v2 export. + for name, rt := range raw.Dictionary.Types.Attributes { + s.Types[name] = &TypeDef{ + Caption: rt.Caption, + Description: rt.Description, + Type: rt.Type, + } + } + + // Dictionary attributes live under dictionary.attributes in the v2 export. + for name, rd := range raw.Dictionary.Attributes { + s.DictionaryAttributes[name] = &DictAttr{ + Type: rd.Type, + TypeName: rd.TypeName, + Caption: rd.Caption, + Description: rd.Description, + } + } + + if hasBaseEvent { + be, err := convertBaseEventFromClass(&rawBE) + if err != nil { + return nil, fmt.Errorf("ocsf schema: base_event: %w", err) + } + s.BaseEvent = be + } + + return s, nil +} + +func convertClass(name string, rc *rawClass) (*Class, error) { + attrs, err := convertAttributes(rc.Attributes) + if err != nil { + return nil, err + } + return &Class{ + Name: name, + Caption: rc.Caption, + Description: rc.Description, + UID: rc.UID, + CategoryUID: rc.CategoryUID, + Category: rc.Category, + CategoryName: rc.CategoryName, + Extends: rc.Extends, + Profiles: rc.Profiles, + Attributes: attrs, + Constraints: classConstraints(rc.Constraints), + }, nil +} + +func convertObject(name string, ro *rawObject) (*Object, error) { + attrs, err := convertAttributes(ro.Attributes) + if err != nil { + return nil, err + } + return &Object{ + Name: name, + Caption: ro.Caption, + Description: ro.Description, + Extends: ro.Extends, + Observable: ro.Observable, + Attributes: attrs, + Constraints: classConstraints(ro.Constraints), + }, nil +} + +// convertBaseEventFromClass converts the raw class entry for "base_event" +// (which the v2 export stores inside the classes map) into a BaseEvent. +func convertBaseEventFromClass(rc *rawClass) (*BaseEvent, error) { + attrs, err := convertAttributes(rc.Attributes) + if err != nil { + return nil, err + } + return &BaseEvent{ + Name: rc.Name, + Caption: rc.Caption, + Description: rc.Description, + Attributes: attrs, + }, nil +} + +func convertAttributes(raw map[string]rawAttribute) (map[string]*Attribute, error) { + if raw == nil { + return nil, nil + } + out := make(map[string]*Attribute, len(raw)) + for name, ra := range raw { + attr, err := convertAttribute(name, &ra) + if err != nil { + return nil, fmt.Errorf("attribute %q: %w", name, err) + } + out[name] = attr + } + return out, nil +} + +func convertAttribute(name string, ra *rawAttribute) (*Attribute, error) { + // v2 uses "profiles" ([]string). Collapse to a single string for + // compatibility with the Attribute.Profile field: take the first entry + // when present, empty string otherwise. Attributes merged from exactly + // one profile carry a single-element list; base attributes carry none. + profile := "" + if len(ra.Profiles) > 0 { + profile = ra.Profiles[0] + } + + members, err := sortedEnumMembers(ra.Enum) + if err != nil { + return nil, fmt.Errorf("enum: %w", err) + } + + return &Attribute{ + Name: name, + Caption: ra.Caption, + Description: ra.Description, + Type: ra.Type, + TypeName: ra.TypeName, + IsArray: ra.IsArray, + Requirement: ra.Requirement, + Group: ra.Group, + Profile: profile, + ObjectType: ra.ObjectType, + ObjectName: ra.ObjectName, + Sibling: ra.Sibling, + Enum: members, + Observable: ra.Observable, + }, nil +} + +// sortedEnumMembers converts the string-keyed enum map into a slice with +// deterministic ordering. +// +// Most OCSF enums use integer keys (e.g. severity_id). The function probes +// the first key to decide the kind: if it parses as an integer, all keys are +// treated as integers and the slice is sorted by ascending integer value. +// Otherwise (including a mix of int-parseable and non-parseable keys) all +// entries are treated as string-keyed and sorted lexicographically. +func sortedEnumMembers(raw map[string]rawEnumMember) ([]EnumMember, error) { + if len(raw) == 0 { + return nil, nil + } + + // Probe whether keys are integers. + allInt := true + for keyStr := range raw { + if _, err := strconv.Atoi(keyStr); err != nil { + allInt = false + break + } + } + + members := make([]EnumMember, 0, len(raw)) + for keyStr, rm := range raw { + m := EnumMember{ + Caption: rm.Caption, + Description: rm.Description, + } + if allInt { + k, err := strconv.Atoi(keyStr) + if err != nil { + // Should not happen after probe, but be defensive. + return nil, fmt.Errorf("enum key %q: %w", keyStr, err) + } + m.Key = k + m.IntKey = true + } else { + m.StrKey = keyStr + } + members = append(members, m) + } + + sort.Slice(members, func(i, j int) bool { + if members[i].IntKey { + return members[i].Key < members[j].Key + } + return members[i].StrKey < members[j].StrKey + }) + + return members, nil +} diff --git a/ocsf/internal/ocsf/schema/schema_test.go b/ocsf/internal/ocsf/schema/schema_test.go new file mode 100644 index 0000000..05d3ef0 --- /dev/null +++ b/ocsf/internal/ocsf/schema/schema_test.go @@ -0,0 +1,196 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package schema_test + +import ( + "os" + "strings" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +const fixtureFile = "testdata/ocsf-1.8.0.json" + +func loadFixture(t *testing.T) *schema.Schema { + t.Helper() + f, err := os.Open(fixtureFile) + require.NoError(t, err) + t.Cleanup(func() { _ = f.Close() }) + s, err := schema.Load(f) + require.NoError(t, err) + return s +} + +// TestLoad verifies that the compiled OCSF 1.8.0 fixture can be parsed without error. +func TestLoad(t *testing.T) { + s := loadFixture(t) + require.NotNil(t, s) + require.Equal(t, "1.8.0", s.Version) +} + +// TestAPIActivityClass verifies class_uid and category_uid for api_activity. +func TestAPIActivityClass(t *testing.T) { + s := loadFixture(t) + + cls, ok := s.Classes["api_activity"] + require.True(t, ok, "api_activity class must be present") + + // uid in the export equals class_uid (category_uid*1000 + within-category-uid). + require.Equal(t, 6003, cls.UID, "api_activity UID must be 6003") + require.Equal(t, 6, cls.CategoryUID, "api_activity CategoryUID must be 6") +} + +// TestAPIActivitySecurityControlProfileAttrs verifies that the compiled export has +// merged the security_control profile attributes into api_activity. +func TestAPIActivitySecurityControlProfileAttrs(t *testing.T) { + s := loadFixture(t) + + cls, ok := s.Classes["api_activity"] + require.True(t, ok) + + _, hasDispositionID := cls.Attributes["disposition_id"] + require.True(t, hasDispositionID, "api_activity must have disposition_id from security_control profile") + + _, hasAuthorizations := cls.Attributes["authorizations"] + require.True(t, hasAuthorizations, "api_activity must have authorizations from security_control profile") +} + +// TestEntityManagementClass verifies class_uid and category_uid for entity_management. +func TestEntityManagementClass(t *testing.T) { + s := loadFixture(t) + + cls, ok := s.Classes["entity_management"] + require.True(t, ok, "entity_management class must be present") + + require.Equal(t, 3004, cls.UID, "entity_management UID must be 3004") + require.Equal(t, 3, cls.CategoryUID, "entity_management CategoryUID must be 3") +} + +// TestUserObjectHasNestedType verifies that the user object has at least one attribute +// whose type references another object (i.e., is itself a complex/object type). +func TestUserObjectHasNestedType(t *testing.T) { + s := loadFixture(t) + + user, ok := s.Objects["user"] + require.True(t, ok, "user object must be present") + + foundObjectRef := false + for _, attr := range user.Attributes { + if attr.ObjectType != "" { + foundObjectRef = true + // Verify the referenced object actually exists in the schema. + _, exists := s.Objects[attr.ObjectType] + require.True(t, exists, "user attribute %q references object %q which must exist in schema", attr.Name, attr.ObjectType) + break + } + } + require.True(t, foundObjectRef, "user object must have at least one attribute that references another object") +} + +// TestTypeDefBaseLink verifies that derived types expose their base type +// and that primitive base types have an empty base. +func TestTypeDefBaseLink(t *testing.T) { + s := loadFixture(t) + + // ip_t is a derived string type: its base must be "string_t". + ipT, ok := s.Types["ip_t"] + require.True(t, ok, "ip_t must be present in schema types") + require.Equal(t, "string_t", ipT.Type, "ip_t must have base type string_t") + + // timestamp_t is a derived long type: its base must be "long_t". + tsT, ok := s.Types["timestamp_t"] + require.True(t, ok, "timestamp_t must be present in schema types") + require.Equal(t, "long_t", tsT.Type, "timestamp_t must have base type long_t") + + // string_t is a base type: no base. + strT, ok := s.Types["string_t"] + require.True(t, ok, "string_t must be present in schema types") + require.Empty(t, strT.Type, "string_t must have no base type") + + // long_t is a base type: no base. + longT, ok := s.Types["long_t"] + require.True(t, ok, "long_t must be present in schema types") + require.Empty(t, longT.Type, "long_t must have no base type") +} + +// TestSchema_ConstraintsLoaded verifies that the schema loader exposes +// constraints on objects (at_least_one and just_one). +func TestSchema_ConstraintsLoaded(t *testing.T) { + s := loadFixture(t) + + user, ok := s.Objects["user"] + require.True(t, ok) + require.NotNil(t, user.Constraints, "user object must have constraints") + require.Contains(t, user.Constraints.AtLeastOne, "name") + require.Contains(t, user.Constraints.AtLeastOne, "uid") + + vuln, ok := s.Objects["vulnerability"] + require.True(t, ok) + require.NotNil(t, vuln.Constraints) + require.Contains(t, vuln.Constraints.JustOne, "cve") +} + +// TestAiModelAndMessageContextAreRealObjects asserts that ai_model and +// message_context load as real objects with attributes, not empty stubs. +// Both were absent from the hand-assembled fixture (ocsf-1.8.0.json ≤ v1) +// and must be present with attributes in the v2 export. +func TestAiModelAndMessageContextAreRealObjects(t *testing.T) { + s := loadFixture(t) + + aiModel, ok := s.Objects["ai_model"] + require.True(t, ok, "ai_model must be present in schema objects") + require.NotEmpty(t, aiModel.Attributes, "ai_model must have at least one attribute (not a stub)") + + msgCtx, ok := s.Objects["message_context"] + require.True(t, ok, "message_context must be present in schema objects") + require.NotEmpty(t, msgCtx.Attributes, "message_context must have at least one attribute (not a stub)") +} + +// TestLoadRejectsMissingVersion verifies that Load returns a descriptive error +// when the schema JSON has an empty (or absent) version field. +func TestLoadRejectsMissingVersion(t *testing.T) { + raw := `{"version":"","classes":{},"objects":{},"dictionary":{"attributes":{},"types":{"attributes":{}}}}` + _, err := schema.Load(strings.NewReader(raw)) + require.Error(t, err) + require.Contains(t, err.Error(), "version") +} + +// TestEnumOrderedAscending verifies that integer-keyed enum members are +// returned in ascending key order regardless of JSON key ordering, and that +// the first member has key 0 (Unknown). +func TestEnumOrderedAscending(t *testing.T) { + s := loadFixture(t) + + cls, ok := s.Classes["api_activity"] + require.True(t, ok) + + activityID, ok := cls.Attributes["activity_id"] + require.True(t, ok, "api_activity must have activity_id attribute") + require.NotEmpty(t, activityID.Enum, "activity_id must have enum members") + + // activity_id uses integer keys. + require.True(t, activityID.Enum[0].IntKey, "activity_id enum must use integer keys") + + // Key 0 (Unknown) must be first. + require.Equal(t, 0, activityID.Enum[0].Key, "first enum member must have key 0 (Unknown)") + + // Verify strictly ascending order. + for i := 1; i < len(activityID.Enum); i++ { + require.Greater( + t, + activityID.Enum[i].Key, + activityID.Enum[i-1].Key, + "enum members must be in ascending key order", + ) + } +} diff --git a/ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json b/ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json new file mode 100644 index 0000000..fc53242 --- /dev/null +++ b/ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json @@ -0,0 +1 @@ +{"dictionary":{"attributes":{"query_info":{"type":"object_t","description":"The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a database query must be written using a specific syntax.","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"password_last_used_time_dt":{"type":"datetime_t","description":"The time when a user's password was last used. See specific usage.","caption":"Password Last Used Time","type_name":"Datetime"},"match_location":{"type":"string_t","description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER.","caption":"Match Location","type_name":"String"},"terminated_time":{"type":"timestamp_t","description":"The time when the entity was terminated. See specific usage.","caption":"Terminated Time","type_name":"Timestamp"},"is_backed_up":{"type":"boolean_t","description":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the cloudBackupEnabled value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service.","caption":"Back Ups Configured","type_name":"Boolean"},"keyboard_subtype":{"type":"integer_t","description":"The keyboard numeric code.","caption":"Keyboard Subtype","type_name":"Integer"},"udid":{"type":"string_t","description":"The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS, tvOS, watchOS and visionOS devices, this is the UDID. For macOS devices, it is the Provisioning UDID. For example: 00008020-008D4548007B4F26","references":[{"description":"Apple Wiki","url":"https://theapplewiki.com/wiki/UDID"}],"caption":"Unique Device Identifier","type_name":"String"},"flag_history":{"type":"string_t","description":"The Connection Flag History summarizes events in a network connection. For example flags ShAD representing SYN, SYN/ACK, ACK and Data exchange.","references":[{"description":"Zeek History","url":"https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is"}],"caption":"Connection Flag History","type_name":"String"},"developer_uid":{"type":"string_t","description":"The developer ID on the certificate that signed the file.","caption":"Developer UID","type_name":"String"},"state_id":{"type":"integer_t","enum":{"0":{"description":"The state is unknown.","caption":"Unknown"},"99":{"description":"The state is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized state ID of the event or object. See specific usage.","caption":"State ID","sibling":"state","type_name":"Integer"},"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"egid":{"type":"integer_t","description":"The effective group under which this process is running.","caption":"Effective Group ID","type_name":"Integer"},"privilege_attack_info_list":{"type":"object_t","description":"A list of privilege-to-attack mappings.","is_array":true,"object_type":"privilege_attack_info","caption":"Privilege Attack Info List","object_name":"Privilege Attack Info"},"physical_width":{"type":"integer_t","description":"The numeric physical width of display.","caption":"Physical Width","type_name":"Integer"},"logout_endpoint":{"type":"url_t","description":"URL for initiating a logout request. See specific usage.","caption":"Logout Endpoint","type_name":"URL String"},"modified_time":{"type":"timestamp_t","description":"The time when the object was last modified. See specific usage.","caption":"Modified Time","type_name":"Timestamp"},"encoding":{"type":"string_t","description":"The encoding method, normalized to the caption of the encoding_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Encoding","type_name":"String"},"http_headers":{"type":"object_t","description":"Additional HTTP headers of an HTTP request or response.","is_array":true,"object_type":"http_header","caption":"HTTP Headers","object_name":"HTTP Header"},"is_src_dst_assignment_known":{"type":"boolean_t","description":"true denotes that src_endpoint and dst_endpoint correctly identify the initiator and responder respectively. false denotes that the event source has arbitrarily assigned one peer to src_endpoint and the other to dst_endpoint, in other words that initiator and responder are not being asserted. This can occur, for example, when the event source is a network appliance that has not observed the initiation of a given connection. In the absence of this attribute, interpretation of the initiator and responder is implementation-specific.","caption":"Source/Destination Assignment Known","type_name":"Boolean"},"ext":{"type":"string_t","description":"The extension. See specific usage.","caption":"Extension","type_name":"String"},"dispersion":{"type":"integer_t","description":"The dispersion in the NTP protocol is the estimated time error or uncertainty relative to the reference clock in milliseconds.","caption":"Root Dispersion","type_name":"Integer"},"ja3s_hash":{"type":"object_t","description":"The MD5 hash of a JA3S string.","object_type":"fingerprint","caption":"JA3S Hash","object_name":"Fingerprint"},"win/service_dll_file":{"type":"object_t","description":"For a shared user mode service (service_type_id is 4) this is the DLL that gets loaded by the generic service host process (e.g. svchost.exe) to implement the service.","extension":"win","extension_id":2,"object_type":"file","caption":"Service DLL","object_name":"File"},"cc_mailboxes":{"type":"string_t","description":"The human-readable email header Cc Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"Cc Mailboxes","type_name":"String"},"app_protocol_name":{"type":"string_t","description":"The application protocol name. See specific usage.","caption":"Application Protocol Name","type_name":"String"},"cvss":{"type":"object_t","description":"The CVSS object details Common Vulnerability Scoring System (CVSS) scores from the advisory that are related to the vulnerability.","is_array":true,"object_type":"cvss","caption":"CVSS Score","object_name":"CVSS Score"},"query_string":{"type":"string_t","description":"The query portion of the URL. For example: the query portion of the URL http://www.example.com/search?q=bad&sort=date is q=bad&sort=date.","caption":"HTTP Query String","type_name":"String"},"role_id":{"type":"integer_t","enum":{"0":{"description":"The role is unknown.","caption":"Unknown"},"99":{"description":"The role is not mapped. See the role attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of an entity's role in the context of the event or finding. See specific usage.","caption":"Role ID","sibling":"role","type_name":"Integer"},"environment_variables":{"type":"object_t","description":"An array of environment variables.","is_array":true,"object_type":"environment_variable","caption":"Environment Variables","object_name":"Environment Variable"},"permission":{"type":"string_t","description":"The IAM permission related to an event","caption":"Permission","type_name":"String"},"win/load_order_group":{"type":"string_t","description":"The name of the load ordering group of which this service is a member.","extension":"win","extension_id":2,"caption":"Load Order Group","type_name":"String"},"vulnerabilities":{"type":"object_t","description":"This object describes vulnerabilities reported in a security finding.","is_array":true,"object_type":"vulnerability","caption":"Vulnerabilities","object_name":"Vulnerability Details"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"kernel_release":{"type":"string_t","description":"The kernel release of the operating system. On Unix-based systems, this is determined from the uname -r command output, for example \"5.15.0-122-generic\".","caption":"Kernel Release","type_name":"String"},"percentile":{"type":"float_t","description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset.","caption":"EPSS Percentile","type_name":"Float"},"last_authentication_time_dt":{"type":"datetime_t","description":"The timestamp when this identity last successfully authenticated to any system or service. See specific usage.","caption":"Last Authentication Time","type_name":"Datetime"},"is_shared":{"type":"boolean_t","description":"The event occurred on a shared device.","caption":"Shared Device","type_name":"Boolean"},"related_component":{"type":"string_t","description":"The package URL (PURL) of the component that this software component has a relationship with.","caption":"Related Component","type_name":"String"},"boot_time":{"type":"timestamp_t","description":"The time when the system was booted.","caption":"Boot Time","type_name":"Timestamp"},"num_volumes":{"type":"integer_t","description":"The number of volumes in the storage device. See specific usage.","caption":"Number of Volumes","type_name":"Integer"},"logged_time_dt":{"type":"datetime_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","caption":"Logged Time","type_name":"Datetime"},"last_run_time":{"type":"timestamp_t","description":"The last run time of application or service. See specific usage.","caption":"Last Run","type_name":"Timestamp"},"expiration_reason":{"type":"string_t","description":"The expiration reason. See specific usage.","caption":"Expiration Reason","type_name":"String"},"loaded_modules":{"type":"string_t","description":"The list of loaded module names.","is_array":true,"caption":"Loaded Modules","type_name":"String"},"win/service_type_id":{"type":"integer_t","enum":{"3":{"description":"A user mode service that runs in its own process.","caption":"Own Process"},"0":{"description":"The service type is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver.","caption":"Kernel Driver"},"2":{"description":"A kernel mode file system minifilter.","caption":"File System Driver"},"99":{"description":"The service type is not mapped. See the service_type attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"A user mode service that shares a process with other services.","caption":"Share Process"}},"description":"The normalized identifier of the service type.","extension":"win","extension_id":2,"caption":"Service Type ID","sibling":"service_type","type_name":"Integer"},"ai_model":{"type":"object_t","description":"The AI Model object describes the characteristics of an AI/ML model. Examples include language models like GPT-4, embedding models like text-embedding-ada-002, and computer vision models like CLIP.","object_type":"ai_model","caption":"AI Model","object_name":"AI Model"},"processed_time":{"type":"timestamp_t","description":"The event processed time, such as an ETL operation.","caption":"Processed Time","type_name":"Timestamp"},"title":{"type":"string_t","description":"The title of an entity. See specific usage.","caption":"Title","type_name":"String"},"zone":{"type":"string_t","description":"The network zone or LAN segment. See specific usage.","caption":"Network Zone","type_name":"String"},"package_manager_url":{"type":"url_t","description":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as AWS CodeArtifact or Artifactory.","caption":"Package Manager URL","type_name":"URL String"},"ptid":{"type":"long_t","description":"The identifier of the process thread associated with the event, as returned by the operating system.","caption":"Process Thread ID","type_name":"Long"},"sans":{"type":"object_t","description":"The list of subject alternative names that are secured by a specific certificate.","is_array":true,"object_type":"san","caption":"Subject Alternative Names","object_name":"Subject Alternative Name"},"cis_benchmark":{"type":"object_t","description":"The CIS Benchmark describes best practices for securely configuring IT systems, software, networks, and cloud infrastructure as defined by the Center for Internet Security (CIS).","object_type":"cis_benchmark","caption":"CIS Benchmark","@deprecated":{"message":"Use Compliance object with Check object instead.","since":"1.5.0"},"object_name":"CIS Benchmark"},"start_column":{"type":"integer_t","description":"The start column number. See specific usage.","caption":"Start Column","type_name":"Integer"},"uid":{"type":"string_t","description":"The unique identifier. See specific usage.","caption":"Unique ID","type_name":"String"},"tag":{"type":"string_t","description":"The image tag. For example: 1.11-alpine.","caption":"Image Tag","type_name":"String","@deprecated":{"message":"Use the labels or tags attribute instead.","since":"1.4.0"}},"continent":{"type":"string_t","description":"The name of the continent.","caption":"Continent","type_name":"String"},"phase":{"type":"string_t","description":"The cyber kill chain phase.","caption":"Kill Chain Phase","type_name":"String"},"observation_point_id":{"type":"integer_t","enum":{"0":{"caption":"Unknown"},"99":{"caption":"Other"}},"description":"The normalized identifier of the observation point. See specific usage.","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"win/reg_key":{"type":"object_t","description":"The registry key.","extension":"win","extension_id":2,"object_type":"win/reg_key","caption":"Registry Key","object_name":"Registry Key"},"threat_actor":{"type":"object_t","description":"A threat actor is an individual or group that conducts malicious cyber activities, often with financial, political, or ideological motives.","references":[{"description":"STIX Threat Actor definition","url":"https://stixproject.github.io/data-model/1.2/ta/ThreatActorType/"}],"object_type":"threat_actor","caption":"Threat Actor","object_name":"Threat Actor"},"rdata":{"type":"string_t","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record.","caption":"DNS RData","type_name":"String"},"tenant_uid":{"type":"string_t","description":"The unique tenant identifier.","caption":"Tenant UID","type_name":"String"},"scan":{"type":"object_t","description":"The Scan object describes characteristics of a scan. See specific usage.","object_type":"scan","caption":"Scan","object_name":"Scan"},"query_language_id":{"type":"integer_t","enum":{"0":{"description":"The Query Language is unknown.","caption":"Unknown"},"99":{"description":"The Query Language is not mapped. See the query_language attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the query language. See specific usage.","caption":"Query Language ID","sibling":"query_language","type_name":"Integer"},"working_directory":{"type":"string_t","description":"The working directory of a process.","caption":"Working Directory","type_name":"String"},"cmd_line":{"type":"string_t","description":"The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used.","caption":"Command Line","type_name":"String","observable":13},"parent_folder":{"type":"string_t","description":"The parent folder in which the file resides. For example: c:\\windows\\system32","caption":"Parent Folder","type_name":"String"},"policies":{"type":"object_t","description":"An array of Policy objects.","is_array":true,"object_type":"policy","caption":"Policies","object_name":"Policy"},"section_a":{"type":"string_t","description":"The 'a' section of the JA4 fingerprint.","caption":"JA4 Section A","type_name":"String"},"from_mailbox":{"type":"string_t","description":"The human-readable email header From Mailbox value. For example 'Example User <example.user@usersdomain.com>'.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"From Mailbox","type_name":"String"},"response_time_dt":{"type":"datetime_t","description":"The Domain Name System (DNS) response time.","caption":"Response Time","type_name":"Datetime"},"folder":{"type":"object_t","description":"The folder that pertains to the event.","object_type":"file","caption":"Folder","object_name":"File"},"last_login_time":{"type":"timestamp_t","description":"The last time when the user logged in.","caption":"Last Login","type_name":"Timestamp"},"is_read":{"type":"boolean_t","description":"The indication of whether the email has been read.","caption":"Read","type_name":"Boolean"},"security_level_id":{"type":"integer_t","enum":{"3":{"caption":"Compromised"},"0":{"caption":"Unknown"},"1":{"caption":"Secure"},"2":{"caption":"At Risk"},"99":{"description":"The security level is not mapped. See the security_level attribute, which contains data source specific values.","caption":"Other"}},"description":"The current security level of the entity","caption":"Security Level ID","sibling":"security_level","type_name":"Integer"},"product_uid":{"type":"string_t","description":"Unique Identifier of a product.","caption":"Product Identifier","type_name":"String","@deprecated":{"message":"Use the uid attribute in the product object instead. See specific usage.","since":"1.4.0"}},"win/hosted_services":{"type":"object_t","description":"The Windows services that this process is hosting.","extension":"win","is_array":true,"extension_id":2,"object_type":"win/win_service","caption":"Hosted Services","object_name":"Windows Service"},"os":{"type":"object_t","description":"The endpoint operating system.","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"cpu_count":{"type":"integer_t","description":"The number of physical processors on a system. For example: 1.","caption":"CPU Count","type_name":"Integer"},"file_diff":{"type":"string_t","description":"File content differences used for change detection. For example, a common use case is to identify itemized changes within INI or configuration/property setting values.","caption":"File Diff","type_name":"String"},"query_type_id":{"type":"integer_t","enum":{"3":{"description":"A query about folder attributes, metadata, content, or structure.","caption":"Folder"},"6":{"description":"A query about loaded modules, their base addresses, load types, or function entry points.","caption":"Module"},"0":{"description":"The query type was unknown or not specified.","caption":"Unknown"},"1":{"description":"A query about kernel resources including system calls, shared mutex, or other kernel components.","caption":"Kernel"},"2":{"description":"A query about file attributes, metadata, content, hash values, or properties.","caption":"File"},"99":{"description":"The query type was not mapped to a standard category. See the query_type attribute for source-specific value.","caption":"Other"},"4":{"description":"A query about group membership, privileges, domain, or group properties.","caption":"Admin Group"},"5":{"description":"A query about scheduled jobs, their command lines, run states, or execution times.","caption":"Job"},"7":{"description":"A query about active network connections, boundaries, protocols, or TCP states.","caption":"Network Connection"},"8":{"description":"A query about physical or virtual network interfaces, their IP/MAC addresses, or types.","caption":"Network Interfaces"},"9":{"description":"A query about attached peripheral devices, their classes, models, or vendor information.","caption":"Peripheral Device"},"10":{"description":"A query about running processes, command lines, ancestry, loaded modules, or execution context.","caption":"Process"},"11":{"description":"A query about system services, their names, versions, labels, or properties.","caption":"Service"},"12":{"description":"A query about authenticated user or service sessions, their creation times, or issuer details.","caption":"Session"},"14":{"description":"A query about multiple users belonging to an administrative group.","caption":"Users"},"15":{"description":"A query about startup configuration items, their run modes, start types, or current states.","caption":"Startup Item"},"16":{"description":"A Windows-specific query about registry keys, their paths, security descriptors, or modification times.","caption":"Registry Key"},"17":{"description":"A Windows-specific query about registry values, their data types, content, or names.","caption":"Registry Value"},"18":{"description":"A Windows-specific query about prefetch files, their run counts, last execution times, or existence.","caption":"Prefetch"},"13":{"description":"A query about user accounts, their properties, credentials, or domain information.","caption":"User"}},"description":"The normalized type of system query performed against a device or system component.","caption":"Query Type ID","sibling":"query_type","type_name":"Integer"},"script_content":{"type":"object_t","description":"The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated.","object_type":"long_string","caption":"Script Content","object_name":"Long String","observable":36},"run_mode_ids":{"type":"integer_t","enum":{"0":{"description":"The run mode is unknown.","caption":"Unknown"},"99":{"description":"The run mode is not mapped. See the run_modes attribute, which contains data source specific values.","caption":"Other"}},"description":"The list of normalized identifiers that describe application attributes when it is running. See specific usage.","is_array":true,"caption":"Run Mode IDs","sibling":"run_modes","type_name":"Integer"},"app":{"type":"object_t","description":"The application that reported the event.","object_type":"product","caption":"Application","object_name":"Product"},"compliance":{"type":"object_t","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details.","object_type":"compliance","caption":"Compliance","object_name":"Compliance"},"vpc_uid":{"type":"string_t","description":"The unique identifier of the Virtual Private Cloud (VPC).","caption":"VPC UID","type_name":"String"},"chunks_out":{"type":"long_t","description":"A unit of information within an SCTP packet, consisting of a chunk header and chunk-specific content. See RFC 4960. This field can be used for the chunks sent from the source to the destination.","caption":"Chunks Out","type_name":"Long"},"state":{"type":"string_t","description":"The state of the event or object, normalized to the caption of the state_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"State","type_name":"String"},"is_public":{"type":"boolean_t","description":"Determination of the public accessibility. See specific usage.","caption":"Public","type_name":"Boolean"},"win/hosting_process":{"type":"object_t","description":"The process that is hosting this service.","extension":"win","extension_id":2,"object_type":"process_entity","caption":"Hosting Process","object_name":"Process Entity"},"is_superseded":{"type":"boolean_t","description":"The vendor patch has been replaced by another.","caption":"The patch is superseded.","type_name":"Boolean"},"classification_ids":{"type":"integer_t","enum":{"0":{"description":"The classification is unknown.","caption":"Unknown"},"99":{"description":"The classification is not mapped. See the classifications attribute, which contains a data source specific value.","caption":"Other"}},"description":"The list of normalized classification identifiers. See specific usage.","is_array":true,"caption":"Classification IDs","sibling":"classifications","type_name":"Integer"},"expiration_time":{"type":"timestamp_t","description":"The expiration time. See specific usage.","caption":"Expiration Time","type_name":"Timestamp"},"driver":{"type":"object_t","description":"The driver that was loaded/unloaded into the kernel","object_type":"kernel_driver","caption":"Kernel Driver","object_name":"Kernel Extension"},"ou_name":{"type":"string_t","description":"The name of the organizational unit, within an organization. For example, Finance, IT, R&D","caption":"Org Unit Name","type_name":"String"},"job_title":{"type":"string_t","description":"The user's job title.","caption":"Job Title","type_name":"String"},"cves":{"type":"object_t","description":"List of Common Vulnerabilities and Exposures (CVE).","is_array":true,"object_type":"cve","caption":"CVE List","object_name":"CVE"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","caption":"Event Time","type_name":"Timestamp"},"employee_uid":{"type":"string_t","description":"The employee identifier assigned to the user by the organization.","caption":"Employee ID","type_name":"String"},"category":{"type":"string_t","description":"The object category, normalized to the caption of category_id. See specific usage.","caption":"Category","type_name":"String"},"num_detections":{"type":"integer_t","description":"The number of detections.","caption":"Detections","type_name":"Integer"},"untruncated_size":{"type":"integer_t","description":"The size in bytes of an attribute before truncation. See specific usage.","caption":"Untruncated Size","type_name":"Integer"},"ram_size":{"type":"integer_t","description":"The total amount of installed RAM, in Megabytes. For example: 2048.","caption":"RAM Size","type_name":"Integer"},"email":{"type":"object_t","description":"The email object.","object_type":"email","caption":"Email","object_name":"Email"},"prev_security_level":{"type":"string_t","description":"The previous security level of the entity","caption":"Previous Security Level","type_name":"String"},"banner":{"type":"string_t","description":"The initial connection response that a messaging server receives after it connects to an email server.","caption":"Protocol Banner","type_name":"String"},"transaction_uid":{"type":"string_t","description":"The unique identifier of the transaction.","caption":"Transaction UID","type_name":"String"},"dmarc_override":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action.","caption":"DMARC Override","type_name":"String"},"service_privilege_analysis_list":{"type":"object_t","description":"A list of privilege analysis results grouped by cloud service or namespace.","is_array":true,"object_type":"service_privilege_analysis","caption":"Service Privilege Analysis List","object_name":"Service Privilege Analysis"},"speed":{"type":"string_t","description":"Ground speed of flight. This value is provided in meters per second with a minimum resolution of 0.25 m/s. Special Values: Invalid, No Value, or Unknown: 255 m/s.","caption":"Speed","type_name":"String"},"firewall_rule":{"type":"object_t","description":"The firewall rule that triggered the event.","object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"containers":{"type":"object_t","description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application.","is_array":true,"object_type":"container","caption":"Containers","object_name":"Container"},"is_deleted":{"type":"boolean_t","description":"Indicates if the entity was deleted. See specific usage.","caption":"Deleted","type_name":"Boolean"},"traits":{"type":"object_t","description":"The traits that describe characteristics, features of an entity. See specific usage.","is_array":true,"object_type":"trait","caption":"Traits","object_name":"Trait"},"startup_item":{"type":"object_t","description":"The startup item object describes an application component that has associated startup criteria and configurations.","object_type":"startup_item","caption":"Startup Item","object_name":"Startup Item"},"log_format":{"type":"string_t","description":"The format of data in the log. See specific usage.","caption":"Log Format","type_name":"String"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"kill_chain":{"type":"object_t","description":"The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.","is_array":true,"object_type":"kill_chain_phase","caption":"Kill Chain","object_name":"Kill Chain Phase"},"total_tokens":{"type":"integer_t","description":"Total number of tokens used for this message (prompt + completion).","caption":"Total Tokens","type_name":"Integer"},"resources":{"type":"object_t","description":"Describes details about resources that were affected by the activity/event.","is_array":true,"object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"dce_rpc":{"type":"object_t","description":"The DCE/RPC object describes the remote procedure call system for distributed computing environments.","object_type":"dce_rpc","caption":"Distributed Computing Environment/Remote Procedure Call (DCE/RPC)","object_name":"DCE/RPC"},"cores":{"type":"integer_t","description":"The number of processing cores or compute units for the component.","caption":"Cores","type_name":"Integer"},"embedding_model":{"type":"string_t","description":"Model used for creating embeddings in AI retrieval systems.","caption":"Embedding Model","type_name":"String"},"depth":{"type":"string_t","enum":{"Base":{"caption":"Base"},"Environmental":{"caption":"Environmental"},"Temporal":{"caption":"Temporal"}},"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score.","caption":"CVSS Depth","type_name":"String"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","is_array":true,"object_type":"malware","caption":"Malware","object_name":"Malware"},"kerberos_flags":{"type":"string_t","description":"A bitmask, either in hexadecimal or decimal form, which encodes various attributes or permissions associated with a Kerberos ticket. These flags delineate specific characteristics of the ticket, such as its renewability or forwardability.","references":[{"description":"RFC 4120: 5.2.8. KerberosFlags","url":"https://www.rfc-editor.org/rfc/rfc4120#section-5.2.8"},{"description":"Microsoft Windows Security 4769 (see 'Ticket Options')","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769"}],"caption":"Kerberos Flags","type_name":"String"},"target":{"type":"string_t","description":"The target of the event or object. See specific usage.","caption":"Target","type_name":"String"},"occurrence_details":{"type":"object_t","description":"Details about where in the target entity the specified information was discovered. See specific usage.","object_type":"occurrence_details","caption":"Occurrence Details","object_name":"Occurrence Details"},"boundary_id":{"type":"integer_t","enum":{"3":{"description":"External network traffic between two endpoints on the Internet or outside the network.","caption":"External"},"6":{"description":"Through a virtual private gateway","caption":"Virtual Private Gateway"},"0":{"description":"The connection boundary is unknown.","caption":"Unknown"},"1":{"description":"Local network traffic on the same endpoint.","caption":"Localhost"},"2":{"description":"Internal network traffic between two endpoints inside network.","caption":"Internal"},"99":{"description":"The boundary is not mapped. See the boundary attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Through another resource in the same VPC","caption":"Same VPC"},"5":{"description":"Through an Internet gateway or a gateway VPC endpoint","caption":"Internet/VPC Gateway"},"7":{"description":"Through an intra-region VPC peering connection","caption":"Intra-region VPC"},"8":{"description":"Through an inter-region VPC peering connection","caption":"Inter-region VPC"},"9":{"description":"Through a local gateway","caption":"Local Gateway"},"10":{"description":"Through a gateway VPC endpoint (Nitro-based instances only)","caption":"Gateway VPC"},"11":{"description":"Through an Internet gateway (Nitro-based instances only)","caption":"Internet Gateway"}},"description":"

The normalized identifier of the boundary of the connection.

For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

","caption":"Boundary ID","sibling":"boundary","type_name":"Integer"},"pod_uuid":{"type":"uuid_t","description":"The unique identifier of the pod (or equivalent) that the container is executing on.","caption":"Pod UUID","type_name":"UUID"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","caption":"Type Name","type_name":"String"},"body_length":{"type":"integer_t","description":"The actual length of the HTTP response/request body, in number of bytes, independent of a potentially existing Content-Length header.","caption":"Body Length not including header","type_name":"Integer"},"end_column":{"type":"integer_t","description":"The end column number. See specific usage.","caption":"End Column","type_name":"Integer"},"query_result":{"type":"string_t","description":"The result of the query.","caption":"Query Result","type_name":"String"},"win/service_file":{"type":"object_t","description":"For a user mode service (service_type_id 3 or 4) this is the executable program that the SCM launches as the service process.
For a kernel mode driver (service_type_id 1 or 2) this is the driver file loaded into the kernel at the request of the SCM. ","extension":"win","extension_id":2,"object_type":"file","caption":"Service File","object_name":"File"},"script":{"type":"object_t","description":"The script object.","object_type":"script","caption":"Script","object_name":"Script"},"port":{"type":"port_t","description":"The TCP/UDP port number associated with a connection. See specific usage.","caption":"Port","type_name":"Port"},"network_scope_id":{"type":"integer_t","enum":{"0":{"description":"Unknown whether this endpoint resides within the customer’s network.","caption":"Unknown"},"1":{"description":"The endpoint resides inside the customer’s network.","caption":"Internal"},"2":{"description":"The endpoint is on the Internet or otherwise external to the customer’s network.","caption":"External"},"99":{"description":"The network scope is not mapped. See the network_scope attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the endpoint’s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined.","caption":"Network Scope ID","sibling":"network_scope","type_name":"Integer"},"is_renewal":{"type":"boolean_t","description":"The indication of whether the event or object represents a renewal. See specific usage.","caption":"Renewal","type_name":"Boolean"},"namespace":{"type":"string_t","description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate.","caption":"Namespace","type_name":"String"},"client_hassh":{"type":"object_t","description":"The Client HASSH fingerprinting object.","object_type":"hassh","caption":"Client HASSH","object_name":"HASSH"},"launch_type_id":{"type":"integer_t","enum":{"3":{"description":"Denotes that the Launch event represents the \"exec\" step of Unix process creation, where a process replaces its executable image, command line, and environment. WSL1 pico processes on Windows also use the 2-step Unix model.","caption":"Exec"},"0":{"description":"The launch type is unknown or not specified.","caption":"Unknown"},"1":{"description":"Denotes that the Launch event represents atomic creation of a new process on Windows. This launch type ID may also be used to represent both steps of Unix process creation in a single Launch event.","caption":"Spawn"},"2":{"description":"Denotes that the Launch event represents the \"fork\" step of Unix process creation, where a process creates a clone of itself in a parent-child relationship. WSL1 pico processes on Windows also use the 2-step Unix model.","caption":"Fork"},"99":{"description":"The launch type is not mapped. See the launch_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier for the specific type of Launch activity.","references":[{"description":"fork() man page","url":"https://www.man7.org/linux/man-pages/man2/fork.2.html"},{"description":"execve() man page","url":"https://www.man7.org/linux/man-pages/man2/execve.2.html"}],"caption":"Launch Type ID","sibling":"launch_type","type_name":"Integer"},"format":{"type":"string_t","description":"The format, normalized to the caption of the format_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Format","type_name":"String"},"privilege_info":{"type":"object_t","description":"Information about a specific privilege, action, or permission.","object_type":"privilege_info","caption":"Privilege Info","object_name":"Privilege Info"},"section_d":{"type":"string_t","description":"The 'd' section of the JA4 fingerprint.","caption":"JA4 Section D","type_name":"String"},"mime_type":{"type":"string_t","description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable.","caption":"MIME type","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","caption":"Priority","type_name":"String"},"http_response":{"type":"object_t","description":"The HTTP Response from a web server to a requester.","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"fingerprints":{"type":"object_t","description":"An array of digital fingerprint objects.","is_array":true,"object_type":"fingerprint","caption":"Fingerprints","object_name":"Fingerprint"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"smtp_from":{"type":"email_t","description":"The value of the SMTP MAIL FROM command.","caption":"SMTP From","type_name":"Email Address","@deprecated":{"message":"Use the from attribute instead.","since":"1.4.0"}},"owner":{"type":"object_t","description":"The user that owns the file/object.","object_type":"user","caption":"Owner","object_name":"User"},"end_line":{"type":"integer_t","description":"The line number of the last line of code block identified as vulnerable.","caption":"End Line","type_name":"Integer"},"assessments":{"type":"object_t","description":"A list of assessment objects. See specific usage.","is_array":true,"object_type":"assessment","caption":"Assessments","object_name":"Assessment"},"full_name":{"type":"string_t","description":"The full name. See specific usage.","caption":"Full Name","type_name":"String"},"license_url":{"type":"url_t","description":"The URL pointing to the license applied on package or software. This is typically a LICENSE.md file within a repository.","caption":"Software License URL","type_name":"URL String"},"is_system":{"type":"boolean_t","description":"The indication of whether the object is part of the operating system.","caption":"System","type_name":"Boolean"},"group_name":{"type":"string_t","description":"The name of the group that the resource belongs to.","caption":"Group Name","type_name":"String","@deprecated":{"message":"Use the group.name attribute instead.","since":"1.1.0"}},"class_uid":{"type":"integer_t","description":"The unique identifier of a class. A class describes the attributes available in an event.","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"content_type":{"type":"string_t","description":"The request header that identifies the original media type of the resource (prior to any content encoding applied for sending).","caption":"HTTP Content Type","type_name":"String"},"win/reg_binary_data":{"type":"bytestring_t","description":"The data of the registry value when type_id is REG_BINARY or REG_NONE.","extension":"win","extension_id":2,"caption":"Registry Binary Data","type_name":"Byte String"},"query_time_dt":{"type":"datetime_t","description":"The Domain Name System (DNS) query time.","caption":"Query Time","type_name":"Datetime"},"data_security":{"type":"object_t","description":"The Data Security object describes the characteristics, techniques and content of a Data Loss Prevention (DLP), Data Loss Detection (DLD), Data Classification, or similar tools' finding, alert, or detection mechanism(s).","object_type":"data_security","caption":"Data Security","object_name":"Data Security"},"timespan":{"type":"object_t","description":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case type_id if present should be set to Other.

A timespan may also be defined by its time interval boundaries, start_time and end_time.","object_type":"timespan","caption":"Time Span","object_name":"Time Span"},"user":{"type":"object_t","description":"The user that pertains to the event or object.","object_type":"user","caption":"User","object_name":"User"},"extensions":{"type":"object_t","description":"The schema extensions used to create the event.","is_array":true,"object_type":"extension","caption":"Schema Extensions","object_name":"Schema Extension"},"login_endpoint":{"type":"url_t","description":"URL for initiating a login request. See specific usage.","caption":"Login Endpoint","type_name":"URL String"},"anomaly_analyses":{"type":"object_t","description":"A list of anomaly analysis results that examine and characterize patterns of activity or usage over time to identify normal vs abnormal activities. See specific usage.","is_array":true,"object_type":"anomaly_analysis","caption":"Anomaly Analyses","object_name":"Anomaly Analysis"},"files":{"type":"object_t","description":"The files that are part of the event or object.","is_array":true,"object_type":"file","caption":"Files","object_name":"File"},"account_switch_type":{"type":"string_t","description":"The account switch method, normalized to the caption of the account_switch_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Account Switch Type","type_name":"String"},"serial_number":{"type":"string_t","description":"The serial number that pertains to the object. See specific usage.","caption":"Serial Number","type_name":"String","observable":37},"subnet":{"type":"subnet_t","description":"The subnet mask.","caption":"Subnet","type_name":"Subnet"},"logon_type_id":{"type":"integer_t","enum":{"3":{"description":"A user or device logged onto this device from the network.","caption":"Network"},"0":{"description":"The logon type is unknown.","caption":"Unknown"},"1":{"description":"Used only by the System account, for example at system startup.","caption":"System"},"2":{"description":"A local logon to device console.","caption":"Interactive"},"99":{"description":"The logon type is not mapped. See the logon_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A batch server logon, where processes may be executing on behalf of a user without their direct intervention.","caption":"Batch"},"5":{"description":"A logon by a service or daemon that was started by the OS.","caption":"OS Service"},"7":{"description":"A user unlocked the device.","caption":"Unlock"},"8":{"description":"A user logged on to this device from the network. The user's password in the authentication package was not hashed.","caption":"Network Cleartext"},"9":{"description":"A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.","caption":"New Credentials"},"10":{"description":"A remote logon using Terminal Services or remote desktop application.","caption":"Remote Interactive"},"11":{"description":"A user logged on to this device with network credentials that were stored locally on the device and the domain controller was not contacted to verify the credentials.","caption":"Cached Interactive"},"12":{"description":"Same as Remote Interactive. This is used for internal auditing.","caption":"Cached Remote Interactive"},"13":{"description":"Workstation logon.","caption":"Cached Unlock"}},"description":"The normalized logon type identifier.","caption":"Logon Type ID","sibling":"logon_type","type_name":"Integer"},"sso":{"type":"object_t","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","object_type":"sso","caption":"SSO","object_name":"SSO"},"load_type":{"type":"string_t","description":"The load type, normalized to the caption of the load_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Load Type","type_name":"String"},"all_privileges_unused":{"type":"boolean_t","description":"Indicates whether all privileges in a set, list, collection or group are unused. See specific usage.","caption":"All Privileges Unused","type_name":"Boolean"},"categories":{"type":"string_t","description":"The Website categorization names, as defined by category_ids enum values.","is_array":true,"caption":"Website Categorization","type_name":"String"},"occurrences":{"type":"object_t","description":"A list of occurrence_details objects, each describing where in the target entity the specified information was discovered. See specific usage.","is_array":true,"object_type":"occurrence_details","caption":"Occurrences","object_name":"Occurrence Details"},"duration_years":{"type":"integer_t","description":"Represents the duration of the activity in years. See specific usage.","caption":"Duration Years","type_name":"Integer"},"prev_security_level_id":{"type":"integer_t","enum":{"3":{"caption":"Compromised"},"0":{"caption":"Unknown"},"1":{"caption":"Secure"},"2":{"caption":"At Risk"},"99":{"description":"The security level is not mapped. See the prev_security_level attribute, which contains data source specific values.","caption":"Other"}},"description":"The previous security level of the entity","caption":"Previous Security Level ID","sibling":"prev_security_level","type_name":"Integer"},"win/service_start_name":{"type":"string_t","description":"For a user mode service, this attribute represents the name of the account under which the service is run. For a kernel mode driver, this attribute represents the object name used to load the driver.","extension":"win","extension_id":2,"caption":"Service Start Name","type_name":"String"},"type":{"type":"string_t","description":"The type of an object or value, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Type","type_name":"String"},"num_network_items":{"type":"integer_t","description":"The number of network items scanned.","caption":"Scanned Network Items","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"loggers":{"type":"object_t","description":"An array of Logger objects that describe the pipeline of devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow and/or to track the chain of custody of the data.","is_array":true,"object_type":"logger","caption":"Loggers","object_name":"Logger"},"entity_result":{"type":"object_t","description":"The updated managed entity.","object_type":"managed_entity","caption":"Entity Result","object_name":"Managed Entity"},"is_compliant":{"type":"boolean_t","description":"The event occurred on a compliant device.","caption":"Compliant Device","type_name":"Boolean"},"cpu_architecture_id":{"type":"integer_t","enum":{"3":{"description":"CPU uses the RISC-V ISA. For bitness, refer to cpu_bits.","caption":"RISC-V"},"0":{"description":"The CPU architecture is unknown.","caption":"Unknown"},"1":{"description":"CPU uses the x86 ISA. For bitness, refer to cpu_bits.","caption":"x86"},"2":{"description":"CPU uses the ARM ISA. For bitness, refer to cpu_bits.","caption":"ARM"},"99":{"description":"The CPU architecture is not mapped. See the cpu_architecture attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the CPU architecture.","caption":"CPU Architecture ID","sibling":"cpu_architecture","type_name":"Integer"},"function_keys":{"type":"integer_t","description":"The number of function keys on client keyboard.","caption":"Function Keys","type_name":"Integer"},"imei":{"type":"string_t","description":"The International Mobile Equipment Identity that is associated with the device.","caption":"IMEI","type_name":"String","@deprecated":{"message":"Use the imei_list attribute instead.","since":"1.4.0"}},"fix_coverage_id":{"type":"integer_t","enum":{"0":{"description":"The fix coverage is unknown.","caption":"Unknown"},"99":{"description":"The fix coverage is not mapped. See the fix_coverage attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier for fix coverage. See specific usage.","caption":"Fix Coverage ID","sibling":"fix_coverage","type_name":"Integer"},"message_context":{"type":"object_t","description":"Communication context for AI system interactions including protocols, roles, clients, and session information for MCP and other AI communication systems.","object_type":"message_context","caption":"Message Context","object_name":"Message Context"},"network_scope":{"type":"string_t","description":"Indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined. The value is normalized to the caption of the network_scope_id.","caption":"Network Scope","type_name":"String"},"ldap_cn":{"type":"string_t","description":"The LDAP and X.500 commonName attribute, typically the full name of the person. For example, John Doe.","caption":"LDAP Common Name","type_name":"String"},"win/service_error_control":{"type":"string_t","description":"The service error control, normalized to the caption of the service_error_control_id value. In the case of 'Other', it is defined by the event source.","extension":"win","extension_id":2,"caption":"Service Error Control","type_name":"String"},"granted_privileges":{"type":"string_t","description":"The Privileges that were granted to the user via an IAM policy or otherwise. See specific usage.","is_array":true,"caption":"Granted Privileges","type_name":"String"},"bios_ver":{"type":"string_t","description":"The BIOS version. For example: LENOVO G5ETA2WW (2.62).","caption":"BIOS Version","type_name":"String"},"security_states":{"type":"object_t","description":"The current security states. See specific usage.","is_array":true,"object_type":"security_state","caption":"Security States","object_name":"Security State"},"signature":{"type":"object_t","description":"The digital signature of the file.","object_type":"digital_signature","caption":"Digital Signature","object_name":"Digital Signature"},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","object_type":"container","caption":"Container","object_name":"Container"},"invoked_by":{"type":"string_t","description":"The name of the service that invoked the activity as described in the event.","caption":"Invoked by","type_name":"String"},"mitigation":{"type":"object_t","description":"The Mitigation object describes the MITRE ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"object_type":"mitigation","caption":"MITRE Mitigation","object_name":"MITRE Mitigation"},"factor_type":{"type":"string_t","description":"The type of authentication factor used in an authentication attempt.","caption":"Factor Type","type_name":"String"},"bytes_missed":{"type":"long_t","description":"Indicates the number of bytes missed, which is representative of packet loss.","caption":"Bytes Missed","type_name":"Long"},"scale_factor":{"type":"integer_t","description":"The numeric scale factor of display.","caption":"Scale Factor","type_name":"Integer"},"category_ids":{"type":"integer_t","enum":{"30":{"caption":"Art/Culture"},"97":{"caption":"Content Servers"},"57":{"caption":"Remote Access Tools"},"38":{"caption":"Technology/Internet"},"63":{"caption":"Personal Sites"},"29":{"caption":"Charitable Organizations"},"83":{"caption":"Peer-to-Peer (P2P)"},"45":{"caption":"Job Search/Careers"},"40":{"caption":"Search Engines/Portals"},"112":{"caption":"Media Sharing"},"22":{"caption":"Alternative Spirituality/Belief"},"56":{"caption":"File Storage/Sharing"},"51":{"caption":"Chat (IM)/SMS"},"61":{"caption":"Society/Daily Living"},"101":{"caption":"Spam"},"47":{"caption":"Personals/Dating"},"96":{"caption":"Non-Viewable/Infrastructure"},"33":{"caption":"Games"},"59":{"caption":"Auctions"},"53":{"caption":"Newsgroups/Forums"},"1":{"caption":"Adult/Mature Content"},"99":{"description":"The Domain/URL category is not mapped. See the categories attribute, which contains a data source specific value.","caption":"Other"},"68":{"caption":"Humor/Jokes"},"92":{"caption":"Suspicious"},"20":{"caption":"Entertainment"},"54":{"caption":"Religion"},"107":{"caption":"Informational"},"3":{"caption":"Pornography"},"15":{"caption":"Weapons"},"34":{"caption":"Government/Legal"},"103":{"caption":"Dynamic DNS Host"},"50":{"caption":"Mixed Content/Potentially Adult"},"110":{"caption":"Internet Telephony"},"106":{"caption":"E-Card/Invitations"},"93":{"caption":"Sexual Expression"},"64":{"caption":"Restaurants/Dining/Food"},"25":{"caption":"Controlled Substances"},"86":{"caption":"Proxy Avoidance"},"87":{"caption":"For Kids"},"71":{"caption":"Software Downloads"},"49":{"caption":"Reference"},"37":{"caption":"Health"},"114":{"caption":"TV/Video Streams"},"121":{"caption":"Marijuana"},"118":{"caption":"Piracy/Copyright Concerns"},"98":{"caption":"Placeholders"},"16":{"caption":"Abortion"},"27":{"caption":"Education"},"7":{"caption":"Extreme"},"23":{"caption":"Alcohol"},"32":{"caption":"Brokerage/Trading"},"18":{"caption":"Phishing"},"36":{"caption":"Political/Social Advocacy"},"113":{"caption":"Radio/Audio Streams"},"90":{"caption":"Uncategorized"},"84":{"caption":"Audio/Video Clips"},"17":{"caption":"Hacking"},"26":{"caption":"Child Pornography"},"35":{"caption":"Military"},"4":{"caption":"Sex Education"},"65":{"caption":"Sports/Recreation"},"95":{"caption":"Translation"},"43":{"caption":"Malicious Sources/Malnets"},"21":{"caption":"Business/Economy"},"67":{"caption":"Vehicles"},"52":{"caption":"Email"},"14":{"caption":"Violence/Hate/Racism"},"85":{"caption":"Office/Business Applications"},"55":{"caption":"Social Networking"},"6":{"caption":"Nudity"},"0":{"description":"The Domain/URL category is unknown.","caption":"Unknown"},"44":{"caption":"Malicious Outbound Data/Botnets"},"11":{"caption":"Gambling"},"109":{"caption":"Internet Connected Devices"},"88":{"caption":"Web Ads/Analytics"},"9":{"caption":"Scam/Questionable/Illegal"},"5":{"caption":"Intimate Apparel/Swimsuit"},"31":{"caption":"Financial Services"},"60":{"caption":"Real Estate"},"89":{"caption":"Web Hosting"},"24":{"caption":"Tobacco"},"66":{"caption":"Travel"},"111":{"caption":"Online Meetings"},"102":{"caption":"Potentially Unwanted Software"},"46":{"caption":"News/Media"},"108":{"caption":"Computer/Information Security"},"58":{"caption":"Shopping"}},"description":"The Website categorization identifiers.","is_array":true,"caption":"Website Categorization IDs","sibling":"categories","type_name":"Integer"},"imei_list":{"type":"string_t","description":"The International Mobile Equipment Identity values that are associated with the device.","is_array":true,"caption":"IMEI List","type_name":"String"},"flag_ids":{"type":"integer_t","enum":{"0":{"description":"The flag is unknown.","caption":"Unknown"},"99":{"description":"The flag is not mapped. See the flags attribute, which contains a data source specific value.","caption":"Other"}},"description":"The list of normalized identifiers of the communication flag IDs. See specific usage.","is_array":true,"caption":"Communication Flag IDs","sibling":"flags","type_name":"Integer"},"section_c":{"type":"string_t","description":"The 'c' section of the JA4 fingerprint.","caption":"JA4 Section C","type_name":"String"},"return_value":{"type":"string_t","description":"The value returned from a function.","caption":"Return Value","type_name":"String"},"network_driver":{"type":"string_t","description":"The network driver used by the container. For example, bridge, overlay, host, none, etc.","caption":"Network Driver","type_name":"String"},"exploit_last_seen_time_dt":{"type":"datetime_t","description":"The time when the exploit was most recently observed.","caption":"Exploit Last Seen Time","type_name":"Datetime"},"injection_type_id":{"type":"integer_t","enum":{"3":{"caption":"Queue APC"},"0":{"description":"The injection type is unknown.","caption":"Unknown"},"1":{"caption":"Remote Thread"},"2":{"caption":"Load Library"},"99":{"description":"The injection type is not mapped. See the injection_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the process injection method.","caption":"Injection Type ID","sibling":"injection_type","type_name":"Integer"},"http_method":{"type":"string_t","description":"The HTTP request method indicates the desired action to be performed for a given resource. Expected values:

","caption":"HTTP Method","type_name":"String"},"baselines":{"type":"object_t","description":"A list of baseline measurements or normal behavior patterns used as reference points for comparison and anomaly detection. See specific usage.","is_array":true,"object_type":"baseline","caption":"Baselines","object_name":"Baseline"},"start_offset":{"type":"long_t","description":"The starting offset. See specific usage.","caption":"Start Offset","type_name":"Long"},"attributes":{"type":"integer_t","description":"The bitmask value that represents the file attributes.","caption":"Attributes","type_name":"Integer"},"last_login_time_dt":{"type":"datetime_t","description":"The last time when the user logged in.","caption":"Last Login","type_name":"Datetime"},"query_time":{"type":"timestamp_t","description":"The Domain Name System (DNS) query time.","caption":"Query Time","type_name":"Timestamp"},"open_type":{"type":"string_t","description":"The file open type.","caption":"Open Type","type_name":"String"},"start_line":{"type":"integer_t","description":"The line number of the first line of code block identified as vulnerable.","caption":"Start Line","type_name":"Integer"},"subgroup":{"type":"object_t","description":"A subgroup that was added to or removed from the group.","object_type":"group","caption":"Subgroup","object_name":"Group"},"duration_hours":{"type":"integer_t","description":"Represents the duration of the activity in hours. See specific usage.","caption":"Duration Hours","type_name":"Integer"},"observations":{"type":"object_t","description":"A list of individual observations or measurements collected during analysis. Each observation captures a specific data point. See specific usage.","is_array":true,"object_type":"observation","caption":"Observations","object_name":"Observation"},"uri":{"type":"url_t","description":"A Uniform Resource Identifier (URI) is a string of characters that identifies a resource on the Internet. URIs can identify physical resources, like webpages and documents. See specific usage.","references":[{"description":"RFC 3986","url":"https://datatracker.ietf.org/doc/html/rfc3986"}],"caption":"URI","type_name":"URL String"},"lat":{"type":"float_t","description":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.","caption":"Latitude","type_name":"Float"},"cipher":{"type":"string_t","description":"The negotiated cipher suite.","caption":"Cipher Suite","type_name":"String"},"spf":{"type":"string_t","description":"The Sender Policy Framework (SPF) status of the email.","caption":"SPF Status","type_name":"String"},"cost_center":{"type":"string_t","description":"The cost center associated with the user.","caption":"Cost Center","type_name":"String"},"encoding_id":{"type":"integer_t","enum":{"0":{"description":"The encoding method is unknown.","caption":"Unknown"},"99":{"description":"The encoding method is not mapped. See the encoding attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the encoding method. See specific usage.","caption":"Encoding ID","sibling":"encoding","type_name":"Integer"},"tunnel_interface":{"type":"object_t","description":"The information about the tunnel interface. See specific usage.","object_type":"network_interface","caption":"Interface","object_name":"Network Interface"},"devices":{"type":"object_t","description":"The object describes details related to the list of devices.","is_array":true,"object_type":"device","caption":"Devices","object_name":"Device"},"cpu_type":{"type":"string_t","description":"The processor type. For example: x86 Family 6 Model 37 Stepping 5.","caption":"Processor Type","type_name":"String"},"given_name":{"type":"string_t","description":"The given or first name of the user.","caption":"Given Name","type_name":"String"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized type identifier of an object. See specific usage.","caption":"Type ID","sibling":"type","type_name":"Integer"},"altitude_ceiling":{"type":"string_t","description":"Maximum altitude (WGS-84 HAE) for a group or an Intent-Based Network Participant. Measured in meters. Special Values: Invalid, No Value, or Unknown: -1000 m.","caption":"Altitude Ceiling","type_name":"String"},"control":{"type":"string_t","description":"A Control is prescriptive, prioritized, and simplified set of best practices that one can use to strengthen their cybersecurity posture. e.g. AWS SecurityHub Controls, CIS Controls.","caption":"Security Control","type_name":"String"},"section_b":{"type":"string_t","description":"The 'b' section of the JA4 fingerprint.","caption":"JA4 Section B","type_name":"String"},"idp":{"type":"object_t","description":"This object describes details about the Identity Provider used.","object_type":"idp","caption":"Identity Provider","object_name":"Identity Provider"},"packets":{"type":"long_t","description":"The total number of packets (in and out).","caption":"Total Packets","type_name":"Long"},"sbom":{"type":"object_t","description":"The Software Bill of Materials (SBOM) object describes the characteristics of a generated SBOM for a software package.","object_type":"sbom","caption":"Software Bill Of Materials","object_name":"Software Bill of Materials"},"domain":{"type":"string_t","description":"The name of the domain. See specific usage.","caption":"Domain","type_name":"String"},"relation":{"type":"string_t","description":"The relationship between two entities. See specific usage.","caption":"Relation","type_name":"String"},"data":{"type":"json_t","description":"The additional data that is associated with the event or object. See specific usage.","caption":"Data","type_name":"JSON"},"reply_to_list":{"type":"email_t","description":"The machine-readable email header Reply-To values, as defined by RFC 5322. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Reply To List","type_name":"Email Address"},"phase_id":{"type":"integer_t","enum":{"3":{"description":"The intruders will use various tactics, such as phishing, infected USB drives, etc.","caption":"Delivery"},"6":{"description":"Malware opens a command channel to enable the intruders to remotely manipulate the victim's system.","caption":"Command & Control"},"0":{"description":"The kill chain phase is unknown.","caption":"Unknown"},"1":{"description":"The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them.","caption":"Reconnaissance"},"2":{"description":"The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities.","caption":"Weaponization"},"99":{"description":"The kill chain phase is not mapped. See the phase attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The intruders start leveraging vulnerabilities to executed code on the victim’s system.","caption":"Exploitation"},"5":{"description":"The intruders install malware on the victim’s system.","caption":"Installation"},"7":{"description":"With hands-on keyboard access, intruders accomplish the mission’s goal.","caption":"Actions on Objectives"}},"description":"The cyber kill chain phase identifier.","caption":"Kill Chain Phase ID","sibling":"phase","type_name":"Integer"},"kernel":{"type":"object_t","description":"The kernel resource object that pertains to the event.","object_type":"kernel","caption":"Kernel","object_name":"Kernel Resource"},"gpu_info_list":{"type":"object_t","description":"An array of objects describing describing Graphical Processing Unit hardware.","is_array":true,"object_type":"gpu_info","caption":"GPU information","object_name":"GPU Information"},"runtime":{"type":"string_t","description":"The backend running the container, such as containerd or cri-o.","caption":"Runtime","type_name":"String"},"tls_extension_list":{"type":"object_t","description":"The list of TLS extensions.","is_array":true,"object_type":"tls_extension","caption":"TLS Extension List","object_name":"TLS Extension"},"is_mobile_account_active":{"type":"boolean_t","description":"Indicates whether the device has an active mobile account. For example, this is indicated by the itunesStoreAccountActive value within JAMF Pro mobile devices.","caption":"Mobile Account Active","type_name":"Boolean"},"ime":{"type":"string_t","description":"The Input Method Editor (IME) file name.","caption":"IME","type_name":"String"},"install_state":{"type":"string_t","description":"The install state, normalized to the caption of install_state_id. In the case of 'Other', it is defined by the event source.","caption":"Install State","type_name":"String"},"chunks":{"type":"long_t","description":"A unit of information within an SCTP packet, consisting of a chunk header and chunk-specific content. See RFC 4960. This field can be used for the total number of chunks (in and out).","caption":"Chunks","type_name":"Long"},"detection_pattern_type":{"type":"string_t","description":"The detection pattern type, normalized to the caption of the detection_pattern_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Detection Pattern","type_name":"String"},"nist":{"type":"string_t","description":"The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk.","is_array":true,"caption":"NIST List","type_name":"String"},"pool":{"type":"object_t","description":"An unordered collection of resources. See specific usage.","object_type":"group","caption":"Pool","object_name":"Group"},"post_value":{"type":"string_t","description":"The value after. See specific usage.","caption":"Post-Value","type_name":"String"},"ai_role_id":{"type":"integer_t","description":"The originator or target role of the message.","caption":"AI Role ID","sibling":"ai_role","type_name":"Integer"},"command_response":{"type":"string_t","description":"The response to the command.","caption":"Command Response","type_name":"String"},"kb_articles":{"type":"string_t","description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.","is_array":true,"caption":"Knowledgebase Articles","type_name":"String","@deprecated":{"message":"Use the kb_article_list attribute instead.","since":"1.1.0"}},"packet":{"type":"object_t","description":"The packet object describes a single captured network packet and its associated metadata.","object_type":"packet","caption":"Packet","object_name":"Packet"},"log_version":{"type":"string_t","description":"The log version. See specific usage.","caption":"Log Version","type_name":"String"},"interface_name":{"type":"string_t","description":"The name of the network interface (e.g. eth2).","caption":"Network Interface Name","type_name":"String"},"accessors":{"type":"object_t","description":"A list of users who have access to an entity. See specific usage.","is_array":true,"object_type":"user","caption":"Accessors","object_name":"User"},"module":{"type":"object_t","description":"The module that pertains to the event.","object_type":"module","caption":"Module","object_name":"Module"},"vulnerability":{"type":"object_t","description":"The vulnerability object describes details related to the observed vulnerability","object_type":"vulnerability","caption":"Vulnerability","object_name":"Vulnerability Details"},"xattributes":{"type":"object_t","description":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute.

For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS:

","object_type":"object","caption":"Extended Attributes","object_name":"Object"},"bytes_in":{"type":"long_t","description":"The number of bytes sent from the destination to the source.","caption":"Bytes In","type_name":"Long"},"prev_security_states":{"type":"object_t","description":"The previous security states. See specific usage.","is_array":true,"object_type":"security_state","caption":"Previous Security States","object_name":"Security State"},"integrity":{"type":"string_t","description":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only).","caption":"Integrity","type_name":"String"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"vector_string":{"type":"string_t","description":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.","caption":"Vector String","type_name":"String"},"share":{"type":"string_t","description":"The share name. See specific usage.","caption":"Share","type_name":"String"},"record_index_in_array":{"type":"integer_t","description":"The index of the record in the array of records.","caption":"Record Index in Array","type_name":"Integer"},"dkim_domain":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) signing domain of the email.","caption":"DKIM Domain","type_name":"String"},"duration_mins":{"type":"integer_t","description":"Represents the duration of the activity in minutes. See specific usage.","caption":"Duration Minutes","type_name":"Integer"},"modified_time_dt":{"type":"datetime_t","description":"The time when the object was last modified. See specific usage.","caption":"Modified Time","type_name":"Datetime"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","caption":"Verdict","type_name":"String"},"win/service_category":{"type":"string_t","description":"The service category, normalized to the caption of the service_category_id value. In the case of 'Other', it is defined by the event source.","extension":"win","extension_id":2,"caption":"Service Category","type_name":"String"},"format_id":{"type":"integer_t","enum":{"0":{"description":"The format is unknown.","caption":"Unknown"},"99":{"description":"The format is not mapped. See the format attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the format. See specific usage.","caption":"Format ID","sibling":"format","type_name":"Integer"},"cpe_name":{"type":"string_t","description":"The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.","caption":"The product CPE identifier","type_name":"String"},"hash":{"type":"object_t","description":"The hash attribute is the value of a digital fingerprint including information about its algorithm.","object_type":"fingerprint","caption":"Hash","object_name":"Fingerprint"},"end_offset":{"type":"long_t","description":"The ending offset. See specific usage.","caption":"End Offset","type_name":"Long"},"labels":{"type":"string_t","description":"The list of labels attached to an entity. See specific usage.","is_array":true,"caption":"Labels","type_name":"String"},"args":{"type":"string_t","description":"The arguments sent along with the HTTP request.","caption":"HTTP Arguments","type_name":"String"},"security_level":{"type":"string_t","description":"The current security level of the entity","caption":"Security Level","type_name":"String"},"sender":{"type":"email_t","description":"The machine readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the from field, which shows the message author. The sender field is most commonly used when multiple addresses appear in the from_list field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else).","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Sender","type_name":"Email Address"},"detection_pattern":{"type":"string_t","description":"Specific pattern, algorithm, fingerprint, or model used for detection.","caption":"Detection Pattern","type_name":"String"},"is_managed":{"type":"boolean_t","description":"The event occurred on a managed device.","caption":"Managed Device","type_name":"Boolean"},"coordinates":{"type":"float_t","description":"A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. For example: [-73.983, 40.719].","is_array":true,"caption":"Coordinates","type_name":"Float","@deprecated":{"message":"Use specific lat, long attributes instead.","since":"1.2.0"}},"connection_uid":{"type":"string_t","description":"The network connection identifier.","caption":"Connection Identifier","type_name":"String"},"json_path":{"type":"string_t","description":"The JSON path of the attribute. See specific usage.","caption":"JSON Path","type_name":"String"},"hypervisor":{"type":"string_t","description":"The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.","caption":"Hypervisor","type_name":"String"},"endpoint_connections":{"type":"object_t","description":"Contains information about network connection attempts. See specific usage.","is_array":true,"object_type":"endpoint_connection","caption":"Endpoint Connections","object_name":"Endpoint Connection"},"image":{"type":"object_t","description":"The image used as a template to run a container or virtual machine.","object_type":"image","caption":"Image","object_name":"Image"},"error_message":{"type":"string_t","description":"Error Message","caption":"Error Message","type_name":"String"},"rcode_id":{"type":"integer_t","enum":{"0":{"description":"The DNS response code is unknown.","caption":"Unknown"},"99":{"description":"The DNS response code is not defined by the RFC. See the rcode attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the server response code. See specific usage.","caption":"Response Code ID","sibling":"rcode","type_name":"Integer"},"advisory":{"type":"object_t","description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor.","object_type":"advisory","caption":"Security Advisory","object_name":"Advisory"},"eid":{"type":"string_t","description":"An Embedded Identity Document, is a unique serial number that identifies an eSIM-enabled device.","caption":"EID","type_name":"String"},"imported_symbols":{"type":"string_t","description":"A list of symbols imported by the executable file.","is_array":true,"caption":"Imported Symbols","type_name":"String"},"num_trusted_items":{"type":"integer_t","description":"The number of trusted items.","caption":"Trusted","type_name":"Integer"},"run_modes":{"type":"string_t","description":"The list of run_modes, normalized to the captions of the run_mode_ids values. In the case of 'Other', they are defined by the event source. See specific usage.","is_array":true,"caption":"Run Modes","type_name":"String"},"win/reg_value":{"type":"object_t","description":"The registry value.","extension":"win","extension_id":2,"object_type":"win/reg_value","caption":"Registry Value","object_name":"Registry Value"},"observed_pattern":{"type":"string_t","description":"A detected pattern or trend identified in the analyzed data, describing recurring activities or characteristics.","caption":"Observed Pattern","type_name":"String"},"auth_factors":{"type":"object_t","description":"Describes a category of methods used for identity verification. See specific usage.","is_array":true,"object_type":"auth_factor","caption":"Authentication Factors","object_name":"Authentication Factor"},"win/prev_reg_key":{"type":"object_t","description":"The registry key before the mutation","extension":"win","extension_id":2,"object_type":"win/reg_key","caption":"Previous Registry Key","object_name":"Registry Key"},"fingerprint":{"type":"object_t","description":"The digital fingerprint associated with an object.","object_type":"fingerprint","caption":"Fingerprint","object_name":"Fingerprint"},"vertical_speed":{"type":"string_t","description":"Vertical speed upward relative to the WGS-84 datum, measured in meters per second. Special Values: Invalid, No Value, or Unknown: 63 m/s.","caption":"Vertical Speed","type_name":"String"},"product":{"type":"object_t","description":"The product that reported the event.","object_type":"product","caption":"Product","object_name":"Product"},"auth_type_id":{"type":"integer_t","enum":{"0":{"description":"The authentication type is unknown.","caption":"Unknown"},"99":{"description":"The authentication type is not mapped. See the auth_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the agreed upon authentication type. See specific usage.","caption":"Authentication Type ID","sibling":"auth_type","type_name":"Integer"},"group":{"type":"object_t","description":"The group object associated with an entity such as user, policy, or rule.","object_type":"group","caption":"Group","object_name":"Group"},"relationship_id":{"type":"integer_t","enum":{"0":{"description":"The relationship is unknown.","caption":"Unknown"},"1":{"description":"The component is a dependency of another component. Can be used to define both direct and transitive dependencies.","caption":"Depends On"},"99":{"description":"The relationship is not mapped. See the relationship attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the relationship between two software components.","caption":"Relationship ID","sibling":"relationship","type_name":"Integer"},"raw_header":{"type":"string_t","description":"The email authentication header.","caption":"Raw Header","type_name":"String"},"detection_system_id":{"type":"integer_t","enum":{"3":{"description":"A Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) tool that can detect sensitive data and/or enforce data security policies on mobile devices (e.g., cellphones, tablets, End User Devices [EUDs]).","caption":"Mobile Device Management"},"6":{"description":"A Secure Email Gateway (SEG) is any tool that can detect sensitive data and/or enforce data security policies within email systems. E.g., Microsoft Defender for Office, Google Workspaces.","caption":"Secure Email Gateway"},"0":{"description":"The type is not mapped. See the detection_system attribute, which contains a data source specific value.","caption":"Unknown"},"1":{"description":"A dedicated agent or sensor installed on a device, either a dedicated data security tool or an Endpoint Detection & Response (EDR) tool that can detect sensitive data and/or enforce data security policies. E.g., Forcepoint DLP, Symantec DLP, Microsoft Defender for Endpoint (MDE).","caption":"Endpoint"},"2":{"description":"A Data Loss Prevention (DLP) gateway that is positioned in-line of an information store such as a network share, a database, or otherwise that can detect sensitive data and/or enforce data security policies.","caption":"DLP Gateway"},"99":{"description":"Any other type of detection system or a multi-variate system made up of several other systems.","caption":"Other"},"4":{"description":"A tool that actively identifies and classifies sensitive data in digital media and information stores in accordance with a policy or automated functionality. E.g, Amazon Macie, Microsoft Purview.","caption":"Data Discovery & Classification"},"5":{"description":"A Secure Web Gateway (SWG) is any tool that can detect sensitive data and/or enforce data security policies at a network-edge such as within a proxy or firewall service.","caption":"Secure Web Gateway"},"7":{"description":"A Digital Rights Management (DRM) or a dedicated Information Rights Management (IRM) are tools which can detect sensitive data and/or enforce data security policies on digital media via policy or user access rights.","caption":"Digital Rights Management"},"8":{"description":"A Cloud Access Security Broker (CASB) that can detect sensitive data and/or enforce data security policies in-line to cloud systems such as the public cloud or Software-as-a-Service (SaaS) tool. E.g., Forcepoint CASB, SkyHigh Security.","caption":"Cloud Access Security Broker"},"9":{"description":"A Database Activity Monitoring (DAM) tool that can detect sensitive data and/or enforce data security policies as part of a dedicated database or warehouse monitoring solution.","caption":"Database Activity Monitoring"},"10":{"description":"A built in Data Loss Prevention (DLP) or other data security capability within a tool or platform such as an Enterprise Resource Planning (ERP) or Customer Relations Management (CRM) tool that can detect sensitive data and/or enforce data security policies.","caption":"Application-Level DLP"},"11":{"description":"Any Developer Security tool such as an Infrastructure-as-Code (IAC) security scanner, Secrets Detection, or Secure Software Development Lifecycle (SSDLC) tool that can detect sensitive data and/or enforce data security policies. E.g., TruffleHog, GitGuardian, Git-Secrets.","caption":"Developer Security"},"12":{"description":"A Data Security Posture Management (DSPM) tool is a continuous monitoring and data discovery solution that can detect sensitive data and/or enforce data security policies for local and cloud environments. E.g., Cyera, Sentra, IBM Polar Security.","caption":"Data Security Posture Management"}},"description":"The type of data security tool or system that the finding, detection, or alert originated from.","caption":"Detection System ID","sibling":"detection_system","type_name":"Integer"},"finding_info_list":{"type":"object_t","description":"A list of finding_info objects associated to an incident.","is_array":true,"object_type":"finding_info","caption":"Finding Information List","object_name":"Finding Information"},"access_list":{"type":"string_t","description":"The list of requested access rights.","is_array":true,"caption":"Access List","type_name":"String"},"peripheral_device":{"type":"object_t","description":"The peripheral device that triggered the event.","object_type":"peripheral_device","caption":"Peripheral Device","object_name":"Peripheral Device"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","caption":"ISP Name","type_name":"String"},"databucket":{"type":"object_t","description":"The data bucket object is a basic container that holds data, typically organized through the use of data partitions.","object_type":"databucket","caption":"Databucket","object_name":"Databucket"},"x_originating_ip":{"type":"ip_t","description":"The X-Originating-IP header identifying the emails originating IP address(es).","is_array":true,"caption":"X-Originating-IP","type_name":"IP Address"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","caption":"Risk Details","type_name":"String"},"geodetic_vertical_accuracy":{"type":"string_t","description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.","caption":"Geodetic Vertical Accuracy","type_name":"String"},"auid":{"type":"integer_t","description":"The audit user assigned at login by the audit subsystem.","caption":"Audit User ID","type_name":"Integer"},"checks":{"type":"object_t","description":"A list of specific, individual compliance verification checks derived from standard or non-standard benchmark rules or requirements.","is_array":true,"object_type":"check","caption":"Compliance Checks","object_name":"Check"},"d3f_tactic":{"type":"object_t","description":"The D3FEND Tactic object describes the defensive tactic name associated with a countermeasure.","references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"object_type":"d3f_tactic","caption":"MITRE D3FEND™ Tactic","object_name":"MITRE D3FEND™ Tactic"},"release":{"type":"string_t","description":"Release is the number of times a version of the software has been packaged.","caption":"Software Release Details","type_name":"String"},"server_hassh":{"type":"object_t","description":"The Server HASSH fingerprinting object.","object_type":"hassh","caption":"Server HASSH","object_name":"HASSH"},"sequence_number":{"type":"long_t","description":"The sequence number. See specific usage.","caption":"Sequence Number","type_name":"Long"},"evidences":{"type":"object_t","description":"A collection of evidence artifacts associated to the activity/activities that triggered a finding. See specific usage.","is_array":true,"object_type":"evidences","caption":"Evidence Artifacts","object_name":"Evidence Artifacts"},"hire_time_dt":{"type":"datetime_t","description":"The timestamp when the user was or will be hired by the organization.","caption":"Hire Time","type_name":"Datetime"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"auth_protocol":{"type":"string_t","description":"The authentication protocol as defined by the caption of auth_protocol_id. In the case of Other, it is defined by the event source.","caption":"Auth Protocol","type_name":"String"},"tactics":{"type":"object_t","description":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by ATT&CK® Matrix.","is_array":true,"object_type":"tactic","caption":"Tactics","@deprecated":{"message":"Use the tactic attribute instead.","since":"1.1.0"},"object_name":"MITRE Tactic"},"bios_manufacturer":{"type":"string_t","description":"The BIOS manufacturer. For example: LENOVO.","caption":"BIOS Manufacturer","type_name":"String"},"message_uid":{"type":"string_t","description":"The email header Message-ID value, as defined by RFC 5322.","source":"Message-ID","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Message UID","type_name":"String","observable":42},"is_remote":{"type":"boolean_t","description":"The indication of whether the session is remote.","caption":"Remote","type_name":"Boolean"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","caption":"Timezone Offset","type_name":"Integer"},"last_used_time_dt":{"type":"datetime_t","description":"The most recent usage time of an entity. See specific usage.","caption":"Last Used Time","type_name":"Datetime"},"last_seen_time":{"type":"timestamp_t","description":"The most recent detection time of the activity or object. See specific usage.","caption":"Last Seen","type_name":"Timestamp"},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","caption":"Namespace PID","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"email_uid":{"type":"string_t","description":"The unique identifier of the email, used to correlate related email alert and activity events.","caption":"Email UID","type_name":"String","@deprecated":{"message":"Use the email.uid attribute instead.","since":"1.4.0"}},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"scheme":{"type":"string_t","description":"The scheme portion of the URL. For example: http, https, ftp, or sftp.","caption":"Scheme","type_name":"String"},"category_uid":{"type":"integer_t","description":"The category unique identifier of the event.","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","caption":"Suspected Breach","type_name":"Boolean"},"launch_type":{"type":"string_t","description":"The specific type of Launch activity, normalized to the caption of the launch_type_id value. In the case of Other it is defined by the event source.","caption":"Launch Type","type_name":"String"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"access_result":{"type":"json_t","description":"The list of access check results.","caption":"Access Check Result","type_name":"JSON"},"query_language":{"type":"string_t","description":"The query language, normalized to the caption of the query_language_id value. See specific usage.","caption":"Query Language","type_name":"String"},"handshake_dur":{"type":"integer_t","description":"The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds.","caption":"Handshake Duration","type_name":"Integer"},"signatures":{"type":"object_t","description":"A collection of Digital Signature objects.","is_array":true,"object_type":"digital_signature","caption":"Digital Signatures","object_name":"Digital Signature"},"scim_group_schema":{"type":"json_t","description":"SCIM provides a schema for representing groups, identified using the following schema URI: urn:ietf:params:scim:schemas:core:2.0:Group as defined in RFC-7634. This attribute will capture key-value pairs for the scheme implemented in a SCIM resource.","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC spec.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"caption":"SCIM Group Schema","type_name":"JSON"},"is_http_only":{"type":"boolean_t","description":"This attribute prevents the cookie from being accessed via JavaScript.","caption":"HTTP Only","type_name":"Boolean"},"model":{"type":"string_t","description":"The model name of an entity. See specific usage.","caption":"Model","type_name":"String"},"is_encrypted":{"type":"boolean_t","description":"Indicates if the entity was encrypted. See specific usage.","caption":"Encrypted","type_name":"Boolean"},"share_type":{"type":"string_t","description":"The share type, normalized to the caption of the share_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Share Type","type_name":"String"},"service_privilege_analysis":{"type":"object_t","description":"Privilege analysis results for a single cloud service or resource namespace.","object_type":"service_privilege_analysis","caption":"Service Privilege Analysis","object_name":"Service Privilege Analysis"},"reporter":{"type":"object_t","description":"The entity from which an event or finding was first reported. See specific usage.","object_type":"reporter","caption":"Reporter","object_name":"Reporter"},"classifier_details":{"type":"object_t","description":"Describes details about the classifier used for data classification.","object_type":"classifier_details","caption":"Classifier Details","object_name":"Classifier Details"},"action_id":{"type":"integer_t","enum":{"0":{"description":"The action was unknown.","caption":"Unknown"},"1":{"description":"The activity was allowed.","caption":"Allowed"},"2":{"description":"The attempted activity was denied.","caption":"Denied"},"99":{"description":"The action was not mapped. See the action attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized action taken by a control or other policy-based system leading to an outcome or disposition.","caption":"Action ID","sibling":"action","type_name":"Integer"},"opnum":{"type":"integer_t","description":"An operation number used to identify a specific remote procedure call (RPC) method or a method in an interface.","caption":"Opnum","type_name":"Integer"},"mac_vendor":{"type":"string_t","description":"The vendor or manufacturer of the network interface controller (NIC) identified from the MAC address. For example: Apple, Inc., Intel Corporate.","references":[{"description":"IEEE Registration Authority","url":"https://standards.ieee.org/products-programs/regauth/"}],"caption":"MAC Vendor","type_name":"String"},"integrity_id":{"type":"integer_t","enum":{"3":{"caption":"Medium"},"6":{"caption":"Protected"},"0":{"description":"The integrity level is unknown.","caption":"Unknown"},"1":{"caption":"Untrusted"},"2":{"caption":"Low"},"99":{"description":"The integrity level is not mapped. See the integrity attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"High"},"5":{"caption":"System"}},"description":"The normalized identifier of the process integrity level (Windows only).","caption":"Integrity Level","sibling":"integrity","type_name":"Integer"},"internal_name":{"type":"string_t","description":"The name by which a resource identifies itself internally. See specific usage.","caption":"Internal Name","type_name":"String"},"name":{"type":"string_t","description":"The name of the entity. See specific usage.","caption":"Name","type_name":"String"},"is_on_premises":{"type":"boolean_t","description":"Indicates whether the location is on-premises.","caption":"On-Premises","type_name":"Boolean"},"access_type":{"type":"string_t","description":"The type or category of access being granted to the identity. See specific usage.","caption":"Access Type","type_name":"String"},"event_uid":{"type":"string_t","description":"The unique identifier of an event. See specific usage.","caption":"Event UID","type_name":"String"},"class":{"type":"string_t","description":"The class name of the object. See specific usage.","caption":"Class","type_name":"String"},"intrusion_sets":{"type":"string_t","description":"A grouping of adversarial behaviors and resources believed to be associated with specific threat actors or campaigns. Intrusion sets often encompass multiple campaigns and are used to organize related activities under a common label.","is_array":true,"caption":"Intrusion Sets","type_name":"String"},"geohash":{"type":"string_t","description":"

Geohash of the geo-coordinates (latitude and longitude).

Geohashing is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string.","caption":"Geohash","type_name":"String"},"mac":{"type":"mac_t","description":"The Media Access Control (MAC) address that is associated with the network interface.","caption":"MAC Address","type_name":"MAC Address"},"privilege_info_list":{"type":"object_t","description":"A list of privilege information objects, where each element describes a specific privilege, action, or permission with its usage status.","is_array":true,"object_type":"privilege_info","caption":"Privilege Info List","object_name":"Privilege Info"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"provider":{"type":"string_t","description":"The origin of information associated with the event. See specific usage.","caption":"Provider","type_name":"String"},"authentication_token":{"type":"object_t","description":"The authentication token, ticket, or assertion. See specific usage.","object_type":"authentication_token","caption":"Authentication Token","object_name":"Authentication Token"},"instance_uid":{"type":"string_t","description":"The unique identifier of a VM instance.","caption":"Instance ID","type_name":"String"},"metadata_endpoint":{"type":"url_t","description":"URL where metadata about a configuration or resource is available (e.g., for SAML configurations). See specific usage.","caption":"Metadata Endpoint","type_name":"URL String"},"parent_uid":{"type":"string_t","description":"The unique identifier of an object's parent object. See specific usage.","caption":"Parent Unique ID","type_name":"String"},"message_trace_uid":{"type":"string_t","description":"The identifier that tracks a message that travels through multiple points of a messaging service.","references":[{"description":"For example Office 365 Message Trace Report.","url":"https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)"}],"caption":"Message Trace UID","type_name":"String"},"nodes":{"type":"object_t","description":"The list of node objects that are part of the graph.","is_array":true,"object_type":"node","caption":"Nodes","object_name":"Node"},"num_resolutions":{"type":"integer_t","description":"The number of items that were resolved.","caption":"Resolutions","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period. See specific usage.","caption":"Start Time","type_name":"Timestamp"},"is_secure":{"type":"boolean_t","description":"The cookie attribute indicates that cookies are sent to the server only when the request is encrypted using the HTTPS protocol.","caption":"Secure","type_name":"Boolean"},"is_new_logon":{"type":"boolean_t","description":"Indicates logon is from a device not seen before or a first time account logon.","caption":"New Logon","type_name":"Boolean"},"additional_restrictions":{"type":"object_t","description":"The supplementary restrictions that may apply to an entity, by the virtue of a policy. See specific usage.","is_array":true,"object_type":"additional_restriction","caption":"Additional Restrictions","object_name":"Additional Restriction"},"algorithm_id":{"type":"integer_t","enum":{"0":{"description":"The algorithm is unknown.","caption":"Unknown"},"99":{"description":"The algorithm is not mapped. See the algorithm attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the algorithm. See specific usage.","caption":"Algorithm ID","sibling":"algorithm","type_name":"Integer"},"observation_parameter":{"type":"string_t","description":"The name of the parameter being analyzed or monitored. This generally identifies the specific characteristic or property being measured. See specific usage.","caption":"Observation Parameter","type_name":"String"},"direction":{"type":"string_t","description":"The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source.","caption":"Direction","type_name":"String"},"token":{"type":"object_t","description":"The Token object is the base object for representing tokens, API keys, and authentication credentials. This object provides common attributes for all token types and can be used directly in API activity events to represent API tokens (type_id: 7) or client tokens (type_id: 6) such as Okta API tokens or Microsoft Entra ID Application Registration client secrets. The base token object is also extended by authentication_token for protocol-specific authentication tokens in authentication events. Note: Use authentication_token (which extends token) for protocol-specific authentication tokens (Kerberos, OIDC, SAML) in authentication events, and programmatic_credential for tracking credential lifecycle and usage patterns.","object_type":"token","caption":"Token","object_name":"Token"},"subnet_uid":{"type":"string_t","description":"The unique identifier of a virtual subnet.","caption":"Subnet UID","type_name":"String"},"access_level":{"type":"string_t","description":"The access level of an entity. See specific usage.","caption":"Access Level","type_name":"String"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"auth_protocol_id":{"type":"integer_t","enum":{"3":{"caption":"Digest"},"6":{"caption":"OAUTH 2.0"},"0":{"description":"The authentication protocol is unknown.","caption":"Unknown"},"1":{"caption":"NTLM"},"2":{"caption":"Kerberos"},"99":{"description":"The authentication protocol is not mapped. See the auth_protocol attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"OpenID"},"5":{"caption":"SAML"},"7":{"caption":"PAP"},"8":{"caption":"CHAP"},"9":{"caption":"EAP"},"10":{"caption":"RADIUS"},"11":{"caption":"Basic Authentication"},"12":{"caption":"LDAP"}},"description":"The normalized identifier of the authentication protocol used to create the user session.","caption":"Auth Protocol ID","sibling":"auth_protocol","type_name":"Integer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"url":{"type":"object_t","description":"The URL object that pertains to the event or object. See specific usage.","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"desktop_display":{"type":"object_t","description":"The desktop display affiliated with the event","object_type":"display","caption":"Desktop Display","object_name":"Display"},"cis_csc":{"type":"object_t","description":"The CIS Critical Security Controls is a list of top 20 actions and practices an organization’s security team can take on such that cyber attacks or malware, are minimized and prevented.","is_array":true,"object_type":"cis_csc","caption":"CIS CSC","@deprecated":{"message":"Use CIS Controls for standard benchmark controls.","since":"1.5.0"},"object_name":"CIS CSC"},"deleted_time":{"type":"timestamp_t","description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days.","caption":"Deleted Time","type_name":"Timestamp"},"decision":{"type":"string_t","description":"Decision/outcome of the authorization mechanism (e.g. Approved, Denied)","caption":"Authorization Decision/Outcome","type_name":"String"},"last_authentication_time":{"type":"timestamp_t","description":"The timestamp when this identity last successfully authenticated to any system or service. See specific usage.","caption":"Last Authentication Time","type_name":"Timestamp"},"architecture":{"type":"string_t","description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on.","caption":"Architecture","type_name":"String"},"win/win_resource":{"type":"object_t","description":"The Windows resource object that was accessed, such as a mutant or timer.","extension":"win","extension_id":2,"object_type":"win/win_resource","caption":"Windows Resource","object_name":"Windows Resource"},"service":{"type":"object_t","description":"The service that pertains to the event.","object_type":"service","caption":"Service","object_name":"Service"},"resource_type":{"type":"string_t","description":"The resource type as defined by the event source.","caption":"Resource Type","type_name":"String"},"permission_analysis_results":{"type":"object_t","description":"Describes analysis results of permissions, policies directly associated with an identity (user, role, or service account). This evaluates what permissions an identity has been granted through attached policies, which privileges are actively used versus unused, and identifies potential over-privileged access. Use this for identity-centric security assessments such as privilege audits, dormant permission discovery, and least-privilege compliance analysis.","is_array":true,"object_type":"permission_analysis_result","caption":"Permission Analysis Results","object_name":"Permission Analysis Result"},"response":{"type":"object_t","description":"General Purpose API Response Object. See specific usage.","object_type":"response","caption":"API Response Details","object_name":"Response Elements"},"evidence":{"type":"json_t","description":"The data the finding exposes to the analyst.","caption":"Evidence","type_name":"JSON","@deprecated":{"message":"Use the evidences attribute instead.","since":"1.1.0"}},"is_mfa":{"type":"boolean_t","description":"Indicates whether Multi Factor Authentication was used during authentication.","caption":"Multi Factor Authentication","type_name":"Boolean"},"uploaded_time_dt":{"type":"datetime_t","description":"The timestamp at which an entity was uploaded. See specific usage.","caption":"Uploaded Time","type_name":"Datetime"},"is_trusted":{"type":"boolean_t","description":"The event occurred on a trusted device.","caption":"Trusted Device","type_name":"Boolean"},"base_score":{"type":"float_t","description":"The base score as reported by the event source. See specific usage.","caption":"Base Score","type_name":"Float"},"assessment":{"type":"object_t","description":"The Assessment object describes a point-in-time assessment, check, or evaluation of a specific configuration or signal against an asset, entity, person, or otherwise. For example, this can encapsulate os_signals from CrowdStrike Falcon Zero Trust Assessments, or account for Datastore configurations from Cyera.","object_type":"assessment","caption":"Assessment","object_name":"Assessment"},"resource":{"type":"object_t","description":"The target resource.","object_type":"resource_details","caption":"Resource","object_name":"Resource Details"},"client_dialects":{"type":"string_t","description":"The list of SMB dialects that the client speaks.","is_array":true,"caption":"Client Dialects","type_name":"String"},"database":{"type":"object_t","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","object_type":"database","caption":"Database","object_name":"Database"},"tid":{"type":"integer_t","description":"The identifier of the thread associated with the event, as returned by the operating system.","caption":"Thread ID","type_name":"Integer","@deprecated":{"message":"tid is deprecated in favor of ptid. ptid has type long_t which can accommodate the thread identifiers returned by all platforms (e.g. 64-bit on MacOS).","since":"1.6.0"}},"command_responses":{"type":"string_t","description":"The responses to the command.","is_array":true,"caption":"Command Responses","type_name":"String"},"unmanned_system_operator":{"type":"object_t","description":"The human or machine operator of an Unmanned System.","object_type":"user","caption":"Unmanned Systems Operator","object_name":"User"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"The normalized observation point value. See specific usage.","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","object_type":"device","caption":"Device","object_name":"Device"},"references":{"type":"string_t","description":"A list of reference URLs supporting the finding/detection.","is_array":true,"caption":"References","type_name":"String"},"fix_coverage":{"type":"string_t","description":"The fix coverage, normalized to the caption of the fix_coverage_id value. See specific usage.","caption":"Fix Coverage","type_name":"String"},"is_exploit_available":{"type":"boolean_t","description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability.","caption":"Exploit Availability","type_name":"Boolean"},"run_state_id":{"type":"integer_t","enum":{"0":{"description":"The run state is unknown.","caption":"Unknown"},"99":{"description":"The run state is not mapped. See the run_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the state of the job or service. See specific usage.","caption":"Run State ID","sibling":"run_state","type_name":"Integer"},"accessed_time":{"type":"timestamp_t","description":"The time when the file was last accessed.","caption":"Accessed Time","type_name":"Timestamp"},"unique_malware_count":{"type":"integer_t","description":"The number of unique malware detected during a scan. See specific usage.","caption":"Unique Malware Count","type_name":"Integer"},"is_group_provisioning_enabled":{"type":"boolean_t","description":"Indicates whether group provisioning is automated (e.g., for a SCIM resource). See specific usage.","caption":"Group Provisioning Enabled","type_name":"Boolean"},"install_state_id":{"type":"integer_t","enum":{"3":{"description":"The item is installed pending reboot operation.","caption":"Installed Pending Reboot"},"0":{"description":"The normalized install state is unknown.","caption":"Unknown"},"1":{"description":"The item is installed.","caption":"Installed"},"2":{"description":"The item is not installed.","caption":"Not Installed"},"99":{"description":"The install state is not mapped. See the install_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized state of the install.","caption":"Install State ID","sibling":"install_state","type_name":"Integer"},"answers":{"type":"object_t","description":"The Domain Name System (DNS) answers.","is_array":true,"object_type":"dns_answer","caption":"DNS Answer","object_name":"DNS Answer"},"d3f_technique":{"type":"object_t","description":"The D3FEND Technique object describes the defensive technique ID and/or name associated with a countermeasure.","references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"object_type":"d3f_technique","caption":"MITRE D3FEND™ Technique","object_name":"MITRE D3FEND™ Technique"},"algorithm":{"type":"string_t","description":"The applicable algorithm, normalized to the caption of 'algorithm_id'. See specific usage.","caption":"Algorithm","type_name":"String"},"analysis_targets":{"type":"object_t","description":"The specific dimensions, components, or aspects of the system that are the targets of the analysis. See specific usage.","is_array":true,"object_type":"analysis_target","caption":"Analysis Targets","object_name":"Analysis Target"},"dnssec_status_id":{"type":"integer_t","enum":{"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"The related domain enables the signing of DNS records using DNSSEC.","caption":"Signed"},"2":{"description":"The related domain does not enable the signing of DNS records using DNSSEC.","caption":"Unsigned"},"99":{"description":"The DNSSEC status is not mapped. See the dnssec_status attribute, which contains a data source specific value.","caption":"Other"}},"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain.","caption":"DNSSEC Status ID","sibling":"dnssec_status","type_name":"Integer"},"os_machine_uuid":{"type":"uuid_t","description":"The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid. In Linux, this is stored in the file: /etc/machine-id.","caption":"OS Machine UUID","type_name":"UUID"},"create_mask":{"type":"string_t","description":"The original Windows mask that is required to create the object.","caption":"Create Mask","type_name":"String"},"privileges":{"type":"string_t","description":"The user or group privileges.","is_array":true,"caption":"Privileges","type_name":"String"},"account_switch_type_id":{"type":"integer_t","enum":{"0":{"description":"The account switch type is unknown.","caption":"Unknown"},"1":{"description":"A utility like sudo, su, or equivalent was used to perform actions in the context of another user.","references":[{"description":"sudo documentation","url":"https://www.sudo.ws/"},{"description":"su Linux manual page","url":"https://man7.org/linux/man-pages/man1/su.1.html"},{"description":"su macOS manual page","url":"https://www.unix.com/man_page/osx/1/su/"}],"caption":"Substitute User"},"2":{"description":"An API like ImpersonateLoggedOnUser() or equivalent was used to perform actions in the context of another user.","references":[{"description":"Microsoft ImpersonateLoggedOnUser() documentation","url":"https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-impersonateloggedonuser"}],"caption":"Impersonate"},"99":{"description":"The account switch type is not mapped. See the account_switch_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the account switch method.","caption":"Account Switch Type ID","sibling":"account_switch_type","type_name":"Integer"},"duration_secs":{"type":"integer_t","description":"Represents the duration of the activity in seconds. See specific usage.","caption":"Duration Seconds","type_name":"Integer"},"log_type_id":{"type":"integer_t","enum":{"0":{"description":"The log type is unknown.","caption":"Unknown"},"1":{"description":"The log type is an Operating System log.","caption":"OS"},"2":{"description":"The log type is an Application log.","caption":"Application"},"99":{"description":"The log type is not mapped. See the log_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized log type identifier.","caption":"Log Type ID","sibling":"log_type","type_name":"Integer"},"unused_services_count":{"type":"integer_t","description":"The number of unused services. See specific usage.","caption":"Unused Services Count","type_name":"Integer"},"extension_list":{"type":"object_t","description":"The list of TLS extensions.","is_array":true,"object_type":"tls_extension","caption":"Extension List","@deprecated":{"message":"Use the tls_extension_list attribute instead.","since":"1.1.0"},"object_name":"TLS Extension"},"uuid":{"type":"uuid_t","description":"The universally unique identifier. See specific usage.","caption":"UUID","type_name":"UUID"},"load_type_id":{"type":"integer_t","enum":{"0":{"description":"The load type is unknown.","caption":"Unknown"},"99":{"description":"The load type is not mapped. See the load_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the load type. See specific usage.","caption":"Load Type ID","sibling":"load_type","type_name":"Integer"},"desc":{"type":"string_t","description":"The description that pertains to the object or event. See specific usage.","caption":"Description","type_name":"String"},"src_url":{"type":"url_t","description":"The URL pointing towards the source of an entity. See specific usage.","caption":"Source URL","type_name":"URL String"},"cve":{"type":"object_t","description":"The Common Vulnerabilities and Exposures (CVE) identifiers for the vulnerability.","object_type":"cve","caption":"CVE","object_name":"CVE"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","is_array":true,"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"customer_uid":{"type":"string_t","description":"The unique customer identifier.","caption":"Customer UID","type_name":"String","@deprecated":{"message":"Use the tenant_uid attribute instead.","since":"1.1.0"}},"color_depth":{"type":"integer_t","description":"The numeric color depth.","caption":"Color Depth","type_name":"Integer"},"orchestrator":{"type":"string_t","description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift.","caption":"Orchestrator","type_name":"String"},"sequence":{"type":"integer_t","description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.","caption":"Sequence Number","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time when the object was created. See specific usage.","caption":"Created Time","type_name":"Timestamp"},"vlan_uid":{"type":"string_t","description":"The Virtual LAN identifier.","caption":"VLAN","type_name":"String"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"hire_time":{"type":"timestamp_t","description":"The timestamp when the user was or will be hired by the organization.","caption":"Hire Time","type_name":"Timestamp"},"subject":{"type":"string_t","description":"The identifier of the subject. See specific usage.","caption":"Subject Details","type_name":"String"},"short_desc":{"type":"string_t","description":"The short description that pertains to the object or event. See specific usage.","caption":"Short Description","type_name":"String"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","object_type":"actor","caption":"Actor","object_name":"Actor"},"cis_benchmark_result":{"type":"object_t","description":"The CIS Benchmark Result object captures results generated from benchmark evaluations as defined by the Center for Internet Security (CIS).","object_type":"cis_benchmark_result","caption":"CIS Benchmark Result","@deprecated":{"message":"Use Compliance object with Check object instead.","since":"1.5.0"},"object_name":"CIS Benchmark Result"},"delivered_to":{"type":"email_t","description":"The machine-readable Delivered-To email header field. For example example.user@usersdomain.com","caption":"Delivered To","type_name":"Email Address","@deprecated":{"message":"Use the delivered_to_list attribute instead.","since":"1.4.0"}},"web_resources_result":{"type":"object_t","description":"The results of the activity on web resources. It should contain the new values of the changed attributes of the web resources.","is_array":true,"object_type":"web_resource","caption":"Web Resources Result","object_name":"Web Resource"},"match_details":{"type":"string_t","description":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'.","is_array":true,"caption":"Match Details","type_name":"String"},"opcode_id":{"type":"integer_t","enum":{"3":{"description":"Reserved, not used","caption":"Reserved"},"6":{"description":"DNS Stateful Operations (DSO)","caption":"DSO Message"},"0":{"description":"Standard query","caption":"Query"},"1":{"description":"Inverse query, obsolete","caption":"Inverse Query"},"2":{"description":"Server status request","caption":"Status"},"99":{"description":"The DNS Opcode is not defined by the RFC. See the opcode attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Zone change notification","caption":"Notify"},"5":{"description":"Dynamic DNS update","caption":"Update"}},"description":"The DNS opcode ID specifies the normalized query message type as defined in RFC-5395.","caption":"DNS Opcode ID","type_name":"Integer","suppress_checks":["enum_convention"]},"credential_uid":{"type":"string_t","description":"The unique identifier of the user's credential. For example, AWS Access Key ID.","caption":"User Credential ID","type_name":"String","observable":19},"open_mask":{"type":"integer_t","description":"The Windows options needed to open a registry key.","caption":"Open Mask","type_name":"Integer"},"logon_process":{"type":"object_t","description":"The trusted process that validated the authentication credentials.","object_type":"process","caption":"Logon Process","object_name":"Process"},"attempt":{"type":"integer_t","description":"The delivery attempt.","caption":"Attempt","type_name":"Integer"},"start_address":{"type":"string_t","description":"The start address of the execution.","caption":"Start Address","type_name":"String"},"rcode":{"type":"string_t","description":"The server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source.","caption":"Response Code","type_name":"String"},"ttl":{"type":"integer_t","description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached.","caption":"TTL","type_name":"Integer"},"domain_contact":{"type":"object_t","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","object_type":"domain_contact","caption":"Domain Contact","object_name":"Domain Contact"},"details":{"type":"string_t","description":"Details of an entity. See specific usage","caption":"Details","type_name":"String"},"logged_time":{"type":"timestamp_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","caption":"Logged Time","type_name":"Timestamp"},"tcp_state_id":{"type":"integer_t","enum":{"3":{"description":"The socket has passively received a connection request from a remote peer.","caption":"SYN-RECEIVED"},"6":{"description":"The socket connection has been closed by the local application, the remote peer has closed its half of the connection, and the system is waiting to be sure that the remote peer received the last acknowledgement.","caption":"TIME-WAIT"},"0":{"description":"The socket state is unknown.","caption":"Unknown"},"1":{"description":"The socket has an established connection between a local application and a remote peer.","caption":"ESTABLISHED"},"2":{"description":"The socket is actively trying to establish a connection to a remote peer.","caption":"SYN-SENT"},"4":{"description":"The socket connection has been closed by the local application, the remote peer has not yet acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN-WAIT-1"},"5":{"description":"The socket connection has been closed by the local application, the remote peer has acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN-WAIT-2"},"7":{"description":"The socket is not in use.","caption":"CLOSED"},"8":{"description":"The socket connection has been closed by the remote peer, and the system is waiting for the local application to close its half of the connection.","caption":"CLOSE-WAIT"},"9":{"description":"The socket connection has been closed by the remote peer, the local application has closed its half of the connection, and the system is waiting for the remote peer to acknowledge the close.","caption":"LAST-ACK"},"10":{"description":"The socket is listening for incoming connections.","caption":"LISTEN"},"11":{"description":"The socket connection has been closed by the local application and the remote peer simultaneously, and the remote peer has not yet acknowledged the close attempt of the local application.","caption":"CLOSING"}},"description":"The state of the TCP socket for the network connection.","references":[{"description":"RFC 9293","url":"https://datatracker.ietf.org/doc/html/rfc9293"}],"caption":"TCP State ID","type_name":"Integer"},"duration_days":{"type":"integer_t","description":"Represents the duration of the activity in days. See specific usage.","caption":"Duration Days","type_name":"Integer"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication. Examples include network taps, span ports, inline security devices, or packet capture systems.","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"physical_orientation":{"type":"integer_t","description":"The numeric physical orientation of display.","caption":"Physical Orientation","type_name":"Integer"},"is_cleartext":{"type":"boolean_t","description":"Indicates whether the credentials were passed in clear text.

Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text.

","caption":"Cleartext Credentials","type_name":"Boolean"},"stratum_id":{"type":"integer_t","enum":{"0":{"description":"Unspecified or invalid.","caption":"Unknown"},"1":{"description":"The highest precision primary server (e.g atomic clock or GPS).","caption":"Primary Server"},"2":{"description":"A secondary level server (possible values: 2-15).","caption":"Secondary Server"},"99":{"description":"The stratum level is not mapped. See the stratum attribute, which contains a data source specific value.","caption":"Other"},"16":{"caption":"Unsynchronized"},"17":{"description":"Reserved stratum (possible values: 17-255).","caption":"Reserved"}},"description":"The normalized identifier of the stratum level, as defined in RFC-5905.","caption":"Stratum ID","sibling":"stratum","type_name":"Integer"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","caption":"Disposition","type_name":"String"},"svc_name":{"type":"string_t","description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service.","caption":"Service Name","type_name":"String"},"query":{"type":"object_t","description":"The Domain Name System (DNS) query.","object_type":"dns_query","caption":"DNS Query","object_name":"DNS Query"},"tcp_flags":{"type":"integer_t","description":"The network connection TCP header flags (i.e., control bits).","caption":"TCP Flags","type_name":"Integer"},"issuer":{"type":"string_t","description":"The identifier of the issuer. See specific usage.","caption":"Issuer Details","type_name":"String"},"win/prev_reg_value":{"type":"object_t","description":"The registry value before the mutation","extension":"win","extension_id":2,"object_type":"win/reg_value","caption":"Previous Registry Value","object_name":"Registry Value"},"confidentiality_id":{"type":"integer_t","enum":{"3":{"caption":"Secret"},"6":{"caption":"Restricted"},"0":{"description":"The confidentiality is unknown.","caption":"Unknown"},"1":{"caption":"Not Confidential"},"2":{"caption":"Confidential"},"99":{"description":"The confidentiality is not mapped. See the confidentiality attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Top Secret"},"5":{"caption":"Private"}},"description":"The normalized identifier of the file content confidentiality indicator.","caption":"Confidentiality ID","sibling":"confidentiality","type_name":"Integer"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"related_cwes":{"type":"object_t","description":"Describes Common Weakness Enumeration (CWE) entries that are related to an entity. See specific usage.","is_array":true,"object_type":"cwe","caption":"Related CWEs","object_name":"CWE"},"hostname":{"type":"hostname_t","description":"The hostname of an endpoint or a device.","caption":"Hostname","type_name":"Hostname"},"boundary":{"type":"string_t","description":"The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source.

For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

","caption":"Boundary","type_name":"String"},"lang":{"type":"string_t","description":"The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).","caption":"Language","type_name":"String"},"type_uid":{"type":"long_t","description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","caption":"Type ID","sibling":"type_name","type_name":"Long"},"meets_criteria":{"type":"boolean_t","description":"Determines if an assessment, control, policy, or otherwise meets its assessment criteria. See specific usage.","caption":"Meets Criteria","type_name":"Boolean"},"length":{"type":"integer_t","description":"The HTTP response length, in number of bytes.","caption":"Response Length","type_name":"Integer"},"deleted_time_dt":{"type":"datetime_t","description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days.","caption":"Deleted Time","type_name":"Datetime"},"registrar":{"type":"string_t","description":"The domain registrar.","caption":"Domain Registrar","type_name":"String"},"original_event_uid":{"type":"string_t","description":"The unique identifier assigned to the event in its original logging system before transformation to OCSF format. This field preserves the source system's native event identifier, enabling traceability back to the raw log entry. For example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or a database transaction log sequence number.","caption":"Original Event ID","type_name":"String"},"win/win_service":{"type":"object_t","description":"The Windows service.","extension":"win","extension_id":2,"object_type":"win/win_service","caption":"Windows Service","object_name":"Windows Service"},"access_mask":{"type":"integer_t","description":"The access mask in a platform-native format.","caption":"Access Mask","type_name":"Integer"},"http_status":{"type":"integer_t","description":"The Hypertext Transfer Protocol (HTTP) status code returned to the client.","caption":"HTTP Status","type_name":"Integer","@deprecated":{"message":"Use the http_response.code attribute instead.","since":"1.1.0"}},"transmit_time_dt":{"type":"datetime_t","description":"The event transmission time from one device to another. See specific usage.","caption":"Transmission Time","type_name":"Datetime"},"is_applied":{"type":"boolean_t","description":"A determination if a policy, rule, or enforcement action was applied.","caption":"Applied","type_name":"Boolean"},"relay":{"type":"object_t","description":"The network relay that is associated with the event.","object_type":"network_interface","caption":"Relay","object_name":"Network Interface"},"access_analysis_result":{"type":"object_t","description":"Describes access relationships and pathways between identities, resources, focusing on who can access what and through which mechanisms. This evaluates access levels (read/write/admin), access types (direct, cross-account, public, federated), and the conditions under which access is granted. Use this for resource-centric security assessments such as external access discovery, public exposure analysis, etc.","object_type":"access_analysis_result","caption":"Access Analysis Result","object_name":"Access Analysis Result"},"cloud_partition":{"type":"string_t","description":"The logical grouping or isolated segment within a cloud provider's infrastructure. See specific usage.","caption":"Cloud Partition","type_name":"String"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"ja3_hash":{"type":"object_t","description":"The MD5 hash of a JA3 string.","object_type":"fingerprint","caption":"JA3 Hash","object_name":"Fingerprint"},"entity":{"type":"object_t","description":"The managed entity that is being acted upon.","object_type":"managed_entity","caption":"Entity","object_name":"Managed Entity"},"locations":{"type":"object_t","description":"A list of detailed geographical locations.","is_array":true,"object_type":"location","caption":"Geo Locations","object_name":"Geo Location"},"is_locked":{"type":"boolean_t","description":"Indicates if the entity is locked. See specific usage.","caption":"Locked","type_name":"Boolean"},"injection_type":{"type":"string_t","description":"The process injection method, normalized to the caption of the injection_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Injection Type","type_name":"String"},"standards":{"type":"string_t","description":"Compliance standards are a set of criteria organizations can follow to protect sensitive and confidential information. e.g. NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001","is_array":true,"caption":"Compliance Standards: List","type_name":"String"},"email_addrs":{"type":"email_t","description":"A list of additional email addresses for the user.","is_array":true,"caption":"Email Addresses","type_name":"Email Address"},"data_sources":{"type":"string_t","description":"A list of data sources utilized in generation of the finding.","is_array":true,"caption":"Data Sources","type_name":"String"},"trace":{"type":"object_t","description":"The information about the trace. See specific usage.","object_type":"trace","caption":"Trace","object_name":"Trace"},"campaign":{"type":"object_t","description":"The campaign object describes details about the campaign that was the source of the activity.","object_type":"campaign","caption":"Campaign","object_name":"Campaign"},"types":{"type":"string_t","description":"The type/s of an entity. See specific usage.","is_array":true,"caption":"Types","type_name":"String"},"sender_mailbox":{"type":"string_t","description":"The human readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the from_mailbox field, which shows the message author. The sender mailbox field is most commonly used when multiple addresses appear in the from_mailboxes field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else).","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Sender Mailbox","type_name":"String"},"meid":{"type":"string_t","description":"The Mobile Equipment Identifier. It's a unique number that identifies a Code Division Multiple Access (CDMA) mobile device.","caption":"MEID","type_name":"String"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","is_array":true,"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"reply_to_mailboxes":{"type":"string_t","description":"The human-readable email header Reply To Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"Reply To Mailboxes","type_name":"String"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","caption":"Risk Score","type_name":"Integer"},"capabilities":{"type":"string_t","description":"A list of RDP capabilities.","is_array":true,"caption":"Capabilities","type_name":"String"},"finding":{"type":"object_t","description":"The Finding object provides details about a finding/detection generated by a security tool.","object_type":"finding","caption":"Finding","object_name":"Finding"},"codes":{"type":"integer_t","description":"The list of numeric responses sent to a request.","is_array":true,"caption":"Response Codes","type_name":"Integer"},"job":{"type":"object_t","description":"The job object that pertains to the event.","object_type":"job","caption":"Job","object_name":"Job"},"command_uid":{"type":"string_t","description":"The unique command identifier.","caption":"Command UID","type_name":"String"},"is_personal":{"type":"boolean_t","description":"The event occurred on a personal device.","caption":"Personal Device","type_name":"Boolean"},"criticality":{"type":"string_t","description":"Criticality of a resource/object in question","caption":"Criticality","type_name":"String"},"num_skipped_items":{"type":"integer_t","description":"The number of skipped items.","caption":"Skipped","type_name":"Integer"},"first_seen_time":{"type":"timestamp_t","description":"The initial detection time of the activity or object. See specific usage","caption":"First Seen","type_name":"Timestamp"},"action":{"type":"string_t","description":"The normalized caption of 'action_id' or the source specific action.","caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"sandbox":{"type":"string_t","description":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.","caption":"Sandbox","type_name":"String"},"role":{"type":"string_t","description":"The role of an entity in the context of the event or finding, normalized to the caption of the role_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Role","type_name":"String"},"execute_count":{"type":"integer_t","description":"The execute count. See specific usage.","caption":"Execute Count","type_name":"Integer"},"dkim":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) status of the email.","caption":"DKIM Status","type_name":"String"},"run_state":{"type":"string_t","description":"The state of the job or service, normalized to the caption of the run_state_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Run State","type_name":"String"},"lineage":{"type":"file_path_t","description":"The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami'].","is_array":true,"caption":"Lineage","type_name":"File Path"},"referrer":{"type":"string_t","description":"The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested.","caption":"HTTP Referrer","type_name":"String"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","is_array":true,"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"tactic":{"type":"object_t","description":"The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"object_type":"tactic","caption":"MITRE Tactic","object_name":"MITRE Tactic"},"parent_process":{"type":"object_t","description":"The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the ancestry attribute.","references":[{"description":"Guidance on Representing Process Parentage","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"}],"object_type":"process","caption":"Parent Process","object_name":"Process"},"cis_controls":{"type":"object_t","description":"The CIS Critical Security Controls is a prioritized set of actions to protect your organization and data from cyber-attack vectors.","is_array":true,"object_type":"cis_control","caption":"CIS Controls","object_name":"CIS Control"},"schedule_uid":{"type":"string_t","description":"The unique identifier of the schedule associated with a scan job.","caption":"Schedule UID","type_name":"String"},"city":{"type":"string_t","description":"The name of the city.","caption":"City","type_name":"String"},"profiles":{"type":"string_t","description":"The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.","is_array":true,"caption":"Profiles","type_name":"String"},"boot_uid":{"type":"string_t","description":"A unique identifier of the device that changes after every reboot. For example, the value of /proc/sys/kernel/random/boot_id from Linux's procfs.","references":[{"description":"Linux kernel's documentation","url":"https://docs.kernel.org/admin-guide/sysctl/kernel.html#random"}],"caption":"Boot UID","type_name":"String"},"num_folders":{"type":"integer_t","description":"The number of folders scanned.","caption":"Scanned Folders","type_name":"Integer"},"long":{"type":"float_t","description":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.","caption":"Longitude","type_name":"Float"},"num_processes":{"type":"integer_t","description":"The number of processes scanned.","caption":"Scanned Processes","type_name":"Integer"},"identifier_cookie":{"type":"string_t","description":"The client identifier cookie during client/server exchange.","caption":"Identifier Cookie","type_name":"String"},"cpu_cores":{"type":"integer_t","description":"The number of processor cores in all installed processors. For Example: 42.","caption":"CPU Cores","type_name":"Integer"},"keyboard_info":{"type":"object_t","description":"The keyboard detailed information.","object_type":"keyboard_info","caption":"Keyboard Information","object_name":"Keyboard Information"},"created_time_dt":{"type":"datetime_t","description":"The time when the object was created. See specific usage.","caption":"Created Time","type_name":"Datetime"},"autonomous_system":{"type":"object_t","description":"The Autonomous System details associated with an IP address.","object_type":"autonomous_system","caption":"Autonomous System","object_name":"Autonomous System"},"vendor_id_list":{"type":"string_t","description":"The list of vendor IDs. See specific usage.","is_array":true,"caption":"Vendor ID List","type_name":"String"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","is_array":true,"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"completion_tokens":{"type":"integer_t","description":"Number of tokens in the model's response/completion for this message.","caption":"Completion Tokens","type_name":"Integer"},"fixed_in_version":{"type":"string_t","description":"The software package version in which a reported vulnerability was patched/fixed.","caption":"Fixed In Version","type_name":"String"},"transformation_info_list":{"type":"object_t","description":"An array of transformation info that describes the mappings or transforms applied to the data.","is_array":true,"object_type":"transformation_info","caption":"Transformation Info","object_name":"Transformation Info"},"is_vpn":{"type":"boolean_t","description":"The indication of whether the session is a VPN session.","caption":"VPN Session","type_name":"Boolean"},"version":{"type":"string_t","description":"The version that pertains to the event or object. See specific usage.","caption":"Version","type_name":"String"},"to_mailboxes":{"type":"string_t","description":"The human-readable email header To Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"To Mailboxes","type_name":"String"},"is_default":{"type":"boolean_t","description":"The indication of whether the value is from a default value name. For example, the value name could be missing.","caption":"Default Value","type_name":"Boolean"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","caption":"Confidence Score","type_name":"Integer"},"applications":{"type":"object_t","description":"A list of application objects. See specific usage.","is_array":true,"object_type":"application","caption":"Applications","object_name":"Application"},"unmanned_aerial_system":{"type":"object_t","description":"The Unmanned Aerial System object describes the characteristics, Position Location Information (PLI), and other metadata of Unmanned Aerial Systems (UAS) and other unmanned and drone systems used in Remote ID. Remote ID is defined in the Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a.","object_type":"unmanned_aerial_system","caption":"Unmanned Aerial System","object_name":"Unmanned Aerial System"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period. See specific usage.","caption":"End Time","type_name":"Datetime"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs attached to an entity. A Tag may be used to categorize, filter, and search for entities. For e.g. \"Environment\": \"Production\", \"Owner\": \"007\". See specific usage.","is_array":true,"object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"is_truncated":{"type":"boolean_t","description":"Indicates that an attribute has been truncated. See specific usage.","caption":"Is Truncated","type_name":"Boolean"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","is_array":true,"object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"graph":{"type":"object_t","description":"A graph data structure representation with nodes and edges.","object_type":"graph","caption":"Graph","object_name":"Graph"},"num_violations":{"type":"integer_t","description":"The number of times the policy or rule was violated.","caption":"Violations","type_name":"Integer"},"chunks_in":{"type":"long_t","description":"A unit of information within an SCTP packet, consisting of a chunk header and chunk-specific content. See RFC 4960. This field can be used for the chunks sent from the destination to the source.","caption":"Chunks In","type_name":"Long"},"technique":{"type":"object_t","description":"The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"object_type":"technique","caption":"MITRE Technique","object_name":"MITRE Technique"},"return_path":{"type":"email_t","description":"The address found in the 'Return-Path' header, which indicates where bounce messages (non-delivery reports) should be sent. This address is often set by the sending system and may differ from the 'From' or 'Sender' addresses. For example, mailer-daemon@senderserver.com.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"},{"description":"RFC 5321 - Simple Mail Transfer Protocol","url":"https://datatracker.ietf.org/doc/html/rfc5321#section-4.4"}],"caption":"Return Path","type_name":"Email Address"},"accessed_time_dt":{"type":"datetime_t","description":"The time when the file was last accessed.","caption":"Accessed Time","type_name":"Datetime"},"win/service_start_type":{"type":"string_t","description":"The service start type, normalized to the caption of the service_start_type_id value. In the case of 'Other', it is defined by the event source.","extension":"win","extension_id":2,"caption":"Service Start Type","type_name":"String"},"agent":{"type":"object_t","description":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software.","object_type":"agent","caption":"Agent","object_name":"Agent"},"from_mailboxes":{"type":"email_t","description":"The human-readable email header From Mailbox values. This array should contain the value in from_mailbox. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"From Mailboxes","type_name":"Email Address"},"data_lifecycle_state_id":{"type":"integer_t","enum":{"3":{"description":"The data was being processed, accessed, or read by a system, making it active in memory or CPU. E.g., sensitive data in a Business Intelligence tool, ePHI being processed in an EHR application or a user viewing data stored in a spreadsheet or PDF.","caption":"Data in-Use"},"0":{"description":"The data lifecycle state is unknown.","caption":"Unknown"},"1":{"description":"The data was stored on physical or logical media and was not actively moving through the network nor was being processed. E.g., data stored in a database, PDF files in a file share, or EHR records in object storage.","caption":"Data at-Rest"},"2":{"description":"The data was actively moving through the network or from one physical or logical location to another. E.g., emails being send, data replication or Change Data Capture (CDC) streams, or sensitive data processed on an API.","caption":"Data in-Transit"},"99":{"description":"The data lifecycle state is not mapped. See the data_lifecycle_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The stage or state that the data was in when it was assessed or scanned by a data security tool.","caption":"Data Lifecycle State ID","sibling":"data_lifecycle_state","type_name":"Integer"},"is_user_provisioning_enabled":{"type":"boolean_t","description":"Indicates whether user provisioning is automated (e.g., for a SCIM resource). See specific usage.","caption":"User Provisioning Enabled","type_name":"Boolean"},"table":{"type":"object_t","description":"The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.","object_type":"table","caption":"Table","object_name":"Table"},"bus_type":{"type":"string_t","description":"The attachment bus or interface standard, normalized to the caption of the bus_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Bus Type","type_name":"String"},"win/service_category_id":{"type":"integer_t","enum":{"0":{"description":"The service category is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver.","caption":"Kernel Mode"},"2":{"description":"A user mode service.","caption":"User Mode"},"99":{"description":"The service category is not mapped. See the service_category attribute, which contains an event source specific value.","caption":"Other"}},"description":"The normalized identifier of the service category.","extension":"win","extension_id":2,"caption":"Service Category ID","sibling":"service_category","type_name":"Integer"},"uploaded_time":{"type":"timestamp_t","description":"The timestamp at which an entity was uploaded. See specific usage.","caption":"Uploaded Time","type_name":"Timestamp"},"function_name":{"type":"string_t","description":"The function name. See specific usage.","caption":"Function Name","type_name":"String"},"precision":{"type":"integer_t","description":"The numeric precision. See specific usage.","caption":"Precision","type_name":"Integer"},"query_type":{"type":"string_t","description":"The normalized caption of query_type_id or the source-specific query type.","caption":"Query Type","type_name":"String"},"security_descriptor":{"type":"string_t","description":"The object security descriptor.","caption":"Security Descriptor","type_name":"String"},"status_details":{"type":"string_t","description":"A list of descriptions, containing additional information about the event/finding status.","is_array":true,"caption":"Status Details","type_name":"String"},"rssi":{"type":"integer_t","description":"Received Signal Strength Indicator (RSSI) is a measurement of the power of a radio signal. See specific usage.","caption":"RSSI","type_name":"Integer"},"department":{"type":"string_t","description":"The name of the department or organizational unit where the entity is assigned or belongs. See specific usage.","caption":"Department","type_name":"String"},"prompt_tokens":{"type":"integer_t","description":"Number of tokens in the input prompt for this message.","caption":"Prompt Tokens","type_name":"Integer"},"exploit_requirement":{"type":"string_t","description":"The requirement description related to any constraints around exploit execution.","caption":"Exploit Requirement","type_name":"String"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"object_type":"observable","caption":"Observables","object_name":"Observable"},"log_source":{"type":"string_t","description":"The log where the data originated. See specific usage.","caption":"Log Source","type_name":"String"},"is_fix_available":{"type":"boolean_t","description":"Indicates if a fix is available for the reported vulnerability.","caption":"Fix Availability","type_name":"Boolean"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","object_type":"group","caption":"Assignee Group","object_name":"Group"},"subdomains":{"type":"string_t","description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs).","is_array":true,"caption":"Subdomains","type_name":"String"},"accessor":{"type":"object_t","description":"The name of the user who last accessed the object.","object_type":"user","caption":"Accessor","object_name":"User"},"phone_number":{"type":"string_t","description":"The number associated with the phone.","caption":"Phone Number","type_name":"String"},"is_renewable":{"type":"boolean_t","description":"The indication of whether something is renewable. See specific usage.","caption":"Renewable","type_name":"Boolean"},"client_ciphers":{"type":"string_t","description":"The client cipher suites that were exchanged during the TLS handshake negotiation.","is_array":true,"caption":"Client Cipher Suites","type_name":"String"},"src_endpoint":{"type":"object_t","description":"The network source endpoint.","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"tunnel_type_id":{"type":"integer_t","description":"The normalized tunnel type ID.","caption":"Type","sibling":"tunnel_type","type_name":"Integer"},"scim":{"type":"object_t","description":"The System for Cross-domain Identity Management (SCIM) resource object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in RFC-7634","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"object_type":"scim","caption":"SCIM","object_name":"SCIM"},"volume":{"type":"string_t","description":"The volume on the storage device where the file is located. See specific usage.","caption":"Volume","type_name":"String"},"cpu_bits":{"type":"integer_t","description":"The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.","caption":"CPU Bits","type_name":"Integer"},"detection_uid":{"type":"string_t","description":"The associated unique detection event identifier. For example: detection response events include the Detection ID of the original event.","caption":"Detection UID","type_name":"String"},"auth_type":{"type":"string_t","description":"The agreed upon authentication type, normalized to the caption of 'auth_type_id'. In the case of 'Other', it is defined by the event source.","caption":"Authentication Type","type_name":"String"},"ack_reason":{"type":"integer_t","description":"An integer that provides a reason code or additional information about the acknowledgment result.","caption":"Acknowledgement Reason","type_name":"Integer"},"keyboard_type":{"type":"string_t","description":"The keyboard type (e.g., xt, ico).","caption":"Keyboard Type","type_name":"String"},"win/service_dependencies":{"type":"string_t","description":"The names of other services upon which this service has a dependency.","extension":"win","is_array":true,"extension_id":2,"caption":"Service Dependencies","type_name":"String"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"cwe":{"type":"object_t","description":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the Common Weakness Enumeration (CWE) catalog.","object_type":"cwe","caption":"CWE","object_name":"CWE"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","is_array":true,"object_type":"packet","caption":"Packets","object_name":"Packet"},"delay":{"type":"integer_t","description":"The total round-trip delay to the reference clock in milliseconds.","caption":"Root Delay","type_name":"Integer"},"path":{"type":"string_t","description":"The path that pertains to the event or object. See specific usage.","caption":"Path","type_name":"String"},"column_name":{"type":"string_t","description":"The name of the column. See specific usage.","caption":"Column Name","type_name":"String"},"attack_graph":{"type":"object_t","description":"An Attack Graph describes possible routes an attacker could take through an environment. It describes relationships between resources and their findings, such as malware detections, vulnerabilities, misconfigurations, and other security actions.","references":[{"description":"MS Defender description of Attack Path","url":"https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path"},{"description":"SentinelOne Attack Path documentation","url":"https://www.sentinelone.com/cybersecurity-101/cybersecurity/attack-path-analysis/"}],"object_type":"graph","caption":"Attack Graph","object_name":"Graph"},"idle_timeout":{"type":"integer_t","description":"Duration (in minutes) of allowed inactivity before a timeout See specific usage.","caption":"SSO Idle Timeout","type_name":"Integer"},"source":{"type":"string_t","description":"The source, when used with source_id, is normalized to the caption of the source_id value. In the case of 'Other', it is defined by the event source. See specific usage.","caption":"Source","type_name":"String"},"whois":{"type":"object_t","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","object_type":"whois","caption":"WHOIS","object_name":"WHOIS"},"actual_permissions":{"type":"integer_t","description":"The permissions that were granted in a platform-native format. See specific usage.","caption":"Actual Permissions","type_name":"Integer"},"radius":{"type":"string_t","description":"Farthest horizontal distance from the reported location at which any UA in a group may be located (meters). Also allows defining the area where an Intent-Based Network Participant operation is taking place. Default: 0 m.","caption":"Radius","type_name":"String"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"unused_privileges_count":{"type":"integer_t","description":"The number of unused Privileges. See specific usage.","caption":"Unused Privileges Count","type_name":"Integer"},"debug":{"type":"string_t","description":"Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array.","is_array":true,"caption":"Debug Information","type_name":"String"},"stratum":{"type":"string_t","description":"The stratum level of the NTP server's time source, normalized to the caption of the stratum_id value.","caption":"Stratum","type_name":"String"},"cpu_architecture":{"type":"string_t","description":"The CPU architecture, normalized to the caption of the cpu_architecture_id value. In the case of Other, it is defined by the source.","caption":"CPU Architecture","type_name":"String"},"open_ports":{"type":"object_t","description":"The list of open ports on a network interface, including port numbers and associated protocol information.","is_array":true,"object_type":"port_info","caption":"Open Ports","object_name":"Port Information"},"analyzed_privileges_count":{"type":"integer_t","description":"The total count of privileges that were analyzed. See specific usage.","caption":"Analyzed Privileges Count","type_name":"Integer"},"reputation":{"type":"object_t","description":"Contains the original and normalized reputation scores.","object_type":"reputation","caption":"Reputation Scores","object_name":"Reputation"},"value":{"type":"string_t","description":"The value associated to an attribute. See specific usage.","caption":"Value","type_name":"String"},"command":{"type":"string_t","description":"The command name.","caption":"Command","type_name":"String"},"ack_result":{"type":"integer_t","description":"An integer that denotes the acknowledgment result of the DCE/RPC call.","caption":"Acknowledgement Result","type_name":"Integer"},"column_number":{"type":"integer_t","description":"The number of the column. See specific usage.","caption":"Column Number","type_name":"Integer"},"project_uid":{"type":"string_t","description":"The unique identifier of a Cloud project.","caption":"Project ID","type_name":"String","@deprecated":{"message":"Use the account.uid attribute instead.","since":"1.4.0"}},"http_only":{"type":"boolean_t","description":"A cookie attribute to make it inaccessible via JavaScript","caption":"HTTP Only","type_name":"Boolean","@deprecated":{"message":"Use the is_http_only attribute instead.","since":"1.1.0"}},"surname":{"type":"string_t","description":"The last or family name for the user.","caption":"Surname","type_name":"String"},"vram_size":{"type":"integer_t","description":"The total amount of installed video RAM.","caption":"VRAM Size","type_name":"Integer"},"dnssec_status":{"type":"string_t","description":"The normalized value of dnssec_status_id.","caption":"DNSSEC Status","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","object_type":"ticket","caption":"Ticket","object_name":"Ticket"},"dkim_signature":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system.","caption":"DKIM Signature","type_name":"String"},"related_events":{"type":"object_t","description":"Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF.","is_array":true,"object_type":"related_event","caption":"Related Events/Findings","object_name":"Related Event/Finding"},"smtp_hello":{"type":"string_t","description":"The value of the SMTP HELO or EHLO command.","caption":"SMTP Hello","type_name":"String","@deprecated":{"message":"Use the command attribute instead.","since":"1.4.0"}},"parameters":{"type":"object_t","description":"The parameters passed into a function invocation.","is_array":true,"object_type":"parameter","caption":"Parameters","object_name":"Parameter"},"resource_relationship":{"type":"object_t","description":"Describes entities related to the resource, using a graph structure. See specific usage.","object_type":"graph","caption":"Resource Relationship","object_name":"Graph"},"exploit_last_seen_time":{"type":"timestamp_t","description":"The time when the exploit was most recently observed.","caption":"Exploit Last Seen Time","type_name":"Timestamp"},"win/reg_integer_data":{"type":"long_t","description":"The data of the registry value when type_id is REG_DWORD, REG_DWORD_BIG_ENDIAN, or REG_QWORD.","extension":"win","extension_id":2,"caption":"Registry Integer Data","type_name":"Long"},"is_self_signed":{"type":"boolean_t","description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA).","caption":"Certificate Self-Signed","type_name":"Boolean"},"detection_pattern_type_id":{"type":"integer_t","enum":{"3":{"caption":"SIGMA"},"6":{"caption":"YARA"},"0":{"description":"The type is not mapped.","caption":"Unknown"},"1":{"caption":"STIX"},"2":{"caption":"PCRE"},"99":{"description":"The detection pattern type is not mapped. See the detection_pattern_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Snort"},"5":{"caption":"Suricata"}},"description":"Specifies the type of detection pattern used to identify the associated threat indicator.","caption":"Detection Pattern Type ID","sibling":"detection_pattern_type","type_name":"Integer"},"packages":{"type":"object_t","description":"List of vulnerable packages as identified by the security product","is_array":true,"object_type":"package","caption":"Software Packages","@deprecated":{"message":"Use the affected_packages attribute instead.","since":"1.1.0"},"object_name":"Software Package"},"processed_time_dt":{"type":"datetime_t","description":"The event processed time, such as an ETL operation.","caption":"Processed Time","type_name":"Datetime"},"requirements":{"type":"string_t","description":"A list of requirements associated to a specific control in an industry or regulatory framework. e.g. NIST.800-53.r5 AU-10","is_array":true,"caption":"Compliance Requirements","type_name":"String"},"user_result":{"type":"object_t","description":"The result of the user account change. It should contain the new values of the changed attributes.","object_type":"user","caption":"User Result","object_name":"User"},"email_addr":{"type":"email_t","description":"The user's primary email address.","caption":"Email Address","type_name":"Email Address"},"num_infected":{"type":"integer_t","description":"The number of infected entities. See specific usage.","caption":"Number of Infected Entities","type_name":"Integer"},"next_run_time_dt":{"type":"datetime_t","description":"The next run time. See specific usage.","caption":"Next Run","type_name":"Datetime"},"creator":{"type":"object_t","description":"The user that created the object associated with event. See specific usage.","object_type":"user","caption":"Creator","object_name":"User"},"tunnel_type":{"type":"string_t","description":"The tunnel type. See specific usage.","caption":"Type","type_name":"String"},"programmatic_credentials":{"type":"object_t","description":"Details about the programmatic credential (API key, service account key, access token, certificate). See specific usage.","is_array":true,"object_type":"programmatic_credential","caption":"Programmatic Credentials","object_name":"Programmatic Credential"},"delivered_to_list":{"type":"email_t","description":"The machine-readable Delivered-To email header values. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 9228","url":"https://www.rfc-editor.org/rfc/rfc9228"}],"caption":"Delivered To List","type_name":"Email Address"},"feature":{"type":"object_t","description":"The feature that reported the event.","object_type":"feature","caption":"Feature","object_name":"Feature"},"modifier":{"type":"object_t","description":"The user that last modified the object associated with the event. See specific usage.","object_type":"user","caption":"Modifier","object_name":"User"},"physical_height":{"type":"integer_t","description":"The numeric physical height of display.","caption":"Physical Height","type_name":"Integer"},"affected_code":{"type":"object_t","description":"List of Affected Code objects that describe details about code blocks identified as vulnerable.","is_array":true,"object_type":"affected_code","caption":"Affected Code","object_name":"Affected Code"},"packets_out":{"type":"long_t","description":"The number of packets sent from the source to the destination.","caption":"Packets Out","type_name":"Long"},"gpu_count":{"type":"integer_t","description":"The number of GPU's on a system. For example: 1.","caption":"GPU Count","type_name":"Integer"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"classifications":{"type":"string_t","description":"The list of malware classifications, normalized to the captions of the classification_id values. In the case of 'Other', they are defined by the event source.","is_array":true,"caption":"Classifications","type_name":"String"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"kb_article_list":{"type":"object_t","description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.","is_array":true,"object_type":"kb_article","caption":"Knowledgebase Articles","object_name":"KB Article"},"latency":{"type":"integer_t","description":"The HTTP response latency measured in milliseconds.","caption":"Latency","type_name":"Integer"},"edges":{"type":"object_t","description":"The list of edge objects that are part of the graph.","is_array":true,"object_type":"edge","caption":"Edges","object_name":"Edge"},"tlp":{"type":"string_t","description":"The Traffic Light Protocol was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared.","caption":"Traffic Light Protocol","type_name":"String"},"category_id":{"type":"integer_t","description":"The normalized identifier of the object category. See specific usage.","caption":"Category ID","sibling":"category","type_name":"Integer"},"domain_contacts":{"type":"object_t","description":"An array of Domain Contact objects.","is_array":true,"object_type":"domain_contact","caption":"Domain Contacts","object_name":"Domain Contact"},"drive_type_id":{"type":"integer_t","enum":{"3":{"description":"The drive is a remote (network) drive.","caption":"Remote"},"0":{"description":"The drive type is unknown.","caption":"Unknown"},"1":{"description":"The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader.","caption":"Removable"},"2":{"description":"The drive has fixed media; for example, a hard disk drive or flash drive.","caption":"Fixed"},"99":{"description":"The drive type is not mapped. See the drive_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The drive is a CD-ROM drive.","caption":"CD-ROM"},"5":{"description":"The drive is a RAM disk.","caption":"RAM Disk"}},"description":"Identifies the type of a disk drive, i.e. fixed, removable, etc.","caption":"Drive Type ID","sibling":"drive_type","type_name":"Integer"},"dependency_chain":{"type":"string_t","description":"Information about the chain of dependencies related to the issue as reported by an Application Security or Vulnerability Management tool. E.g., serverless-offline -> @serverless/utils -> memoizee -> es5-ext.","caption":"Dependency Chain","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal.","caption":"Alert","type_name":"Boolean"},"related_vulnerabilities":{"type":"string_t","description":"List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability.","is_array":true,"caption":"Related Vulnerability IDs","type_name":"String"},"build":{"type":"string_t","description":"The operating system build number.","caption":"OS Build","type_name":"String"},"event_code":{"type":"string_t","description":"The Event ID, Code, or Name that the product uses to primarily identify the event.","caption":"Event Code","type_name":"String"},"account":{"type":"object_t","description":"The account object describes details about the account that was the source or target of the activity. See specific usage.","object_type":"account","caption":"Account","object_name":"Account"},"number":{"type":"integer_t","description":"The number of the entity. See specific usage.","caption":"Number","type_name":"Integer"},"email_auth":{"type":"object_t","description":"The SPF, DKIM and DMARC attributes of an email.","object_type":"email_auth","caption":"Email Authentication","object_name":"Email Authentication"},"is_readonly":{"type":"boolean_t","description":"Indicates that an object cannot be modified. See specific usage","caption":"Read-Only","type_name":"Boolean"},"log_level":{"type":"string_t","description":"The log specific level at which an event was generated. See specific usage.","caption":"Log Level","type_name":"String"},"dmarc_policy":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status.","caption":"DMARC Policy","type_name":"String"},"values":{"type":"string_t","description":"An array of values associated to an attribute. See specific usage.","is_array":true,"caption":"Values","type_name":"String"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","object_type":"api","caption":"API Details","object_name":"API"},"epss":{"type":"object_t","description":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. (EPSS).","object_type":"epss","caption":"EPSS","object_name":"EPSS"},"transmit_time":{"type":"timestamp_t","description":"The event transmission time from one device to another. See specific usage.","caption":"Transmission Time","type_name":"Timestamp"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value.","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"Describes details of a policy. See specific usage.","object_type":"policy","caption":"Policy","object_name":"Policy"},"share_type_id":{"type":"integer_t","enum":{"3":{"caption":"Print"},"0":{"description":"The share type is unknown.","caption":"Unknown"},"1":{"caption":"File"},"2":{"caption":"Pipe"},"99":{"description":"The share type is not mapped. See the share_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the share type.","caption":"Share Type ID","sibling":"share_type","type_name":"Integer"},"application":{"type":"object_t","description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps.","object_type":"application","caption":"Application","object_name":"Application"},"from":{"type":"email_t","description":"The machine-readable email header From value, as defined by RFC 5322. For example example.user@usersdomain.com.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"From","type_name":"Email Address"},"geodetic_altitude":{"type":"string_t","description":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","caption":"Geodetic Altitude","type_name":"String"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","caption":"Confidence","type_name":"String"},"num_registry_items":{"type":"integer_t","description":"The number of registry items scanned.","caption":"Scanned Registry Items","type_name":"Integer"},"size":{"type":"long_t","description":"The size of data, in bytes.","caption":"Size","type_name":"Long"},"http_request":{"type":"object_t","description":"The HTTP Request Object documents attributes of a request made to a web server.","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"read_count":{"type":"integer_t","description":"The read count. See specific usage.","caption":"Read Count","type_name":"Integer"},"tree_uid":{"type":"string_t","description":"The tree id is a unique SMB identifier which represents an open connection to a share.","caption":"Tree UID","type_name":"String"},"speed_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal ground speed. Measured in meters/second.","caption":"Speed Accuracy","type_name":"String"},"country":{"type":"string_t","description":"The ISO 3166-1 Alpha-2 country code.

Note: The two letter country code should be capitalized. For example: US or CA.

","references":[{"description":"ISO 3166-1 alpha-2 codes","url":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}],"caption":"Country","type_name":"String","observable":14},"function_invocation":{"type":"object_t","description":"Details of a function invocation.","object_type":"function_invocation","caption":"Function Invocation","object_name":"Function Invocation"},"name_servers":{"type":"string_t","description":"A collection of name servers related to a domain registration or other record.","is_array":true,"caption":"Name Servers","type_name":"String"},"process":{"type":"object_t","description":"The process object.","object_type":"process","caption":"Process","object_name":"Process"},"ou_uid":{"type":"string_t","description":"The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID.","caption":"Org Unit ID","type_name":"String"},"affected_packages":{"type":"object_t","description":"List of software packages identified as affected by a vulnerability/vulnerabilities.","is_array":true,"object_type":"affected_package","caption":"Affected Software Packages","object_name":"Affected Software Package"},"request":{"type":"object_t","description":"General Purpose API Request Object. See specific usage","object_type":"request","caption":"API Request Details","object_name":"Request Elements"},"write_count":{"type":"integer_t","description":"The write count. See specific usage.","caption":"Write Count","type_name":"Integer"},"password_last_used_time":{"type":"timestamp_t","description":"The time when a user's password was last used. See specific usage.","caption":"Password Last Used Time","type_name":"Timestamp"},"rpc_interface":{"type":"object_t","description":"The RPC Interface object describes the details pertaining to the remote procedure call interface.","object_type":"rpc_interface","caption":"Remote Procedure Call Interface","object_name":"RPC Interface"},"leave_time_dt":{"type":"datetime_t","description":"The timestamp when the user left or will be leaving the organization.","caption":"Leave Time","type_name":"Datetime"},"ancestry":{"type":"object_t","description":"An array of Process Entities describing the extended parentage of this process object. Direct parent information should be expressed through the parent_process attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object.","is_array":true,"references":[{"description":"Guidance on Representing Process Parentage","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"}],"object_type":"process_entity","caption":"Ancestry","object_name":"Process Entity"},"euid":{"type":"integer_t","description":"The effective user under which this process is running.","caption":"Effective User ID","type_name":"Integer"},"storage_class":{"type":"string_t","description":"The storage class of the entity. See specific usage.","caption":"Storage Class","type_name":"String"},"subdomain":{"type":"string_t","description":"The subdomain portion of the URL. For example: sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com.","caption":"Subdomain","type_name":"String"},"server_ciphers":{"type":"string_t","description":"The server cipher suites that were exchanged during the TLS handshake negotiation.","is_array":true,"caption":"Server Cipher Suites","type_name":"String"},"packets_in":{"type":"long_t","description":"The number of packets sent from the destination to the source.","caption":"Packets In","type_name":"Long"},"is_disabled":{"type":"boolean_t","description":"Indicates if the entity is disabled. See specific usage.","caption":"Disabled","type_name":"Boolean"},"supporting_data":{"type":"json_t","description":"Additional data supporting a finding as provided by security tool","caption":"Supporting Data","type_name":"JSON"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","caption":"Count","type_name":"Integer"},"hashes":{"type":"object_t","description":"An array of hash attributes.","is_array":true,"object_type":"fingerprint","caption":"Hashes","object_name":"Fingerprint"},"metrics":{"type":"object_t","description":"The general purpose metrics associated with the event. See specific usage.","is_array":true,"object_type":"metric","caption":"Metrics","object_name":"Metric"},"lease_dur":{"type":"integer_t","description":"This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events.","caption":"Lease Duration","type_name":"Integer"},"author":{"type":"string_t","description":"The author(s) who published the software component.","caption":"Author","type_name":"String"},"sp_name":{"type":"string_t","description":"The name of the latest Service Pack.","caption":"OS Service Pack","type_name":"String"},"confidentiality":{"type":"string_t","description":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.","caption":"Confidentiality","type_name":"String"},"unmanned_system_operating_area":{"type":"object_t","description":"The UAS Operating Area object describes details about a precise area of operations for a UAS flight or mission.","object_type":"unmanned_system_operating_area","caption":"UAS Operating Area","object_name":"Unmanned System Operating Area"},"analytic":{"type":"object_t","description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion.","object_type":"analytic","caption":"Analytic","object_name":"Analytic"},"last_used_time":{"type":"timestamp_t","description":"The most recent usage time of an entity. See specific usage.","caption":"Last Used Time","type_name":"Timestamp"},"uid_alt":{"type":"string_t","description":"The alternate unique identifier. See specific usage.","caption":"Alternate ID","type_name":"String"},"forward_addr":{"type":"email_t","description":"The user's forwarding email address.","caption":"Forwarding Address","type_name":"Email Address"},"boot_time_dt":{"type":"datetime_t","description":"The time when the system was booted.","caption":"Boot Time","type_name":"Datetime"},"response_time":{"type":"timestamp_t","description":"The Domain Name System (DNS) response time.","caption":"Response Time","type_name":"Timestamp"},"smtp_to":{"type":"email_t","description":"The value of the SMTP envelope RCPT TO command.","is_array":true,"caption":"SMTP To","type_name":"Email Address","@deprecated":{"message":"Use the to attribute instead.","since":"1.4.0"}},"dmarc":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email.","caption":"DMARC Status","type_name":"String"},"app_uid":{"type":"string_t","description":"The unique ID of the application associated with the event or object.","caption":"Application ID","type_name":"String"},"resources_result":{"type":"object_t","description":"Updated resources after an activity/event.","is_array":true,"object_type":"resource_details","caption":"Resource Results Array","object_name":"Resource Details"},"certificate_chain":{"type":"string_t","description":"The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer.","is_array":true,"caption":"Certificate Chain","type_name":"String"},"related_events_count":{"type":"integer_t","description":"Number of related events or findings.","caption":"Related Events/Findings Count","type_name":"Integer"},"system_call":{"type":"string_t","description":"The system call that was invoked.","caption":"System Call","type_name":"String"},"postal_code":{"type":"string_t","description":"The postal code of the location.","caption":"Postal Code","type_name":"String"},"users":{"type":"object_t","description":"The users that pertain to the event or object.","is_array":true,"object_type":"user","caption":"Users","object_name":"User"},"logon_type":{"type":"string_t","description":"The logon type, normalized to the caption of the logon_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Logon Type","type_name":"String"},"win/service_error_control_id":{"type":"integer_t","enum":{"3":{"description":"The startup program logs the error in the event log. If the last-known-good configuration is being started, the startup operation continues. Otherwise, the system is restarted with the last-known-good configuration.","caption":"Severe"},"0":{"description":"The service error control is unknown.","caption":"Unknown"},"1":{"description":"The startup program ignores the error and continues the startup operation.","caption":"Ignore"},"2":{"description":"The startup program logs the error in the event log but continues the startup operation.","caption":"Normal"},"99":{"description":"The service error control is not mapped. See the service_error_control attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"The startup program logs the error in the event log, if possible. If the last-known-good configuration is being started, the startup operation fails. Otherwise, the system is restarted with the last-known good configuration.","caption":"Critical"}},"description":"The normalized identifier of the service error control.","extension":"win","extension_id":2,"caption":"Service Error Control ID","sibling":"service_error_control","type_name":"Integer"},"scim_user_schema":{"type":"json_t","description":"SCIM provides a resource type for user resources. The core schema for user is identified using the following schema URI: urn:ietf:params:scim:schemas:core:2.0:User as defined in RFC-7634. his attribute will capture key-value pairs for the scheme implemented in a SCIM resource. This object is inclusive of both the basic and Enterprise User Schema Extension.","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC spec.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"caption":"SCIM User Schema","type_name":"JSON"},"http_cookies":{"type":"object_t","description":"The cookies object describes details about HTTP cookies","is_array":true,"object_type":"http_cookie","caption":"HTTP Cookies","object_name":"HTTP Cookie"},"traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network at a given point of time. Intended to be used alongside Network Connection.","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"The user-provided comment.","caption":"Comment","type_name":"String"},"pattern_match":{"type":"string_t","description":"A text, binary, file name, or datastore that matched against a detection rule.","caption":"Pattern Match","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The end time of a time period. See specific usage.","caption":"End Time","type_name":"Timestamp"},"keyboard_layout":{"type":"string_t","description":"The keyboard locale identifier name (e.g., en-US).","caption":"Keyboard Layout","type_name":"String"},"correlation_uid":{"type":"string_t","description":"A unique identifier used to correlate events. See specific usage.","caption":"Correlation UID","type_name":"String"},"cwe_uid":{"type":"string_t","description":"The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.","caption":"CWE UID","type_name":"String","@deprecated":{"message":"Use the related_cwes object attributes instead.","since":"1.1.0"}},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"object_type":"agent","caption":"Agent List","object_name":"Agent"},"protocol_num":{"type":"integer_t","description":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: 6 for TCP and 17 for UDP.","references":[{"description":"IANA Protocol Numbers","url":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}],"caption":"Protocol Number","type_name":"Integer"},"cell_name":{"type":"string_t","description":"The name of the cell. See specific usage.","caption":"Cell Name","type_name":"String"},"x_forwarded_for":{"type":"ip_t","description":"The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer.","is_array":true,"caption":"X-Forwarded-For","type_name":"IP Address"},"package":{"type":"object_t","description":"The Software Package object describes details about a software package.","references":[{"description":"D3FEND™ Ontology d3f:SoftwarePackage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}],"object_type":"package","caption":"Software Package","object_name":"Software Package"},"protocol_name":{"type":"string_t","description":"The protocol name. See specific usage.","caption":"Protocol Name","type_name":"String"},"win/reg_string_list_data":{"type":"string_t","description":"The data of the registry value when type_id is REG_MULTI_SZ.","extension":"win","is_array":true,"extension_id":2,"caption":"Registry String List Data","type_name":"String"},"connection_info":{"type":"object_t","description":"The network connection information.","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"sp_ver":{"type":"integer_t","description":"The version number of the latest Service Pack.","caption":"OS Service Pack Version","type_name":"Integer"},"countermeasures":{"type":"object_t","description":"The MITRE D3FEND™ Matrix Countermeasures associated with a remediation.","is_array":true,"object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"score_id":{"type":"integer_t","enum":{"3":{"description":"Reasonable history of good behavior.","caption":"Probably Safe"},"6":{"description":"Starting to establish a history of suspicious or risky behavior.","caption":"Exercise Caution"},"0":{"description":"The reputation score is unknown.","caption":"Unknown"},"1":{"description":"Long history of good behavior.","caption":"Very Safe"},"2":{"description":"Consistently good behavior.","caption":"Safe"},"99":{"description":"The reputation score is not mapped. See the rep_score attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Starting to establish a history of normal behavior.","caption":"Leans Safe"},"5":{"description":"No established history of normal behavior.","caption":"May not be Safe"},"7":{"description":"A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious).","caption":"Suspicious/Risky"},"8":{"description":"Strong possibility of maliciousness.","caption":"Possibly Malicious"},"9":{"description":"Indicators of maliciousness.","caption":"Probably Malicious"},"10":{"description":"Proven evidence of maliciousness.","caption":"Malicious"}},"description":"The normalized reputation score identifier.","caption":"Reputation Score ID","sibling":"score","type_name":"Integer"},"log_provider":{"type":"string_t","description":"The logging provider or logging service that logged the event. See specific usage.","caption":"Log Provider","type_name":"String"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"key_length":{"type":"integer_t","description":"The length of the encryption key.","caption":"Key Length","type_name":"Integer"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"start_type":{"type":"string_t","description":"The start type of a service, driver, or application.","caption":"Start Type","type_name":"String"},"rate_limit":{"type":"integer_t","description":"The rate limit for a rate-based rule.","caption":"Rate Limit","type_name":"Integer"},"is_hotp":{"type":"boolean_t","description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP).","caption":"HMAC-based One-time Password (HOTP)","type_name":"Boolean"},"requested_permissions":{"type":"integer_t","description":"The permissions mask. See specific usage.","caption":"Requested Permissions","type_name":"Integer"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","is_array":true,"object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"dialect":{"type":"string_t","description":"The negotiated protocol dialect.","caption":"Dialect","type_name":"String"},"is_on_premises_sync_enabled":{"type":"boolean_t","description":"Indicates whether synchronization with an on-premises directory service is enabled. For example, Microsoft Entra Connect.","caption":"On-Premises Sync Enabled","type_name":"Boolean"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value.","caption":"Class","type_name":"String"},"related_cves":{"type":"object_t","description":"Describes Common Vulnerabilities and Exposures (CVE) entries that are related to an entity. See specific usage.","is_array":true,"object_type":"cve","caption":"Related CVEs","object_name":"CVE"},"manager":{"type":"object_t","description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.","object_type":"user","caption":"Manager","object_name":"User"},"security_questions":{"type":"string_t","description":"The question(s) provided to user for a question-based authentication factor.","is_array":true,"caption":"Security Questions","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The network destination endpoint.","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"sensitivity":{"type":"string_t","description":"The sensitivity of the firewall rule in the matched event. For example: HIGH.","caption":"Sensitivity","type_name":"String"},"cumulative_traffic":{"type":"object_t","description":"The cumulative network traffic. See specific usage.","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","caption":"Status Code","type_name":"String"},"is_supervised":{"type":"boolean_t","description":"The event occurred on a supervised device. Devices that are supervised are typically mobile devices managed by a Mobile Device Management solution and are restricted from specific behaviors such as Apple AirDrop.","caption":"Supervised Device","type_name":"Boolean"},"packet_uid":{"type":"integer_t","description":"The packet identifier assigned by the protocol.","caption":"Packet UID","type_name":"Integer"},"interface_uid":{"type":"string_t","description":"The unique identifier of the network interface.","caption":"Network Interface ID","type_name":"String"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","object_type":"device_hw_info","caption":"Hardware Info","object_name":"Device Hardware Info"},"ai_role":{"type":"string_t","description":"The normalized caption of the ai_role_id.","caption":"AI Role","type_name":"String"},"protocol_ver_id":{"type":"integer_t","enum":{"0":{"description":"The protocol version is unknown.","caption":"Unknown"},"99":{"description":"The protocol version is not mapped. See the protocol_ver attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the Protocol version. See specific usage.","caption":"Protocol Version ID","sibling":"protocol_ver","type_name":"Integer"},"bios_date":{"type":"string_t","description":"The BIOS date. For example: 03/31/16.","caption":"BIOS Date","type_name":"String"},"protocol_ver":{"type":"string_t","description":"The Protocol version, normalized to the caption of the protocol_ver_id value. In the case of 'Other', it is defined by the event source.","caption":"Protocol Version","type_name":"String"},"exploit_type":{"type":"string_t","description":"The categorization or type of Exploit. E.g., Network or Physical.","caption":"Exploit Type","type_name":"String"},"encryption_details":{"type":"object_t","description":"The encryption details of a file or other content. See specific usage.","object_type":"encryption_details","caption":"Encryption Details","object_name":"Encryption Details"},"ldap_person":{"type":"object_t","description":"The additional LDAP attributes that describe a person.","object_type":"ldap_person","caption":"LDAP Person","object_name":"LDAP Person"},"scopes":{"type":"string_t","description":"Scopes define the specific permissions or actions that the client is allowed to perform on behalf of the user. Each scope represents a different set of permissions, and the user can selectively grant or deny access to specific scopes during the authorization process.","is_array":true,"caption":"Scopes","type_name":"String"},"cwe_url":{"type":"url_t","description":"Common Weakness Enumeration (CWE) definition URL. For example: https://cwe.mitre.org/data/definitions/787.html.","caption":"CWE URL","type_name":"URL String","@deprecated":{"message":"Use the related_cwes object attributes instead.","since":"1.1.0"}},"ai_provider":{"type":"string_t","description":"AI service provider or organization name.","caption":"AI Provider","type_name":"String"},"subnet_prefix":{"type":"integer_t","description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet.","caption":"Subnet Prefix Length","type_name":"Integer"},"extension":{"type":"object_t","description":"The schema extension used to create the event.","object_type":"extension","caption":"Schema Extension","@deprecated":{"message":"Use the extensions attribute instead.","since":"1.1.0"},"object_name":"Schema Extension"},"direction_id":{"type":"integer_t","enum":{"3":{"description":"Lateral network connection. The connection originated from inside the network, destined for services on the inside network.","caption":"Lateral"},"0":{"description":"The connection direction is unknown.","caption":"Unknown"},"1":{"description":"Inbound network connection. The connection originated from the Internet or outside network, destined for services on the inside network.","caption":"Inbound"},"2":{"description":"Outbound network connection. The connection originated from inside the network, destined for services on the Internet or outside network.","caption":"Outbound"},"99":{"description":"The direction is not mapped. See the direction attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Local network connection (localhost). The connection is intra-device, originating from and destined for services running on the same device.","caption":"Local"}},"description":"The normalized identifier of the direction of the initiated connection, traffic, or email.","caption":"Direction ID","sibling":"direction","type_name":"Integer"},"terminated_time_dt":{"type":"datetime_t","description":"The time when the entity was terminated. See specific usage.","caption":"Terminated Time","type_name":"Datetime"},"exit_code":{"type":"integer_t","description":"The exit code reported by a process when it terminates. The convention is that zero indicates success and any non-zero exit code indicates that some error occurred.","caption":"Exit Code","type_name":"Integer"},"horizontal_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters.","caption":"Horizontal Accuracy","type_name":"String"},"row_number":{"type":"integer_t","description":"The row number. See specific usage.","caption":"Row Number","type_name":"Integer"},"flags":{"type":"string_t","description":"The list of communication flags, normalized to the captions of the flag_ids values. See specific usage.","is_array":true,"caption":"Flags","type_name":"String"},"community_uid":{"type":"string_t","description":"The Community ID of the network connection.","source":"community_id","references":[{"description":"Community ID definition.","url":"https://github.com/corelight/community-id-spec"}],"caption":"Community ID","type_name":"String"},"to":{"type":"email_t","description":"The machine-readable email header To values, as defined by RFC 5322. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"To","type_name":"Email Address"},"leave_time":{"type":"timestamp_t","description":"The timestamp when the user left or will be leaving the organization.","caption":"Leave Time","type_name":"Timestamp"},"altitude_floor":{"type":"string_t","description":"Minimum altitude (WGS-84 HAE) for a group or an Intent-Based Network Participant. Measured in meters. Special Values: Invalid, No Value, or Unknown: -1000 m.","caption":"Altitude Floor","type_name":"String"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration time. See specific usage.","caption":"Expiration Time","type_name":"Datetime"},"groups":{"type":"object_t","description":"The groups to which an entity belongs. See specific usage.","is_array":true,"object_type":"group","caption":"Groups","object_name":"Group"},"urls":{"type":"object_t","description":"The URLs that pertain to the event or object.","is_array":true,"object_type":"url","caption":"URLs","object_name":"Uniform Resource Locator"},"attack":{"type":"object_t","description":"The MITRE ATT&CK® object describing the tactic, technique, and sub-technique.","object_type":"attack","caption":"MITRE ATT&CK® Details","object_name":"MITRE ATT&CK® & ATLAS™"},"has_mfa":{"type":"boolean_t","description":"The user has a multi-factor or secondary-factor device assigned.","caption":"MFA Assigned","type_name":"Boolean"},"win/reg_string_data":{"type":"string_t","description":"The data of the registry value when type_id is REG_SZ, REG_EXPAND_SZ, or REG_LINK.","extension":"win","extension_id":2,"caption":"Registry String Data","type_name":"String"},"cpid":{"type":"uuid_t","description":"A unique process identifier that can be assigned deterministically by multiple system data producers.","source":"cpid","references":[{"description":"OCSF Common Process Identifier (CPID) Specification","url":"https://github.com/ocsf/common-process-id"}],"caption":"Common Process Identifier","type_name":"UUID"},"sni":{"type":"string_t","description":" The Server Name Indication (SNI) extension sent by the client.","caption":"Server Name Indication","type_name":"String"},"last_seen_time_dt":{"type":"datetime_t","description":"The most recent detection time of the activity or object. See specific usage.","caption":"Last Seen","type_name":"Datetime"},"data_lifecycle_state":{"type":"string_t","description":"The name of the stage or state that the data was in. E.g., Data-at-Rest, Data-in-Transit, etc.","caption":"Data Lifecycle State","type_name":"String"},"total":{"type":"integer_t","description":"The total number of items. See specific usage.","caption":"Total","type_name":"Integer"},"samesite":{"type":"string_t","description":"The cookie attribute that lets servers specify whether/when cookies are sent with cross-site requests. Values are: Strict, Lax or None","caption":"SameSite","type_name":"String"},"drive_type":{"type":"string_t","description":"The drive type, normalized to the caption of the drive_type_id value. In the case of Other, it is defined by the source.","caption":"Drive Type","type_name":"String"},"control_parameters":{"type":"object_t","description":"The list of control parameters evaluated in a Compliance check.","is_array":true,"object_type":"key_value_object","caption":"Control Parameters","object_name":"Key:Value object"},"relationship":{"type":"string_t","description":"The relationship between two software components, normalized to the caption of the relationship_id value. In the case of 'Other', it is defined by the source.","caption":"Relationship","type_name":"String"},"next_run_time":{"type":"timestamp_t","description":"The next run time. See specific usage.","caption":"Next Run","type_name":"Timestamp"},"secure":{"type":"boolean_t","description":"The cookie attribute to only send cookies to the server with an encrypted request over the HTTPS protocol.","caption":"Secure","type_name":"Boolean","@deprecated":{"message":"Use the is_secure attribute instead.","since":"1.1.0"}},"epoch":{"type":"integer_t","description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers.","caption":"Epoch","type_name":"Integer"},"base_address":{"type":"string_t","description":"The memory address where the module was loaded.","caption":"Base Address","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","caption":"Priority ID","sibling":"priority","type_name":"Integer"},"anomalies":{"type":"object_t","description":"A list of detected anomalies or deviations from expected behavior patterns. See specific usage.","is_array":true,"object_type":"anomaly","caption":"Anomalies","object_name":"Anomaly"},"rule":{"type":"object_t","description":"The rules that reported the events.","object_type":"rule","caption":"Rule","object_name":"Rule"},"vram_mode_id":{"type":"integer_t","enum":{"0":{"description":"The VRAM mode is unknown or not reported.","caption":"Unknown"},"1":{"description":"Video memory is allocated from system memory.","caption":"Shared"},"2":{"description":"Video memory is physically separate from system memory.","caption":"Dedicated"},"99":{"description":"A VRAM mode not covered by the defined values; the exact value is reported by the event source.","caption":"Other"}},"description":"The normalized identifier of the video memory attachment mode.","caption":"VRAM Mode ID","sibling":"vram_mode","type_name":"Integer"},"session":{"type":"object_t","description":"The authenticated user or service session.","object_type":"session","caption":"Session","object_name":"Session"},"privilege_attack_info":{"type":"object_t","description":"Information about privileges grouped by the potential attack they could enable.","object_type":"privilege_attack_info","caption":"Privilege Attack Info","object_name":"Privilege Attack Info"},"opcode":{"type":"string_t","description":"The DNS opcode specifies the type of the query message.","caption":"DNS Opcode","type_name":"String"},"reply_to":{"type":"email_t","description":"The machine-readable email header Reply-To value, as defined by RFC 5322. For example example.user@usersdomain.com","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Reply To","type_name":"Email Address","@deprecated":{"message":"Use the reply_to_list attribute instead.","since":"1.4.0"}},"sub_technique":{"type":"object_t","description":"The Sub-technique object describes the MITRE ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"object_type":"sub_technique","caption":"MITRE Sub-technique","object_name":"MITRE Sub-technique"},"source_id":{"type":"integer_t","enum":{"0":{"description":"The source is unknown.","caption":"Unknown"},"99":{"description":"The source is not mapped. See the source attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the source. See specific usage.","caption":"Source ID","sibling":"source","type_name":"Integer"},"phones":{"type":"string_t","description":"The phone numbers associated with the user","is_array":true,"caption":"Phones","type_name":"String"},"start_type_id":{"type":"integer_t","enum":{"3":{"description":"Started on demand. For example, by the Windows Service Control Manager when a process calls the StartService function.","caption":"On Demand"},"6":{"description":"Started on specific user logins.","caption":"Specific User Login"},"0":{"description":"The start type is unknown.","caption":"Unknown"},"1":{"description":"Service started automatically during system startup.","caption":"Auto"},"2":{"description":"Device driver started by the system loader.","caption":"Boot"},"99":{"description":"The start type is not mapped. See the start_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The service is disabled, and cannot be started.","caption":"Disabled"},"5":{"description":"Started on all user logins.","caption":"All Logins"},"7":{"description":"Stared according to a schedule.","caption":"Scheduled"},"8":{"description":"Started when a system item, such as a file or registry key, changes.","caption":"System Changed"}},"description":"The start type ID of a service or application.","caption":"Start Type ID","sibling":"start_type","type_name":"Integer"},"display_name":{"type":"string_t","description":"The display name. See specific usage.","caption":"Display Name","type_name":"String"},"compliance_standards":{"type":"object_t","description":"A list of established guidelines or criteria that define specific requirements an organization must follow.","is_array":true,"object_type":"kb_article","caption":"Compliance Standards: Details","@deprecated":{"message":"Use the Compliance object with Check array instead","since":"1.5.0"},"object_name":"KB Article"},"terminal":{"type":"string_t","description":"The Pseudo Terminal. Ex: the tty or pts value.","caption":"Terminal","type_name":"String"},"win/service_type":{"type":"string_t","description":"The service type, normalized to the caption of the service_type_id value. In the case of 'Other', it is defined by the event source.","extension":"win","extension_id":2,"caption":"Service Type","type_name":"String"},"software_components":{"type":"object_t","description":"The list of software components used in the software package.","is_array":true,"object_type":"software_component","caption":"Software Components","object_name":"Software Component"},"alert":{"type":"integer_t","description":"The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246.","caption":"Client TLS Alert","type_name":"Integer"},"error":{"type":"string_t","description":"Error Code","caption":"Error Code","type_name":"String"},"bytes_out":{"type":"long_t","description":"The number of bytes sent from the source to the destination.","caption":"Bytes Out","type_name":"Long"},"iccid":{"type":"string_t","description":"The Integrated Circuit Card Identification of a mobile device. Typically it is a unique 18 to 22 digit number that identifies a SIM card.","caption":"ICCID","type_name":"String"},"total_queued_duration":{"type":"object_t","description":"The amount of time an event spent in a queue awaiting processing.","object_type":"timespan","caption":"Total Queued Duration","object_name":"Time Span"},"avg_timespan":{"type":"object_t","description":"The average time span of an activity.","object_type":"timespan","caption":"Average Timespan","object_name":"Time Span"},"aircraft":{"type":"object_t","description":"The Aircraft object represents any aircraft or otherwise airborne asset such as an unmanned system, airplane, balloon, spacecraft, or otherwise. The Aircraft object is intended to normalized data captured or otherwise logged from active radar, passive radar, multi-spectral systems, or the Automatic Dependant Broadcast - Surveillance (ADS-B), and/or Mode S systems.","object_type":"aircraft","caption":"Aircraft","object_name":"Aircraft"},"is_totp":{"type":"boolean_t","description":"Whether the authentication factor is a Time-based One-time Password (TOTP).","caption":"Time-based One-time Password (TOTP)","type_name":"Boolean"},"aerial_height":{"type":"string_t","description":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","caption":"Aerial Height","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","caption":"Raw Data Size","type_name":"Long"},"num_files":{"type":"integer_t","description":"The number of files scanned.","caption":"Scanned Files","type_name":"Integer"},"identity_activity_metrics":{"type":"object_t","description":"Describes usage activity and other metrics of an Identity i.e. AWS IAM User, GCP IAM Principal, etc.","object_type":"identity_activity_metrics","caption":"Identity Activity Metrics","object_name":"Identity Activity Metrics"},"win/run_count":{"type":"integer_t","description":"The prefetch file run count.","extension":"win","extension_id":2,"caption":"Run Count","type_name":"Integer"},"score":{"type":"string_t","description":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source.","caption":"Reputation Score","type_name":"String"},"related_analytics":{"type":"object_t","description":"Describes analytics related to the analytic of a finding or detection as identified by the security product.","is_array":true,"object_type":"analytic","caption":"Related Analytics","object_name":"Analytic"},"remote_display":{"type":"object_t","description":"The remote display affiliated with the event","object_type":"display","caption":"Remote Display","object_name":"Display"},"track_direction":{"type":"string_t","description":"Direction of flight expressed as a “True North-based” ground track angle. This value is provided in clockwise degrees with a minimum resolution of 1 degree. If aircraft is not moving horizontally, use the “Unknown” value","caption":"Track Direction","type_name":"String"},"app_name":{"type":"string_t","description":"The name of the application associated with the event or object.","caption":"Application Name","type_name":"String"},"org":{"type":"object_t","description":"Organization and org unit relevant to the event or object. See specific usage.","object_type":"organization","caption":"Organization","object_name":"Organization"},"external_uid":{"type":"string_t","description":"A unique identifier assigned by an external system for cross-referencing.","caption":"External ID","type_name":"String"},"pre_value":{"type":"string_t","description":"The value before. See specific usage.","caption":"Pre-Value","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","caption":"Status","type_name":"String"},"condition_keys":{"type":"object_t","description":"The list of condition keys and their values that were evaluated as part of a rule or policy. Condition keys are used to define circumstances under which the rule/policy is in effect. See specific usage.","is_array":true,"object_type":"key_value_object","caption":"Condition Keys","object_name":"Key:Value object"},"original_time":{"type":"string_t","description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.","caption":"Original Time","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address, in either IPv4 or IPv6 format.","caption":"IP Address","type_name":"IP Address"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","caption":"Raw Data","type_name":"String"},"observation_type":{"type":"string_t","description":"The classification or category of the observation, indicating what kind of measurement or finding it represents. See specific usage.","caption":"Observation Type","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","caption":"Status ID","sibling":"status","type_name":"Integer"},"url_string":{"type":"url_t","description":"The URL string. See RFC 1738. For example: http://www.example.com/download/trouble.exe.","caption":"URL String","type_name":"URL String"},"page_number":{"type":"integer_t","description":"The page number of the document. See specific usage.","caption":"Page Number","type_name":"Integer"},"factor_type_id":{"type":"integer_t","enum":{"3":{"description":"System calls the user's registered phone number and requires the user to answer and provide a response.","caption":"Phone Call"},"6":{"description":"Physical device that generates a code to be used for authentication.","caption":"Hardware Token"},"0":{"caption":"Unknown"},"1":{"description":"User receives and inputs a code sent to their mobile device via SMS text message.","caption":"SMS"},"2":{"description":"The user responds to a security question as part of a question-based authentication factor","caption":"Security Question"},"99":{"caption":"Other"},"4":{"description":"Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.","caption":"Biometric"},"5":{"description":"Push notification is sent to user's registered device and requires the user to acknowledge.","caption":"Push Notification"},"7":{"description":"Application generates a one-time password (OTP) for use in authentication.","caption":"OTP"},"8":{"description":"A code or link is sent to a user's registered email address.","caption":"Email"},"9":{"description":"Typically involves a hardware token, which the user physically interacts with to authenticate.","caption":"U2F"},"10":{"description":"Web-based API that enables users to register devices as authentication factors.","caption":"WebAuthn"},"11":{"description":"The user enters a password that they have previously established.","caption":"Password"}},"description":"The normalized identifier for the authentication factor.","caption":"Factor Type ID","sibling":"factor_type","type_name":"Integer"},"vram_mode":{"type":"string_t","description":"The video memory attachment mode, indicating how the VRAM hardware is integrated with the system (e.g., shared or dedicated), normalized to the caption of the vram_mode_id value. For 'Other', the exact attachment mode is defined by the event source.","caption":"VRAM Mode","type_name":"String"},"log_type":{"type":"string_t","description":"The log type, normalized to the caption of the log_type_id value. In the case of 'Other', it is defined by the event source.","caption":"Log Type","type_name":"String"},"key_uid":{"type":"string_t","description":"The unique identifier of the key. See specific usage.","caption":"Key UID","type_name":"String"},"is_directed":{"type":"boolean_t","description":"Indicates if the entity has directionality. See specific usage.","caption":"Directed","type_name":"Boolean"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","caption":"Event Time","type_name":"Datetime"},"exploit_ref_url":{"type":"url_t","description":"The URL of the exploit code or Proof-of-Concept (PoC).","caption":"Exploit URL","type_name":"URL String"},"is_unused":{"type":"boolean_t","description":"Indicates whether an item is unused. See specific usage.","caption":"Is Unused","type_name":"Boolean"},"duration_months":{"type":"integer_t","description":"Represents the duration of the activity in months. See specific usage.","caption":"Duration Months","type_name":"Integer"},"fix_available":{"type":"boolean_t","description":"Indicates if a fix is available for the reported vulnerability.","caption":"Fix Availability","type_name":"Boolean","@deprecated":{"message":"Use the is_fix_available attribute instead.","since":"1.1.0"}},"network_interfaces":{"type":"object_t","description":"The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

","is_array":true,"object_type":"network_interface","caption":"Network Interfaces","object_name":"Network Interface"},"digest":{"type":"object_t","description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information.","object_type":"fingerprint","caption":"Message Digest","object_name":"Fingerprint"},"win/service_start_type_id":{"type":"integer_t","enum":{"3":{"description":"A user mode service started automatically during system startup.","caption":"Auto"},"0":{"description":"The service start type is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver loaded at boot.","caption":"Boot"},"2":{"description":"A kernel mode driver loaded during system startup.","caption":"System"},"99":{"description":"The service start type is not mapped. See the service_start_type attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"A user mode service started on demand when a process calls StartService.","caption":"Demand"},"5":{"description":"A driver or service that cannot be started.","caption":"Disabled"}},"description":"The normalized identifier of the service start type.","extension":"win","extension_id":2,"caption":"Service Start Type ID","sibling":"service_start_type","type_name":"Integer"},"detection_system":{"type":"string_t","description":"The name of the type of data security tool or system that the finding, detection, or alert originated from. E.g., Endpoint, Secure Email Gateway, etc.","caption":"Detection System","type_name":"String"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","caption":"Status Detail","type_name":"String"},"span":{"type":"object_t","description":"The information about the span. See specific usage.","object_type":"span","caption":"Span","object_name":"Span"},"last_run_time_dt":{"type":"datetime_t","description":"The last run time of application or service. See specific usage.","caption":"Last Run","type_name":"Datetime"},"pressure_altitude":{"type":"string_t","description":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: Invalid, No Value, or Unknown: -1000 m.","caption":"Pressure Altitude","type_name":"String"},"component":{"type":"string_t","description":"The component of a data object. See specific usage.","caption":"Component","type_name":"String"},"certificate":{"type":"object_t","description":"The certificate object containing information about the digital certificate.","object_type":"certificate","caption":"Certificate","object_name":"Digital Certificate"},"isp_org":{"type":"string_t","description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.","caption":"ISP Org","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"region":{"type":"string_t","description":"The name or the code of a region. See specific usage.","caption":"Region","type_name":"String"},"cpu_speed":{"type":"integer_t","description":"The speed of the processor in Mhz. For Example: 4200.","caption":"Processor Speed","type_name":"Integer"},"duration_weeks":{"type":"integer_t","description":"Represents the duration of the activity in weeks. See specific usage.","caption":"Duration Weeks","type_name":"Integer"},"bus_type_id":{"type":"integer_t","enum":{"3":{"description":"Peripheral Component Interconnect Express slot with 8 lanes; common for high‑performance NICs, storage controllers, and accelerators.","caption":"PCIe x8"},"6":{"description":"M.2 (NGFF) internal module form factor/connector exposing PCIe (and/or SATA/USB) for SSDs and add‑in modules.","caption":"M.2"},"0":{"description":"The bus type is unknown or not reported.","caption":"Unknown"},"1":{"description":"The device is attached directly on the motherboard or SoC (often referred to as 'integrated' or 'onboard').","caption":"Onboard"},"2":{"description":"Peripheral Component Interconnect Express slot with 16 lanes, typically used for high‑bandwidth add‑in devices.","caption":"PCIe x16"},"99":{"description":"A bus or interface standard not covered by the defined values; the exact value is reported by the event source.","caption":"Other"},"4":{"description":"Mobile PCI Express Module (MXM) Type A form factor (compact laptop/embedded GPU module).","caption":"MXM Type A"},"5":{"description":"Mobile PCI Express Module (MXM) Type B form factor (larger laptop/embedded GPU module).","caption":"MXM Type B"},"7":{"description":"Compute Express Link (CXL), an open cache‑coherent interconnect for processors, memory expansion, and accelerators built on the PCIe physical layer.","caption":"CXL"}},"description":"The normalized identifier of the attachment bus or interface standard.","caption":"Bus Type ID","sibling":"bus_type","type_name":"Integer"},"duration":{"type":"long_t","description":"This represents the duration of the activity in milliseconds. See specific usage.","caption":"Duration Milliseconds","type_name":"Long"},"vendor_name":{"type":"string_t","description":"The name of the vendor. See specific usage.","caption":"Vendor Name","type_name":"String"},"location":{"type":"object_t","description":"The detailed geographical location usually associated with an IP address.","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"license":{"type":"string_t","description":"The name or identifier of the license applied on package or software. See SPDX License List.","caption":"Software License","type_name":"String"},"file_result":{"type":"object_t","description":"The result of the file change. It should contain the new values of the changed attributes.","object_type":"file","caption":"File Result","object_name":"File"},"classification":{"type":"string_t","description":"The classification as defined by the vendor.","caption":"Classification","type_name":"String"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","object_type":"user","caption":"Assignee","object_name":"User"},"bulletin":{"type":"string_t","description":"The vendor bulletin identifier.","caption":"Patch Bulletin","type_name":"String"},"first_seen_time_dt":{"type":"datetime_t","description":"The initial detection time of the activity or object. See specific usage","caption":"First Seen","type_name":"Datetime"},"code":{"type":"integer_t","description":"The numeric response sent to a request.","caption":"Response Code","type_name":"Integer"},"log_name":{"type":"string_t","description":"The log name. See specific usage.","caption":"Log Name","type_name":"String"},"query_evidence":{"type":"object_t","description":"The resulting evidence discovered from the evidence search request.","object_type":"query_evidence","caption":"Query Evidence","object_name":"Query Evidence"},"company_name":{"type":"string_t","description":"The name of the company that published the file. For example: Microsoft Corporation.","caption":"Company Name","type_name":"String"},"discovery_details":{"type":"object_t","description":"A collection of Discovery Details objects. See specific usage.","is_array":true,"object_type":"discovery_details","caption":"Discovery Details","object_name":"Discovery Details"},"intermediate_ips":{"type":"ip_t","description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header.","is_array":true,"caption":"Intermediate IP Addresses","type_name":"IP Address"},"compliance_references":{"type":"object_t","description":"A list of reference KB articles that provide information to help organizations understand, interpret, and implement compliance standards. They provide guidance, best practices, and examples.","is_array":true,"object_type":"kb_article","caption":"Compliance Standard References","@deprecated":{"message":"Use the Compliance object with Check array instead","since":"1.5.0"},"object_name":"KB Article"},"condition":{"type":"string_t","description":"The condition that was evaluated in a rule, policy. See specific usage.","caption":"Condition","type_name":"String"},"chassis":{"type":"string_t","description":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows Windows Chassis Types","caption":"Chassis","type_name":"String"},"cc":{"type":"email_t","description":"The machine-readable email header Cc values, as defined by RFC 5322. For example example.user@usersdomain.com.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"caption":"Cc","type_name":"Email Address"},"total_potential_attacks_count":{"type":"integer_t","description":"The total count of privilege-to-attack technique mappings identified across all analyzed privileges.","caption":"Total Potential Attacks Count","type_name":"Integer"},"purl":{"type":"string_t","description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.","caption":"Package URL","type_name":"String"},"operation":{"type":"string_t","description":"Verb/Operation associated with the request","caption":"Operation","type_name":"String"},"file":{"type":"object_t","description":"The file that pertains to the event or object. See specific usage.","object_type":"file","caption":"File","object_name":"File"},"from_list":{"type":"email_t","description":"The machine-readable email header From values. This array should contain the value in from. For example example.user@usersdomain.com.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"caption":"From List","type_name":"Email Address"},"caption":{"type":"string_t","description":"A short description or caption of the device. For example: Scanner 1 or Database Manager.","caption":"Caption","type_name":"String"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","caption":"Impact Score","type_name":"Integer"},"user_agent":{"type":"string_t","description":"The request header that identifies the operating system and web browser.","caption":"HTTP User-Agent","type_name":"String","observable":16},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","caption":"Severity","type_name":"String"},"bytes":{"type":"long_t","description":"The total number of bytes (in and out).","caption":"Total Bytes","type_name":"Long"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period. See specific usage.","caption":"Start Time","type_name":"Datetime"},"overall_score":{"type":"float_t","description":"The overall score as reported by the event source. See specific usage.","caption":"Overall Score","type_name":"Float"},"web_resources":{"type":"object_t","description":"Describes details about web resources that were affected by an activity/event.","is_array":true,"object_type":"web_resource","caption":"Web Resources","object_name":"Web Resource"},"pid":{"type":"integer_t","description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.","caption":"Process ID","type_name":"Integer","observable":15},"package_manager":{"type":"string_t","description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc.","caption":"Package Manager","type_name":"String"},"edition":{"type":"string_t","description":"The operating system edition. For example: Professional.","caption":"OS Edition","type_name":"String"},"autoscale_uid":{"type":"string_t","description":"The unique identifier of the cloud autoscale configuration.","caption":"Autoscale UID","type_name":"String"},"office_location":{"type":"string_t","description":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, South East Virtual.","caption":"Office Location","type_name":"String"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","caption":"Severity ID","sibling":"severity","type_name":"Integer"},"network_endpoint":{"type":"object_t","description":"The Network Endpoint object describes characteristics of a network endpoint. See specific usage.","object_type":"network_endpoint","caption":"Network Endpoint","object_name":"Network Endpoint"},"ldap_dn":{"type":"string_t","description":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, cn=John Doe,ou=People,dc=example,dc=com.","caption":"LDAP Distinguished Name","type_name":"String"}},"name":"dictionary","description":"The Attribute Dictionary provides a comprehensive catalog of standardized attributes used across OCSF. It defines each attribute's properties, data types, and relationships. This dictionary serves as the authoritative reference for attribute definitions and ensures consistent usage throughout the schema.","types":{"attributes":{"boolean_t":{"values":[false,true],"description":"Boolean value. One of true or false.","caption":"Boolean"},"float_t":{"description":"Real floating-point value. For example:
3.14.","caption":"Float"},"integer_t":{"description":"Signed integer value.","caption":"Integer"},"json_t":{"description":"Embedded JSON value. A value can be a string, or a number, or true or false or null, or an object or an array. These structures can be nested. See www.json.org.","caption":"JSON"},"long_t":{"description":"8-byte long, signed integer value.","caption":"Long"},"string_t":{"description":"UTF-8 encoded byte sequence.","caption":"String"},"bytestring_t":{"type":"string_t","description":"Base 64 encoded immutable byte sequence. Traditional Base 64 is preferred but publishers may use URL-safe Base 64 when known to be acceptable to consumers. These encodings are described in RFC 4648.","regex":"^(?:(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)|(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=))?$","references":[{"description":"RFC 4648","url":"https://www.rfc-editor.org/rfc/rfc4648.html"}],"caption":"Byte String","type_name":"String"},"datetime_t":{"type":"string_t","description":"The Internet Date/Time format as defined in RFC-3339. For example:
2024-09-10T23:20:50.520Z,
2024-09-10 23:20:50.520789Z.","regex":"^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?([Zz]|[\\+-]\\d{2}:\\d{2})?$","caption":"Datetime","type_name":"String"},"email_t":{"type":"string_t","description":"Email address. For example:
john_doe@example.com.","regex":"^[a-zA-Z0-9!#$%&'*+-/=?^_`{|}~.]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$","caption":"Email Address","type_name":"String","observable":5},"file_hash_t":{"type":"string_t","description":"Fingerprint. A value, in any format, that maps an arbitrarily large data item to a much shorter string that uniquely identifies the original data. Examples include cryptographic hashing of a file, code signing, and Network Protocol Fingerprinting (NPF).

Note about name. The type name file_hast_t and the caption "Hash" are used for legacy reasons. This type has been generalized from a file hash to a general fingerprint. The existing type name and caption were retained for backwards compatibility.","caption":"Hash","type_name":"String","observable":8},"file_name_t":{"type":"string_t","description":"File name. For example:
text-file.txt.","caption":"File Name","type_name":"String","observable":7},"file_path_t":{"type":"string_t","description":"The full path to the file. For example: For example:
c:\\windows\\system32\\svchost.exe.","caption":"File Path","type_name":"String","observable":45},"hostname_t":{"type":"string_t","description":"Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:
r2-d2.example.com.,
mx.example.com","caption":"Hostname","type_name":"String","observable":1},"ip_t":{"type":"string_t","description":"Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:
192.168.200.24,
2001:0db8:85a3:0000:0000:8a2e:0370:7334.","regex":"((^\\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\s*$)|(^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?\\s*$))","caption":"IP Address","type_name":"String","max_len":40,"observable":2},"mac_t":{"type":"string_t","description":"Media Access Control (MAC) address. For example:
18:36:F3:98:4F:9A.","regex":"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$","caption":"MAC Address","type_name":"String","max_len":32,"observable":3},"port_t":{"type":"integer_t","description":"The TCP/UDP port number. For example:
80,
22.","range":[0,65535],"caption":"Port","type_name":"Integer","observable":11},"process_name_t":{"type":"string_t","description":"Process name. For example:
Notepad.","caption":"Process Name","type_name":"String","observable":9},"resource_uid_t":{"type":"string_t","description":"Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID.","caption":"Resource UID","type_name":"String","observable":10},"subnet_t":{"type":"string_t","description":"The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:
192.168.1.0/24,
2001:0db8:85a3:0000::/64","caption":"Subnet","type_name":"String","max_len":42,"observable":12},"timestamp_t":{"type":"long_t","description":"The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example:
1618524549901.","caption":"Timestamp","type_name":"Long"},"url_t":{"type":"string_t","description":"Uniform Resource Locator (URL) string. For example:
http://www.example.com/download/trouble.exe.","caption":"URL String","type_name":"String","observable":6},"username_t":{"type":"string_t","description":"User name. For example:
john_doe.","caption":"User Name","type_name":"String","observable":4},"uuid_t":{"type":"string_t","description":"128-bit universal unique identifier. For example:
123e4567-e89b-12d3-a456-42661417400.","regex":"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}","caption":"UUID","type_name":"String"},"reg_key_path_t":{"type":"string_t","description":"Full path of registry key.","extension":"win","extension_id":2,"caption":"Registry Key Path","type_name":"String","observable":46}},"description":"The data types available in OCSF. Each data type specifies constraints in the form regular expressions, max lengths or value limits. Implementers of OCSF should ensure they abide to these constraints.","caption":"Data Types"},"caption":"Attribute Dictionary"},"version":"1.8.0","extensions":{"linux":{"name":"linux","version":"1.8.0","description":"The Linux extension defines Linux specific attributes, profiles, objects, and classes.","uid":1,"caption":"Linux","platform_extension?":true},"win":{"name":"win","version":"1.8.0","description":"The Windows extension defines Windows specific attributes, objects, and classes.","uid":2,"caption":"Windows","platform_extension?":true},"macos":{"name":"macos","version":"1.8.0","description":"The macOS extension defines macOS specific attributes, profiles, objects, and classes.","uid":3,"caption":"macOS","platform_extension?":true}},"objects":{"query_info":{"attributes":{"data":{"type":"json_t","description":"The data returned from the query execution.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The query name for a saved or scheduled query.","requirement":"recommended","caption":"Name","type_name":"String"},"bytes":{"type":"long_t","description":"The size of the data returned from the query.","requirement":"optional","caption":"Total Bytes","type_name":"Long"},"uid":{"type":"string_t","description":"The unique identifier of the query.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"query_string":{"type":"string_t","description":"A string representing the query code being run. For example: SELECT * FROM my_table","requirement":"required","caption":"Query String","type_name":"String"},"query_time":{"type":"timestamp_t","description":"The time when the query was run.","requirement":"optional","caption":"Query Time","type_name":"Timestamp"},"query_time_dt":{"type":"datetime_t","description":"The time when the query was run.","requirement":"optional","profiles":["datetime"],"caption":"Query Time","type_name":"Datetime"}},"name":"query_info","description":"The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a query must be written using a specific syntax.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["datetime"],"caption":"Query Information"},"vendor_attributes":{"attributes":{"severity":{"type":"string_t","description":"The finding severity, as reported by the Vendor (Finding Provider). The value should be normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Severity","type_name":"String"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"The finding severity ID, as reported by the Vendor (Finding Provider).","requirement":"optional","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"vendor_attributes","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","extends":"object","caption":"Vendor Attributes"},"process_entity":{"attributes":{"name":{"type":"process_name_t","description":"The friendly name of the process, for example: Notepad++.","requirement":"recommended","caption":"Name","type_name":"Process Name"},"pid":{"type":"integer_t","description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.","requirement":"recommended","caption":"Process ID","type_name":"Integer","observable":15},"path":{"type":"string_t","description":"The process file path.","requirement":"optional","caption":"Path","type_name":"String"},"uid":{"type":"string_t","description":"A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":39},"cmd_line":{"type":"string_t","description":"The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used.","requirement":"recommended","caption":"Command Line","type_name":"String","observable":13},"cpid":{"type":"uuid_t","description":"A unique process identifier that can be assigned deterministically by multiple system data producers.","source":"cpid","references":[{"description":"OCSF Common Process Identifier (CPID) Specification","url":"https://github.com/ocsf/common-process-id"}],"requirement":"recommended","caption":"Common Process Identifier","type_name":"UUID"},"created_time":{"type":"timestamp_t","description":"The time when the process was created/started.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"created_time_dt":{"type":"datetime_t","description":"The time when the process was created/started.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"process_entity","description":"The Process Entity object provides critical fields for referencing a process.","extends":"_entity","constraints":{"at_least_one":["cmd_line","name","path","pid","uid","cpid"]},"profiles":["datetime"],"caption":"Process Entity"},"cvss":{"attributes":{"version":{"type":"string_t","description":"The CVSS version. For example: 3.1.","requirement":"required","caption":"Version","type_name":"String"},"depth":{"type":"string_t","enum":{"Base":{"caption":"Base"},"Environmental":{"caption":"Environmental"},"Temporal":{"caption":"Temporal"}},"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score.","requirement":"recommended","caption":"CVSS Depth","type_name":"String"},"severity":{"type":"string_t","description":"

The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.

CVSS v2.0

CVSS v3.0","requirement":"optional","caption":"Severity","type_name":"String"},"metrics":{"type":"object_t","description":"The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: { {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}.","is_array":true,"requirement":"optional","object_type":"metric","caption":"Metrics","object_name":"Metric"},"base_score":{"type":"float_t","description":"The CVSS base score. For example: 9.1.","requirement":"required","caption":"Base Score","type_name":"Float"},"overall_score":{"type":"float_t","description":"The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.","requirement":"recommended","caption":"Overall Score","type_name":"Float"},"src_url":{"type":"url_t","description":"The source URL for the CVSS score. For example: https://nvd.nist.gov/vuln/detail/CVE-2021-44228","requirement":"optional","caption":"Source URL","type_name":"URL String"},"vector_string":{"type":"string_t","description":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.","requirement":"optional","caption":"Vector String","type_name":"String"},"vendor_name":{"type":"string_t","description":"The vendor that provided the CVSS score. For example: NVD, REDHAT etc.","requirement":"recommended","caption":"Vendor Name","type_name":"String"}},"name":"cvss","description":"The Common Vulnerability Scoring System (CVSS) object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.","extends":"object","caption":"CVSS Score"},"authorization":{"attributes":{"decision":{"type":"string_t","description":"Authorization Result/outcome, e.g. allowed, denied.","requirement":"recommended","caption":"Authorization Decision/Outcome","type_name":"String"},"policy":{"type":"object_t","description":"Details about the Identity/Access management policies that are applicable.","requirement":"optional","object_type":"policy","caption":"Policy","object_name":"Policy"}},"name":"authorization","description":"The Authorization Result object provides details about the authorization outcome and associated policies related to activity.","extends":"object","caption":"Authorization Result"},"ai_model":{"attributes":{"name":{"type":"string_t","description":"Human-readable model name. For example: gpt-4o, claude-3-sonnet, or text-embedding-ada-002.","requirement":"required","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"Model version identifier. For example: 2024-05-13, v2.1.0, or beta.","requirement":"recommended","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the AI model.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"ai_provider":{"type":"string_t","description":"AI service provider or organization name. For example: OpenAI, Anthropic, Google, or Internal.","requirement":"required","caption":"AI Provider","type_name":"String"}},"name":"ai_model","description":"The AI Model object describes the characteristics of an AI/ML model. Examples include language models like GPT-4, embedding models like text-embedding-ada-002, and computer vision models like CLIP.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"AI Model Registry and Documentation Standards","url":"https://huggingface.co/docs/hub/models"},{"description":"OpenAI Model Documentation","url":"https://platform.openai.com/docs/models"}],"caption":"AI Model"},"cis_benchmark":{"attributes":{"name":{"type":"string_t","description":"The CIS Benchmark name. For example: Ensure mounting of cramfs filesystems is disabled.","requirement":"required","caption":"Name","type_name":"String"},"desc":{"type":"string_t","description":"The CIS Benchmark description. For example: The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.","requirement":"optional","caption":"Description","type_name":"String"},"cis_controls":{"type":"object_t","description":"The CIS Critical Security Controls is a prioritized set of actions to protect your organization and data from cyber-attack vectors.","is_array":true,"requirement":"recommended","object_type":"cis_control","caption":"CIS Controls","object_name":"CIS Control"}},"name":"cis_benchmark","description":"The CIS Benchmark object describes best practices for securely configuring IT systems, software, networks, and cloud infrastructure as defined by the Center for Internet Security. See also Getting to Know the CIS Benchmarks.","extends":"object","caption":"CIS Benchmark","@deprecated":{"message":"Use the Compliance object with Checks object instead.","since":"1.5.0"}},"win/reg_key":{"attributes":{"path":{"type":"reg_key_path_t","description":"The full path to the registry key.","requirement":"required","caption":"Path","type_name":"Registry Key Path"},"is_system":{"type":"boolean_t","description":"The indication of whether the object is part of the operating system.","requirement":"optional","caption":"System","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The time when the registry key was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"security_descriptor":{"type":"string_t","description":"The security descriptor of the registry key.","requirement":"optional","caption":"Security Descriptor","type_name":"String"},"modified_time_dt":{"type":"datetime_t","description":"The time when the registry key was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"reg_key","description":"The registry key object describes a Windows registry key.","extension":"win","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:WindowsRegistryKey.","url":"https://d3fend.mitre.org/dao/artifact/d3f:WindowsRegistryKey/"}],"extension_id":2,"profiles":["datetime"],"caption":"Registry Key","observable":28},"threat_actor":{"attributes":{"name":{"type":"string_t","description":"The name of the threat actor.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The classification of the threat actor based on their motivations, capabilities, or affiliations. Common types include nation-state actors, cybercriminal groups, hacktivists, or insider threats.","requirement":"optional","caption":"Threat Actor Type","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Hacktivists"},"0":{"description":"The threat actor type is unknown.","caption":"Unknown"},"1":{"caption":"Nation-state"},"2":{"caption":"Cybercriminal"},"99":{"description":"The threat actor type is not mapped.","caption":"Other"},"4":{"caption":"Insider"}},"description":"The normalized datastore resource type identifier.","requirement":"recommended","caption":"Threat Actor Type ID","sibling":"type","type_name":"Integer"}},"name":"threat_actor","description":"Threat actor is responsible for the observed malicious activity.","extends":"object","caption":"Threat Actor"},"scan":{"attributes":{"name":{"type":"string_t","description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\"","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of scan.","requirement":"optional","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The application-defined unique identifier assigned to an instance of a scan.","requirement":"recommended","caption":"Scan UID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"The scan was triggered by a content update.","caption":"Updated Content"},"6":{"description":"The scan was started due to a user logon.","caption":"User Logon"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The scan was manually initiated by the user or administrator.","caption":"Manual"},"2":{"description":"The scan was started based on scheduler.","caption":"Scheduled"},"99":{"description":"The scan type id is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The scan was triggered by newly quarantined items.","caption":"Quarantined Items"},"5":{"description":"The scan was triggered by the attachment of removable media.","caption":"Attached Media"},"7":{"description":"The scan was triggered by an Early Launch Anti-Malware (ELAM) detection.","caption":"ELAM"}},"description":"The type id of the scan.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"}},"name":"scan","description":"The Scan object describes characteristics of a proactive scan.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Scan"},"kernel_driver":{"attributes":{"file":{"type":"object_t","description":"The driver/extension file object.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"}},"name":"kernel_driver","description":"The Kernel Extension object describes a kernel driver that has been loaded or unloaded into the operating system (OS) kernel.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:KernelModule","url":"https://d3fend.mitre.org/dao/artifact/d3f:KernelModule/"}],"profiles":["data_classification"],"caption":"Kernel Extension"},"kill_chain_phase":{"attributes":{"phase":{"type":"string_t","description":"The cyber kill chain phase.","requirement":"recommended","caption":"Kill Chain Phase","type_name":"String"},"phase_id":{"type":"integer_t","enum":{"3":{"description":"The intruders will use various tactics, such as phishing, infected USB drives, etc.","caption":"Delivery"},"6":{"description":"Malware opens a command channel to enable the intruders to remotely manipulate the victim's system.","caption":"Command & Control"},"0":{"description":"The kill chain phase is unknown.","caption":"Unknown"},"1":{"description":"The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them.","caption":"Reconnaissance"},"2":{"description":"The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities.","caption":"Weaponization"},"99":{"description":"The kill chain phase is not mapped. See the phase attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The intruders start leveraging vulnerabilities to executed code on the victim’s system.","caption":"Exploitation"},"5":{"description":"The intruders install malware on the victim’s system.","caption":"Installation"},"7":{"description":"With hands-on keyboard access, intruders accomplish the mission’s goal.","caption":"Actions on Objectives"}},"description":"The cyber kill chain phase identifier.","requirement":"required","caption":"Kill Chain Phase ID","sibling":"phase","type_name":"Integer"}},"name":"kill_chain_phase","description":"The Kill Chain Phase object represents a single phase of a cyber attack, including the initial reconnaissance and planning stages up to the final objective of the attacker. It provides a detailed description of each phase and its associated activities within the broader context of a cyber attack. See Cyber Kill Chain®.","extends":"object","caption":"Kill Chain Phase"},"os":{"attributes":{"name":{"type":"string_t","description":"The operating system name.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the operating system.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\".","requirement":"optional","caption":"Version","type_name":"String"},"build":{"type":"string_t","description":"The operating system build number.","requirement":"optional","caption":"OS Build","type_name":"String"},"country":{"type":"string_t","description":"The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code).

Note: The two letter country code should be capitalized. For example: US or CA.

","references":[{"description":"ISO 3166-1 alpha-2 codes","url":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}],"requirement":"optional","caption":"Country","type_name":"String","observable":14},"lang":{"type":"string_t","description":"The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).","requirement":"optional","caption":"Language","type_name":"String"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"101":{"caption":"Windows Mobile"},"100":{"caption":"Windows"},"200":{"caption":"Linux"},"201":{"caption":"Android"},"300":{"caption":"macOS"},"301":{"caption":"iOS"},"302":{"caption":"iPadOS"},"400":{"caption":"Solaris"},"401":{"caption":"AIX"},"402":{"caption":"HP-UX"}},"description":"The type identifier of the operating system.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"cpe_name":{"type":"string_t","description":"The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.","requirement":"optional","caption":"The product CPE identifier","type_name":"String"},"cpu_bits":{"type":"integer_t","description":"The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.","requirement":"optional","caption":"CPU Bits","type_name":"Integer"},"edition":{"type":"string_t","description":"The operating system edition. For example: Professional.","requirement":"optional","caption":"OS Edition","type_name":"String"},"kernel_release":{"type":"string_t","description":"The kernel release of the operating system. On Unix-based systems, this is determined from the uname -r command output, for example \"5.15.0-122-generic\".","requirement":"optional","caption":"Kernel Release","type_name":"String"},"sp_name":{"type":"string_t","description":"The name of the latest Service Pack.","requirement":"optional","caption":"OS Service Pack","type_name":"String"},"sp_ver":{"type":"integer_t","description":"The version number of the latest Service Pack.","requirement":"optional","caption":"OS Service Pack Version","type_name":"Integer"}},"name":"os","description":"The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:OperatingSystem","url":"https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/"}],"caption":"Operating System (OS)"},"compliance":{"attributes":{"control":{"type":"string_t","description":"A Control is a prescriptive, actionable set of specifications that strengthens device posture. The control specifies required security measures, while the specific implementation values are defined in control_parameters. E.g., CIS AWS Foundations Benchmark 1.2.0 - Control 2.1 - Ensure CloudTrail is enabled in all regions","references":[{"description":"CIS AWS Foundations Benchmark 1.2.0","url":"https://www.cisecurity.org/benchmark/amazon_web_services"},{"description":"CloudTrail Documentation","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html"}],"requirement":"recommended","caption":"Security Control","type_name":"String"},"status":{"type":"string_t","description":"The resultant status of the compliance check normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","requirement":"recommended","caption":"Status","type_name":"String"},"desc":{"type":"string_t","description":"The description or criteria of a control.","requirement":"optional","caption":"Description","type_name":"String"},"category":{"type":"string_t","description":"The category a control framework pertains to, as reported by the source tool, such as Asset Management or Risk Assessment.","requirement":"optional","caption":"Category","type_name":"String"},"assessments":{"type":"object_t","description":"A list of assessments associated with the compliance requirements evaluation.","is_array":true,"requirement":"optional","object_type":"assessment","caption":"Assessments","object_name":"Assessment"},"checks":{"type":"object_t","description":"A list of compliance checks associated with specific industry standards or frameworks. Each check represents an individual rule or requirement that has been evaluated against a target device. Checks typically include details such as the check name (e.g., CIS: 'Ensure mounting of cramfs filesystems is disabled' or DISA STIG descriptive titles), unique identifiers (such as CIS identifier '1.1.1.1' or DISA STIG identifier 'V-230234'), descriptions (detailed explanations of security requirements or vulnerability discussions), and version information.","is_array":true,"references":[{"description":"Center for Internet Security Benchmarks","url":"https://www.cisecurity.org/cis-benchmarks/"},{"description":"DISA Security Technical Implementation Guides (STIGs)","url":"https://public.cyber.mil/stigs/"}],"requirement":"optional","object_type":"check","caption":"Compliance Checks","object_name":"Check"},"compliance_references":{"type":"object_t","description":"A list of reference KB articles that provide information to help organizations understand, interpret, and implement compliance standards. They provide guidance, best practices, and examples.","is_array":true,"requirement":"optional","object_type":"kb_article","caption":"Compliance Standard References","@deprecated":{"message":"Use the Compliance object with Check array instead.","since":"1.5.0"},"object_name":"KB Article"},"compliance_standards":{"type":"object_t","description":"A list of established guidelines or criteria that define specific requirements an organization must follow.","is_array":true,"requirement":"optional","object_type":"kb_article","caption":"Compliance Standards: Details","@deprecated":{"message":"Use the Compliance object with Check array instead.","since":"1.5.0"},"object_name":"KB Article"},"control_parameters":{"type":"object_t","description":"The list of control parameters evaluated in a Compliance check. E.g., parameters for CloudTrail configuration might include multiRegionTrailEnabled: true, logFileValidationEnabled: true, and requiredRegions: [us-east-1, us-west-2]","is_array":true,"references":[{"description":"AWS CloudTrail Configuration Parameters","url":"https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html"},{"description":"AWS Multi-Region CloudTrail Best Practices","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html"},{"description":"CloudTrail Log File Validation","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html"}],"requirement":"optional","object_type":"key_value_object","caption":"Control Parameters","object_name":"Key:Value object"},"requirements":{"type":"string_t","description":"The specific compliance requirements being evaluated. E.g., PCI DSS Requirement 8.2.3 - Passwords must meet minimum complexity requirements or HIPAA Security Rule 164.312(a)(2)(iv) - Implement encryption and decryption mechanisms","is_array":true,"references":[{"description":"PCI DSS Standards","url":"https://www.pcisecuritystandards.org/document_library"},{"description":"HIPAA Security Rule","url":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"}],"requirement":"optional","caption":"Compliance Requirements","type_name":"String"},"standards":{"type":"string_t","description":"The regulatory or industry standards being evaluated for compliance.","is_array":true,"references":[{"description":"PCI DSS 3.2.1","url":"https://www.pcisecuritystandards.org/document_library"},{"description":"HIPAA Security Rule","url":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"},{"description":"NIST SP 800-53 Rev. 5","url":"https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final"},{"description":"ISO/IEC 27001:2013","url":"https://www.iso.org/standard/54534.html"}],"requirement":"recommended","caption":"Compliance Standards: List","type_name":"String"},"status_code":{"type":"string_t","description":"The resultant status code of the compliance check.","requirement":"optional","caption":"Status Code","type_name":"String"},"status_detail":{"type":"string_t","description":"The contextual description of the status, status_code values.","requirement":"optional","caption":"Status Detail","type_name":"String","@deprecated":{"message":"Use the status_details attribute instead.","since":"1.4.0"}},"status_details":{"type":"string_t","description":"A list of contextual descriptions of the status, status_code values.","is_array":true,"requirement":"optional","caption":"Status Details","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The compliance check failed for at least one of the evaluated resources.","caption":"Fail"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The compliance check passed for all the evaluated resources.","caption":"Pass"},"2":{"description":"The compliance check did not yield a result due to missing information.","caption":"Warning"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized status identifier of the compliance check.","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"}},"name":"compliance","description":"The Compliance object contains information about Industry and Regulatory Framework standards, controls and requirements or details about custom assessments utilized in a compliance evaluation. Standards define broad security frameworks, controls represent specific security requirements within those frameworks, and checks are the testable verification points used to determine if controls are properly implemented.","extends":"object","profiles":["cloud","data_classification"],"caption":"Compliance"},"d3fend":{"attributes":{"version":{"type":"string_t","description":"The D3FEND™ Matrix version.","requirement":"recommended","caption":"Version","type_name":"String"},"d3f_tactic":{"type":"object_t","description":"The Tactic object describes the tactic ID and/or name that is associated with a countermeasure.","references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"requirement":"recommended","object_type":"d3f_tactic","caption":"MITRE D3FEND™ Tactic","object_name":"MITRE D3FEND™ Tactic"},"d3f_technique":{"type":"object_t","description":"The Technique object describes the technique ID and/or name associated with a countermeasure.","references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"requirement":"recommended","object_type":"d3f_technique","caption":"MITRE D3FEND™ Technique","object_name":"MITRE D3FEND™ Technique"}},"name":"d3fend","description":"The MITRE D3FEND™ object describes the tactic & technique associated with a countermeasure.","extends":"object","constraints":{"at_least_one":["d3f_tactic","d3f_technique"]},"references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"caption":"MITRE D3FEND™"},"email":{"attributes":{"size":{"type":"long_t","description":"The size in bytes of the email, including attachments.","requirement":"recommended","caption":"Size","type_name":"Long"},"from_list":{"type":"email_t","description":"The machine-readable email header From values. This array should contain the value in from. For example example.user@usersdomain.com.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"From List","type_name":"Email Address"},"uid":{"type":"string_t","description":"The unique identifier of the email thread.","requirement":"recommended","caption":"Email Thread UID","type_name":"String","observable":41},"files":{"type":"object_t","description":"The files embedded or attached to the email.","is_array":true,"requirement":"optional","object_type":"file","caption":"Files","object_name":"File"},"from":{"type":"email_t","description":"The machine-readable email header From value, as defined by RFC 5322. For example example.user@usersdomain.com.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"From","type_name":"Email Address"},"cc":{"type":"email_t","description":"The machine-readable email header Cc values, as defined by RFC 5322. For example example.user@usersdomain.com.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"optional","caption":"Cc","type_name":"Email Address"},"to":{"type":"email_t","description":"The machine-readable email header To values, as defined by RFC 5322. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"To","type_name":"Email Address"},"sender":{"type":"email_t","description":"The machine readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the from field, which shows the message author. The sender field is most commonly used when multiple addresses appear in the from_list field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else).","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"optional","caption":"Sender","type_name":"Email Address"},"subject":{"type":"string_t","description":"The email header Subject value, as defined by RFC 5322.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"Subject","type_name":"String","observable":40},"cc_mailboxes":{"type":"string_t","description":"The human-readable email header Cc Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"Cc Mailboxes","type_name":"String"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"delivered_to":{"type":"email_t","description":"The machine-readable Delivered-To email header field. For example example.user@usersdomain.com","requirement":"optional","caption":"Delivered To","type_name":"Email Address","@deprecated":{"message":"Use the delivered_to_list attribute instead.","since":"1.4.0"}},"delivered_to_list":{"type":"email_t","description":"The machine-readable Delivered-To email header values. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 9228","url":"https://www.rfc-editor.org/rfc/rfc9228"}],"requirement":"optional","caption":"Delivered To List","type_name":"Email Address"},"from_mailbox":{"type":"string_t","description":"The human-readable email header From Mailbox value. For example 'Example User <example.user@usersdomain.com>'.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"From Mailbox","type_name":"String"},"from_mailboxes":{"type":"email_t","description":"The human-readable email header From Mailbox values. This array should contain the value in from_mailbox. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"From Mailboxes","type_name":"Email Address"},"http_headers":{"type":"object_t","description":"Additional HTTP headers of an HTTP request or response.","is_array":true,"requirement":"optional","object_type":"http_header","caption":"HTTP Headers","object_name":"HTTP Header"},"is_read":{"type":"boolean_t","description":"The indication of whether the email has been read.","requirement":"optional","caption":"Read","type_name":"Boolean"},"message_uid":{"type":"string_t","description":"The email header Message-ID value, as defined by RFC 5322.","source":"Message-ID","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"Message UID","type_name":"String","observable":42},"raw_header":{"type":"string_t","description":"The email authentication header.","requirement":"optional","caption":"Raw Header","type_name":"String"},"reply_to":{"type":"email_t","description":"The machine-readable email header Reply-To value, as defined by RFC 5322. For example example.user@usersdomain.com","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"Reply To","type_name":"Email Address","@deprecated":{"message":"Use the reply_to_list attribute instead.","since":"1.4.0"}},"reply_to_list":{"type":"email_t","description":"The machine-readable email header Reply-To values, as defined by RFC 5322. For example example.user@usersdomain.com","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"optional","caption":"Reply To List","type_name":"Email Address"},"reply_to_mailboxes":{"type":"string_t","description":"The human-readable email header Reply To Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"Reply To Mailboxes","type_name":"String"},"return_path":{"type":"email_t","description":"The address found in the 'Return-Path' header, which indicates where bounce messages (non-delivery reports) should be sent. This address is often set by the sending system and may differ from the 'From' or 'Sender' addresses. For example, mailer-daemon@senderserver.com.","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"},{"description":"RFC 5321 - Simple Mail Transfer Protocol","url":"https://datatracker.ietf.org/doc/html/rfc5321#section-4.4"}],"requirement":"optional","caption":"Return Path","type_name":"Email Address"},"sender_mailbox":{"type":"string_t","description":"The human readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the from_mailbox field, which shows the message author. The sender mailbox field is most commonly used when multiple addresses appear in the from_mailboxes field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else).","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"optional","caption":"Sender Mailbox","type_name":"String"},"smtp_from":{"type":"email_t","description":"The value of the SMTP MAIL FROM command.","requirement":"recommended","caption":"SMTP From","type_name":"Email Address","@deprecated":{"message":"Use the from attribute instead.","since":"1.4.0"}},"smtp_to":{"type":"email_t","description":"The value of the SMTP envelope RCPT TO command.","is_array":true,"requirement":"recommended","caption":"SMTP To","type_name":"Email Address","@deprecated":{"message":"Use the to attribute instead.","since":"1.4.0"}},"to_mailboxes":{"type":"string_t","description":"The human-readable email header To Mailbox values. For example 'Example User <example.user@usersdomain.com>'.","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322#section-3.4"}],"requirement":"optional","caption":"To Mailboxes","type_name":"String"},"urls":{"type":"object_t","description":"The URLs embedded in the email.","is_array":true,"requirement":"optional","object_type":"url","caption":"URLs","object_name":"Uniform Resource Locator"},"x_originating_ip":{"type":"ip_t","description":"The X-Originating-IP header identifying the emails originating IP address(es).","is_array":true,"requirement":"optional","caption":"X-Originating-IP","type_name":"IP Address"}},"name":"email","description":"The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.","extends":"object","constraints":{"at_least_one":["from","to"]},"references":[{"description":"D3FEND™ Ontology d3f:Email.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Email/"}],"profiles":["data_classification"],"caption":"Email","observable":22},"firewall_rule":{"attributes":{"name":{"type":"string_t","description":"The name of the rule that generated the event.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The rule type.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The rule version. For example: 1.1.","requirement":"optional","caption":"Version","type_name":"String"},"desc":{"type":"string_t","description":"The description of the rule that generated the event.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the rule that generated the event.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The rule category.","requirement":"optional","caption":"Category","type_name":"String"},"duration":{"type":"long_t","description":"The rule response time duration, usually used for challenge completion time.","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"condition":{"type":"string_t","description":"The rule trigger condition for the rule. For example: SQL_INJECTION.","requirement":"optional","caption":"Condition","type_name":"String"},"match_details":{"type":"string_t","description":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'.","is_array":true,"requirement":"optional","caption":"Match Details","type_name":"String"},"match_location":{"type":"string_t","description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER.","requirement":"optional","caption":"Match Location","type_name":"String"},"rate_limit":{"type":"integer_t","description":"The rate limit for a rate-based rule.","requirement":"optional","caption":"Rate Limit","type_name":"Integer"},"sensitivity":{"type":"string_t","description":"The sensitivity of the firewall rule in the matched event. For example: HIGH.","requirement":"optional","caption":"Sensitivity","type_name":"String"}},"name":"firewall_rule","description":"The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.","extends":"rule","constraints":{"at_least_one":["name","uid"]},"caption":"Firewall Rule"},"startup_item":{"attributes":{"driver":{"type":"object_t","description":"The startup item kernel driver resource.","requirement":"optional","object_type":"kernel_driver","caption":"Kernel Driver","object_name":"Kernel Extension"},"name":{"type":"string_t","description":"The unique name of the startup item.","requirement":"required","caption":"Name","type_name":"String"},"process":{"type":"object_t","description":"The startup item process resource.","requirement":"optional","object_type":"process","caption":"Process","object_name":"Process"},"type":{"type":"string_t","description":"The startup item type.","requirement":"optional","caption":"Type","type_name":"String"},"start_type":{"type":"string_t","description":"The start type of the startup item.","requirement":"optional","caption":"Start Type","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A background process typically managed by the operating system, e.g., a service process on Windows or a systemd-managed daemon on Linux.","caption":"Service"},"6":{"description":"System extensions on macOS enables 3rd parties to extend the capabilities of macOS.","caption":"System Extension"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"Kernel mode driver.","caption":"Kernel Mode Driver"},"2":{"description":"User mode driver.","caption":"User Mode Driver"},"99":{"description":"The startup item type is not mapped. See the type attribute, which contains data source specific values.","caption":"Other"},"4":{"description":"An application that runs in the user space.","caption":"User Mode Application"},"5":{"description":"The macOS Autoload Application.","caption":"Autoload"},"7":{"description":"Kernel extensions on macOS includes Apple provided pre-installs and 3rd party installs which enables support for specific hardware or software features not natively supported by macOS.","caption":"Kernel Extension"},"8":{"description":"A job or task that runs on a configured schedule.","caption":"Scheduled Job, Task"}},"description":"The startup item type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"job":{"type":"object_t","description":"The startup item job resource.","requirement":"optional","object_type":"job","caption":"Job","object_name":"Job"},"run_mode_ids":{"type":"integer_t","enum":{"3":{"description":"The startup item runs in a shared process.","caption":"Shared Process"},"0":{"description":"The run mode is unknown.","caption":"Unknown"},"1":{"description":"The startup item interacts with the desktop.","caption":"Interactive"},"2":{"description":"The startup item runs in its own process.","caption":"Own Process"},"99":{"description":"The run mode is not mapped. See the run_modes attribute, which contains data source specific values.","caption":"Other"}},"description":"The list of normalized identifiers that describe the startup items' properties when it is running. Use this field to capture extended information about the process, which may depend on the type of startup item. E.g., A Windows service that interacts with the desktop.","is_array":true,"requirement":"optional","caption":"Run Mode IDs","sibling":"run_modes","type_name":"Integer"},"run_modes":{"type":"string_t","description":"The list of run_modes, normalized to the captions of the run_mode_id values. In the case of 'Other', they are defined by the event source.","is_array":true,"requirement":"optional","caption":"Run Modes","type_name":"String"},"run_state":{"type":"string_t","description":"The run state of the startup item.","requirement":"optional","caption":"Run State","type_name":"String"},"run_state_id":{"type":"integer_t","enum":{"3":{"description":"The service is stopping.","caption":"Stop Pending"},"6":{"description":"The service is pending pause.","caption":"Pause Pending"},"0":{"description":"The run state is unknown.","caption":"Unknown"},"1":{"description":"The service is not running.","caption":"Stopped"},"2":{"description":"The service is starting.","caption":"Start Pending"},"99":{"description":"The run state is not mapped. See the run_state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The service is running.","caption":"Running"},"5":{"description":"The service is pending continue.","caption":"Continue Pending"},"7":{"description":"The service is paused.","caption":"Paused"},"8":{"description":"The service is pending restart.","caption":"Restart Pending"}},"description":"The run state ID of the startup item.","requirement":"recommended","caption":"Run State ID","sibling":"run_state","type_name":"Integer"},"start_type_id":{"type":"integer_t","enum":{"3":{"description":"Started on demand. For example, by the Windows Service Control Manager when a process calls the StartService function.","caption":"On Demand"},"6":{"description":"Started on specific user logins.","caption":"Specific User Login"},"0":{"description":"The start type is unknown.","caption":"Unknown"},"1":{"description":"Service started automatically during system startup.","caption":"Auto"},"2":{"description":"Device driver started by the system loader.","caption":"Boot"},"99":{"description":"The start type is not mapped. See the start_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The service is disabled, and cannot be started.","caption":"Disabled"},"5":{"description":"Started on all user logins.","caption":"All Logins"},"7":{"description":"Stared according to a schedule.","caption":"Scheduled"},"8":{"description":"Started when a system item, such as a file or registry key, changes.","caption":"System Changed"}},"description":"The start type ID of the startup item.","requirement":"required","caption":"Start Type ID","sibling":"start_type","type_name":"Integer"},"win_service":{"type":"object_t","description":"The startup item Windows service resource.","extension":"win","requirement":"optional","extension_id":2,"object_type":"win/win_service","caption":"Windows Service","object_name":"Windows Service"}},"name":"startup_item","description":"The startup item object describes an application component that has associated startup criteria and configurations.","constraints":{"just_one":["driver","job","process","win_service"]},"profiles":["container","data_classification","linux/linux_users","macos/macos_users"],"caption":"Startup Item"},"dce_rpc":{"attributes":{"command":{"type":"string_t","description":"The request command (e.g. REQUEST, BIND).","requirement":"recommended","caption":"Command","type_name":"String"},"flags":{"type":"string_t","description":"The list of interface flags.","is_array":true,"requirement":"required","caption":"Flags","type_name":"String"},"command_response":{"type":"string_t","description":"The reply to the request command (e.g. RESPONSE, BINDACK or FAULT).","requirement":"recommended","caption":"Command Response","type_name":"String"},"opnum":{"type":"integer_t","description":"An operation number used to identify a specific remote procedure call (RPC) method or a method in an interface.","requirement":"recommended","caption":"Opnum","type_name":"Integer"},"rpc_interface":{"type":"object_t","description":"The RPC Interface object describes the details pertaining to the remote procedure call interface.","requirement":"required","object_type":"rpc_interface","caption":"Remote Procedure Call Interface","object_name":"RPC Interface"}},"name":"dce_rpc","description":"The DCE/RPC, or Distributed Computing Environment/Remote Procedure Call, object describes the remote procedure call system for distributed computing environments.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:RemoteProcedureCall.","url":"https://d3fend.mitre.org/dao/artifact/d3f:RemoteProcedureCall/"}],"caption":"DCE/RPC"},"node":{"attributes":{"data":{"type":"json_t","description":"Additional data about the node stored as key-value pairs. Can include custom properties specific to the node.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"A human-readable name or label for the node. Should be descriptive and unique within the graph context.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"Categorizes the node into a specific class or type. Useful for grouping and filtering nodes.","requirement":"optional","caption":"Type","type_name":"String"},"desc":{"type":"string_t","description":"A human-readable description of the node's purpose or meaning in the graph.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"A unique string or numeric identifier that distinguishes this node from all others in the graph. Must be unique across all nodes.","requirement":"required","caption":"Unique ID","type_name":"String"}},"name":"node","description":"Represents a node or a vertex in a graph structure.","extends":"object","references":[{"description":"JSON graph specification.","url":"https://github.com/jsongraph/json-graph-specification/"}],"caption":"Node"},"http_cookie":{"attributes":{"name":{"type":"string_t","description":"The HTTP cookie name.","requirement":"required","caption":"Name","type_name":"String"},"value":{"type":"string_t","description":"The HTTP cookie value.","requirement":"required","caption":"Value","type_name":"String"},"path":{"type":"string_t","description":"The path of the HTTP cookie.","requirement":"optional","caption":"Path","type_name":"String"},"domain":{"type":"string_t","description":"The domain name for the server from which the http_cookie is served.","requirement":"optional","caption":"Domain","type_name":"String"},"secure":{"type":"boolean_t","description":"The cookie attribute to only send cookies to the server with an encrypted request over the HTTPS protocol.","requirement":"optional","caption":"Secure","type_name":"Boolean","@deprecated":{"message":"Use the is_secure attribute instead.","since":"1.1.0"}},"http_only":{"type":"boolean_t","description":"A cookie attribute to make it inaccessible via JavaScript","requirement":"optional","caption":"HTTP Only","type_name":"Boolean","@deprecated":{"message":"Use the is_http_only attribute instead.","since":"1.1.0"}},"expiration_time":{"type":"timestamp_t","description":"The expiration time of the HTTP cookie.","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"is_http_only":{"type":"boolean_t","description":"This attribute prevents the cookie from being accessed via JavaScript.","requirement":"optional","caption":"HTTP Only","type_name":"Boolean"},"is_secure":{"type":"boolean_t","description":"The cookie attribute indicates that cookies are sent to the server only when the request is encrypted using the HTTPS protocol.","requirement":"optional","caption":"Secure","type_name":"Boolean"},"samesite":{"type":"string_t","description":"The cookie attribute that lets servers specify whether/when cookies are sent with cross-site requests. Values are: Strict, Lax or None","requirement":"optional","caption":"SameSite","type_name":"String"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration time of the HTTP cookie.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"}},"name":"http_cookie","description":"The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:SessionCookie.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SessionCookie/"}],"profiles":["datetime"],"caption":"HTTP Cookie"},"malware":{"attributes":{"name":{"type":"string_t","description":"The malware name, as reported by the detection engine.","requirement":"recommended","caption":"Name","type_name":"String"},"path":{"type":"file_path_t","description":"The filesystem path of the malware that was observed.","requirement":"recommended","caption":"Path","type_name":"File Path","@deprecated":{"message":"Use file.path attribute available via files.","since":"1.5.0"}},"uid":{"type":"string_t","description":"A unique identifier for the specific malware instance, as assigned by the detection engine (e.g., virus signature ID or IPS rule ID).","requirement":"recommended","caption":"Unique ID","type_name":"String"},"files":{"type":"object_t","description":"The list of file objects representing files that were identified as infected by the malware.","is_array":true,"requirement":"optional","object_type":"file","caption":"Files","object_name":"File"},"severity":{"type":"string_t","description":"The severity of the malware, normalized to the captions of the severity_id values. In the case of 'Other', they are defined by the event source.","requirement":"optional","caption":"Severity","type_name":"String"},"classification_ids":{"type":"integer_t","enum":{"3":{"caption":"Bot"},"6":{"caption":"Downloader"},"0":{"description":"The classification is unknown.","caption":"Unknown"},"1":{"caption":"Adware"},"2":{"caption":"Backdoor"},"99":{"description":"The classification is not mapped. See the classifications attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Bootkit"},"5":{"caption":"DDOS"},"7":{"caption":"Dropper"},"8":{"caption":"Exploit-Kit"},"9":{"caption":"Keylogger"},"10":{"caption":"Ransomware"},"11":{"caption":"Remote-Access-Trojan"},"14":{"caption":"Rogue-Security-Software"},"15":{"caption":"Rootkit"},"16":{"caption":"Screen-Capture"},"17":{"caption":"Spyware"},"18":{"caption":"Trojan"},"20":{"caption":"Webshell"},"21":{"caption":"Wiper"},"22":{"caption":"Worm"},"13":{"caption":"Resource-Exploitation"},"19":{"caption":"Virus"}},"description":"The list of normalized identifiers of the malware classifications.","is_array":true,"references":[{"description":"STIX Malware Types","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl"}],"requirement":"required","caption":"Classification IDs","sibling":"classifications","type_name":"Integer"},"classifications":{"type":"string_t","description":"The list of malware classifications, normalized to the captions of the classification_ids values. In the case of 'Other', they are defined by the event source.","is_array":true,"requirement":"optional","caption":"Classifications","type_name":"String"},"cves":{"type":"object_t","description":"The list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the malware. Reference: CVE","is_array":true,"requirement":"optional","object_type":"cve","caption":"CVE List","object_name":"CVE"},"num_infected":{"type":"integer_t","description":"The number of files that were identified to be infected by the malware.","requirement":"optional","caption":"Number of Infected Entities","type_name":"Integer"},"provider":{"type":"string_t","description":"The name or identifier of the security solution or service that provided the malware detection information.","requirement":"recommended","caption":"Provider","type_name":"String"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"The normalized identifier of the malware severity.","requirement":"recommended","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"malware","description":"The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["data_classification"],"caption":"Malware"},"occurrence_details":{"attributes":{"end_line":{"type":"integer_t","description":"The line number of the last line of the file, where the information was discovered.","requirement":"optional","caption":"End Line","type_name":"Integer"},"cell_name":{"type":"string_t","description":"The cell name/reference in a spreadsheet. e.g A2","requirement":"optional","caption":"Cell Name","type_name":"String"},"column_name":{"type":"string_t","description":"The column name in a spreadsheet, where the information was discovered.","requirement":"optional","caption":"Column Name","type_name":"String"},"column_number":{"type":"integer_t","description":"The column number in a spreadsheet or a plain text document, where the information was discovered.","requirement":"optional","caption":"Column Number","type_name":"Integer"},"json_path":{"type":"string_t","description":"The JSON path of the attribute in a json record, where the information was discovered","requirement":"optional","caption":"JSON Path","type_name":"String"},"page_number":{"type":"integer_t","description":"The page number in a document, where the information was discovered.","requirement":"optional","caption":"Page Number","type_name":"Integer"},"record_index_in_array":{"type":"integer_t","description":"The index of the record in the array of records, where the information was discovered. e.g. the index of a record in an array of JSON records in a file.","requirement":"optional","caption":"Record Index in Array","type_name":"Integer"},"row_number":{"type":"integer_t","description":"The row number in a spreadsheet, where the information was discovered.","requirement":"optional","caption":"Row Number","type_name":"Integer"},"start_line":{"type":"integer_t","description":"The line number of the first line of the file, where the information was discovered.","requirement":"optional","caption":"Start Line","type_name":"Integer"}},"name":"occurrence_details","description":"Details about where in the target entity, specified information was discovered. Only the attributes, relevant to the target entity type should be populated.","extends":"object","constraints":{"at_least_one":["cell_name","column_name","column_number","end_line","json_path","page_number","record_index_in_array","row_number","start_line"]},"caption":"Occurrence Details"},"script":{"attributes":{"name":{"type":"string_t","description":"Unique identifier for the script or macro, independent of the containing file, used for tracking, auditing, and security analysis.","requirement":"optional","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The script type, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"file":{"type":"object_t","description":"Present if this script is associated with a file. Not present in the case of a file-less script.","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"uid":{"type":"string_t","description":"Some script engines assign a unique ID to each individual execution of a given script. This attribute captures that unique ID. In the case of PowerShell, the unique ID corresponds to the ScriptBlockId in the raw ETW events provided by the OS.","requirement":"optional","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Python"},"6":{"caption":"Unix Shell"},"0":{"description":"The script type is unknown.","caption":"Unknown"},"1":{"caption":"Windows Command Prompt"},"2":{"caption":"PowerShell"},"99":{"description":"The script type is not mapped. See the type attribute which contains an event source specific value.","caption":"Other"},"4":{"caption":"JavaScript"},"5":{"caption":"VBScript"},"7":{"caption":"VBA"}},"description":"The normalized script type ID.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"hashes":{"type":"object_t","description":"An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the script_content attribute.","is_array":true,"requirement":"recommended","object_type":"fingerprint","caption":"Hashes","object_name":"Fingerprint"},"parent_uid":{"type":"string_t","description":"This attribute relates a sub-script to a parent script having the matching uid attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS.","requirement":"optional","caption":"Parent Unique ID","type_name":"String"},"script_content":{"type":"object_t","description":"The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated.","requirement":"required","object_type":"long_string","caption":"Script Content","object_name":"Long String","observable":36}},"name":"script","description":"The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term script here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:ExecutableScript.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ExecutableScript/"}],"profiles":["data_classification"],"caption":"Script"},"privilege_info":{"attributes":{"name":{"type":"string_t","description":"The name of the privilege, action, or permission. Examples: GetObject, CreateStoreImageTask (AWS); Microsoft.Storage/storageAccounts/read (Azure); storage.objects.get (GCP).","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type or category of the privilege, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"is_unused":{"type":"boolean_t","description":"Indicates whether the privilege is unused within the analysis timeframe.","requirement":"optional","caption":"Is Unused","type_name":"Boolean"},"type_id":{"type":"integer_t","enum":{"3":{"description":"An execute-type privilege that permits running operations or invoking functions. Examples: lambda:InvokeFunction, Microsoft.Compute/virtualMachines/start/action.","caption":"Execute"},"0":{"description":"The privilege type is unknown.","caption":"Unknown"},"1":{"description":"A read-type privilege that permits viewing or retrieving data. Examples: s3:GetObject, Microsoft.Storage/storageAccounts/read, storage.objects.get.","caption":"Read"},"2":{"description":"A write-type privilege that permits creating, modifying, or deleting data. Examples: s3:PutObject, Microsoft.Storage/storageAccounts/write, storage.objects.create.","caption":"Write"},"99":{"description":"The privilege type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized type of the privilege.","requirement":"optional","caption":"Type ID","sibling":"type","type_name":"Integer"},"last_used_time":{"type":"timestamp_t","description":"The most recent time this privilege was used.","requirement":"optional","caption":"Last Used Time","type_name":"Timestamp"},"last_used_time_dt":{"type":"datetime_t","description":"The most recent time this privilege was used.","requirement":"optional","profiles":["datetime"],"caption":"Last Used Time","type_name":"Datetime"}},"name":"privilege_info","description":"The Privilege Info object describes information about a specific privilege, action, or permission. It captures the privilege name, type, usage status, and when it was last used.","extends":"object","profiles":["datetime"],"caption":"Privilege Info"},"http_response":{"attributes":{"code":{"type":"integer_t","description":"The Hypertext Transfer Protocol (HTTP) status code returned from the web server to the client. For example, 200.","requirement":"required","caption":"Response Code","type_name":"Integer"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","requirement":"optional","caption":"Message","type_name":"String"},"status":{"type":"string_t","description":"The response status. For example: A successful HTTP status of 'OK' which corresponds to a code of 200.","requirement":"optional","caption":"Status","type_name":"String"},"length":{"type":"integer_t","description":"The length of the entire HTTP response, in number of bytes.","requirement":"optional","caption":"Response Length","type_name":"Integer"},"content_type":{"type":"string_t","description":"The request header that identifies the original media type of the resource (prior to any content encoding applied for sending).","requirement":"optional","caption":"HTTP Content Type","type_name":"String"},"body_length":{"type":"integer_t","description":"The actual length of the HTTP response body, in number of bytes, independent of a potentially existing Content-Length header.","requirement":"optional","caption":"Response Body Length","type_name":"Integer"},"http_headers":{"type":"object_t","description":"Additional HTTP headers of an HTTP request or response.","is_array":true,"requirement":"recommended","object_type":"http_header","caption":"HTTP Headers","object_name":"HTTP Header"},"latency":{"type":"integer_t","description":"The HTTP response latency measured in milliseconds.","requirement":"optional","caption":"Latency","type_name":"Integer"}},"name":"http_response","description":"The HTTP Response object contains detailed information about the response sent from a web server to the requester. It encompasses attributes and metadata that describe the response status, headers, body content, and other relevant information.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:InboundInternetNetworkTraffic.","url":"https://d3fend.mitre.org/dao/artifact/d3f:InboundInternetNetworkTraffic/"}],"caption":"HTTP Response"},"data_security":{"attributes":{"size":{"type":"long_t","description":"Size of the data classified.","requirement":"optional","caption":"Size","type_name":"Long"},"status":{"type":"string_t","description":"The resultant status of the classification job normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","requirement":"recommended","caption":"Status","type_name":"String"},"total":{"type":"integer_t","description":"The total count of discovered entities, by the classification job.","requirement":"optional","caption":"Total","type_name":"Integer"},"uid":{"type":"string_t","description":"The unique identifier of the classification job.","requirement":"optional","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The name of the data classification category that data matched into, e.g. Financial, Personal, Governmental, etc.","requirement":"optional","caption":"Category","type_name":"String"},"pattern_match":{"type":"string_t","description":"A text, binary, file name, or datastore that matched against a detection rule.","requirement":"optional","caption":"Pattern Match","type_name":"String"},"category_id":{"type":"integer_t","enum":{"3":{"description":"Any financially-related sensitive information or Cardholder Data (CHD). E.g., banking account numbers, credit card numbers, International Banking Account Numbers (IBAN), SWIFT codes, etc.","caption":"Financial"},"6":{"description":"Any sensitive security-related data such as passwords, passkeys, IP addresses, API keys, credentials and similar secrets. E.g., AWS Access Secret Key, SaaS API Keys, user passwords, database credentials, etc.","caption":"Security"},"0":{"description":"The type is not mapped. See the data_type attribute, which contains a data source specific value.","caption":"Unknown"},"1":{"description":"Any Personally Identifiable Information (PII), Electronic Personal Health Information (ePHI), or similarly personal information. E.g., full name, home address, date of birth, etc.","caption":"Personal"},"2":{"description":"Any sensitive government identification number related to a person or other classified material. E.g., Passport numbers, driver license numbers, business identification, taxation identifiers, etc.","caption":"Governmental"},"99":{"description":"Any other type of data classification or a multi-variate classification made up of several other classification categories.","caption":"Other"},"4":{"description":"Any business-specific sensitive data such as intellectual property, trademarks, copyrights, human resource data, Board of Directors meeting minutes, and similar.","caption":"Business"},"5":{"description":"Any mission-specific sensitive data for military, law enforcement, or other government agencies such as specifically classified data, weapon systems information, or other planning data.","caption":"Military and Law Enforcement"}},"description":"The normalized identifier of the data classification category.","requirement":"recommended","caption":"Category ID","sibling":"category","type_name":"Integer"},"classifier_details":{"type":"object_t","description":"Describes details about the classifier used for data classification.","requirement":"recommended","object_type":"classifier_details","caption":"Classifier Details","object_name":"Classifier Details"},"confidentiality":{"type":"string_t","description":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Confidentiality","type_name":"String"},"confidentiality_id":{"type":"integer_t","enum":{"3":{"caption":"Secret"},"6":{"caption":"Restricted"},"0":{"description":"The confidentiality is unknown.","caption":"Unknown"},"1":{"caption":"Not Confidential"},"2":{"caption":"Confidential"},"99":{"description":"The confidentiality is not mapped. See the confidentiality attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Top Secret"},"5":{"caption":"Private"}},"description":"The normalized identifier of the file content confidentiality indicator.","requirement":"recommended","caption":"Confidentiality ID","sibling":"confidentiality","type_name":"Integer"},"data_lifecycle_state":{"type":"string_t","description":"The name of the stage or state that the data was in. E.g., Data-at-Rest, Data-in-Transit, etc.","requirement":"optional","caption":"Data Lifecycle State","type_name":"String"},"data_lifecycle_state_id":{"type":"integer_t","enum":{"3":{"description":"The data was being processed, accessed, or read by a system, making it active in memory or CPU. E.g., sensitive data in a Business Intelligence tool, ePHI being processed in an EHR application or a user viewing data stored in a spreadsheet or PDF.","caption":"Data in-Use"},"0":{"description":"The data lifecycle state is unknown.","caption":"Unknown"},"1":{"description":"The data was stored on physical or logical media and was not actively moving through the network nor was being processed. E.g., data stored in a database, PDF files in a file share, or EHR records in object storage.","caption":"Data at-Rest"},"2":{"description":"The data was actively moving through the network or from one physical or logical location to another. E.g., emails being send, data replication or Change Data Capture (CDC) streams, or sensitive data processed on an API.","caption":"Data in-Transit"},"99":{"description":"The data lifecycle state is not mapped. See the data_lifecycle_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The stage or state that the data was in when it was assessed or scanned by a data security tool.","requirement":"recommended","caption":"Data Lifecycle State ID","sibling":"data_lifecycle_state","type_name":"Integer"},"detection_pattern":{"type":"string_t","description":"Specific pattern, algorithm, fingerprint, or model used for detection.","requirement":"recommended","caption":"Detection Pattern","type_name":"String"},"detection_system":{"type":"string_t","description":"The name of the type of data security tool or system that the finding, detection, or alert originated from. E.g., Endpoint, Secure Email Gateway, etc.","requirement":"optional","caption":"Detection System","type_name":"String"},"detection_system_id":{"type":"integer_t","enum":{"3":{"description":"A Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) tool that can detect sensitive data and/or enforce data security policies on mobile devices (e.g., cellphones, tablets, End User Devices [EUDs]).","caption":"Mobile Device Management"},"6":{"description":"A Secure Email Gateway (SEG) is any tool that can detect sensitive data and/or enforce data security policies within email systems. E.g., Microsoft Defender for Office, Google Workspaces.","caption":"Secure Email Gateway"},"0":{"description":"The type is not mapped. See the detection_system attribute, which contains a data source specific value.","caption":"Unknown"},"1":{"description":"A dedicated agent or sensor installed on a device, either a dedicated data security tool or an Endpoint Detection & Response (EDR) tool that can detect sensitive data and/or enforce data security policies. E.g., Forcepoint DLP, Symantec DLP, Microsoft Defender for Endpoint (MDE).","caption":"Endpoint"},"2":{"description":"A Data Loss Prevention (DLP) gateway that is positioned in-line of an information store such as a network share, a database, or otherwise that can detect sensitive data and/or enforce data security policies.","caption":"DLP Gateway"},"99":{"description":"Any other type of detection system or a multi-variate system made up of several other systems.","caption":"Other"},"4":{"description":"A tool that actively identifies and classifies sensitive data in digital media and information stores in accordance with a policy or automated functionality. E.g, Amazon Macie, Microsoft Purview.","caption":"Data Discovery & Classification"},"5":{"description":"A Secure Web Gateway (SWG) is any tool that can detect sensitive data and/or enforce data security policies at a network-edge such as within a proxy or firewall service.","caption":"Secure Web Gateway"},"7":{"description":"A Digital Rights Management (DRM) or a dedicated Information Rights Management (IRM) are tools which can detect sensitive data and/or enforce data security policies on digital media via policy or user access rights.","caption":"Digital Rights Management"},"8":{"description":"A Cloud Access Security Broker (CASB) that can detect sensitive data and/or enforce data security policies in-line to cloud systems such as the public cloud or Software-as-a-Service (SaaS) tool. E.g., Forcepoint CASB, SkyHigh Security.","caption":"Cloud Access Security Broker"},"9":{"description":"A Database Activity Monitoring (DAM) tool that can detect sensitive data and/or enforce data security policies as part of a dedicated database or warehouse monitoring solution.","caption":"Database Activity Monitoring"},"10":{"description":"A built in Data Loss Prevention (DLP) or other data security capability within a tool or platform such as an Enterprise Resource Planning (ERP) or Customer Relations Management (CRM) tool that can detect sensitive data and/or enforce data security policies.","caption":"Application-Level DLP"},"11":{"description":"Any Developer Security tool such as an Infrastructure-as-Code (IAC) security scanner, Secrets Detection, or Secure Software Development Lifecycle (SSDLC) tool that can detect sensitive data and/or enforce data security policies. E.g., TruffleHog, GitGuardian, Git-Secrets.","caption":"Developer Security"},"12":{"description":"A Data Security Posture Management (DSPM) tool is a continuous monitoring and data discovery solution that can detect sensitive data and/or enforce data security policies for local and cloud environments. E.g., Cyera, Sentra, IBM Polar Security.","caption":"Data Security Posture Management"}},"description":"The type of data security tool or system that the finding, detection, or alert originated from.","requirement":"recommended","caption":"Detection System ID","sibling":"detection_system","type_name":"Integer"},"discovery_details":{"type":"object_t","description":"Details about the data discovered by classification job.","is_array":true,"requirement":"optional","object_type":"discovery_details","caption":"Discovery Details","object_name":"Discovery Details"},"policy":{"type":"object_t","description":"Details about the policy that triggered the finding.","requirement":"recommended","object_type":"policy","caption":"Policy","object_name":"Policy"},"src_url":{"type":"url_t","description":"The source URL pointing towards the full classification job details.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"status_details":{"type":"string_t","description":"The contextual description of the status, status_id value.","is_array":true,"requirement":"optional","caption":"Status Details","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The classification job failed for the evaluated resource.","caption":"Fail"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The classification job completed for the evaluated resource.","caption":"Complete"},"2":{"description":"The classification job partially completed for the evaluated resource.","caption":"Partial"},"99":{"description":"The classification job type id is not mapped.","caption":"Other"}},"description":"The normalized status identifier of the classification job.","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"}},"name":"data_security","description":"The Data Security object describes the characteristics, techniques and content of a Data Loss Prevention (DLP), Data Loss Detection (DLD), Data Classification, or similar tools' finding, alert, or detection mechanism(s).","extends":"data_classification","constraints":{"at_least_one":["data_lifecycle_state_id","detection_pattern","detection_system_id","policy"]},"caption":"Data Security"},"timespan":{"attributes":{"type":{"type":"string_t","description":"The type of time span duration the object represents.","requirement":"optional","caption":"Time Span Type","type_name":"String"},"start_time":{"type":"timestamp_t","description":"The start time or beginning of the timespan's interval.","requirement":"recommended","caption":"Start Time","type_name":"Timestamp"},"duration":{"type":"long_t","description":"The duration of the time span in milliseconds.","requirement":"recommended","caption":"Duration Milliseconds","type_name":"Long"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Minutes"},"6":{"caption":"Weeks"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Milliseconds"},"2":{"caption":"Seconds"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Hours"},"5":{"caption":"Days"},"7":{"caption":"Months"},"8":{"caption":"Years"},"9":{"description":"The start_time and end_time should be set.","caption":"Time Interval"}},"description":"The normalized identifier for the time span duration type.","requirement":"recommended","caption":"Time Span Type ID","sibling":"type","type_name":"Integer"},"end_time":{"type":"timestamp_t","description":"The end time or conclusion of the timespan's interval.","requirement":"recommended","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The start time or beginning of the timespan's interval.","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The end time or conclusion of the timespan's interval.","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"duration_days":{"type":"integer_t","description":"The duration of the time span in days.","requirement":"recommended","caption":"Duration Days","type_name":"Integer"},"duration_hours":{"type":"integer_t","description":"The duration of the time span in hours.","requirement":"recommended","caption":"Duration Hours","type_name":"Integer"},"duration_mins":{"type":"integer_t","description":"The duration of the time span in minutes.","requirement":"recommended","caption":"Duration Minutes","type_name":"Integer"},"duration_months":{"type":"integer_t","description":"The duration of the time span in months.","requirement":"recommended","caption":"Duration Months","type_name":"Integer"},"duration_secs":{"type":"integer_t","description":"The duration of the time span in seconds.","requirement":"recommended","caption":"Duration Seconds","type_name":"Integer"},"duration_weeks":{"type":"integer_t","description":"The duration of the time span in weeks.","requirement":"recommended","caption":"Duration Weeks","type_name":"Integer"},"duration_years":{"type":"integer_t","description":"The duration of the time span in years.","requirement":"recommended","caption":"Duration Years","type_name":"Integer"}},"name":"timespan","description":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case type_id if present should be set to Other.

A timespan may also be defined by its time interval boundaries, start_time and end_time.","extends":"object","constraints":{"at_least_one":["duration","duration_days","duration_hours","duration_mins","duration_months","duration_secs","duration_weeks","duration_years","end_time","start_time"]},"profiles":["datetime"],"caption":"Time Span"},"user":{"attributes":{"name":{"type":"username_t","description":"The username. For example, janedoe1.","requirement":"recommended","caption":"Name","type_name":"User Name"},"type":{"type":"string_t","description":"The type of the user. For example, System, AWS IAM User, etc.","requirement":"optional","caption":"Type","type_name":"String"},"domain":{"type":"string_t","description":"The domain where the user is defined. For example: the LDAP or Active Directory domain.","requirement":"optional","caption":"Domain","type_name":"String"},"uid":{"type":"string_t","description":"The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":31},"groups":{"type":"object_t","description":"The administrative groups to which the user belongs.","is_array":true,"requirement":"optional","object_type":"group","caption":"Groups","object_name":"Group"},"org":{"type":"object_t","description":"Organization and org unit related to the user.","requirement":"optional","object_type":"organization","caption":"Organization","object_name":"Organization"},"full_name":{"type":"string_t","description":"The full name of the user, as reported by the product.","requirement":"optional","caption":"Full Name","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"System account. For example, Windows computer accounts with a trailing dollar sign ($).","caption":"System"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"Regular user account.","caption":"User"},"2":{"description":"Admin/root user account.","caption":"Admin"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Service account. For example, Windows service account.","caption":"Service"}},"description":"The account type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"account":{"type":"object_t","description":"The user's account or the account associated with the user.","requirement":"optional","object_type":"account","caption":"Account","object_name":"Account"},"credential_uid":{"type":"string_t","description":"The unique identifier of the user's credential. For example, AWS Access Key ID.","requirement":"optional","caption":"User Credential ID","type_name":"String","@deprecated":{"message":"Use programmatic_credentials instead.","since":"1.6.0"},"observable":19},"display_name":{"type":"string_t","description":"The display name of the user, as reported by the product.","requirement":"optional","caption":"Display Name","type_name":"String"},"email_addr":{"type":"email_t","description":"The user's primary email address.","requirement":"optional","caption":"Email Address","type_name":"Email Address"},"forward_addr":{"type":"email_t","description":"The user's forwarding email address.","requirement":"optional","caption":"Forwarding Address","type_name":"Email Address"},"has_mfa":{"type":"boolean_t","description":"The user has a multi-factor or secondary-factor device assigned.","requirement":"recommended","caption":"MFA Assigned","type_name":"Boolean"},"ldap_person":{"type":"object_t","description":"The additional LDAP attributes that describe a person.","requirement":"optional","object_type":"ldap_person","caption":"LDAP Person","object_name":"LDAP Person"},"phone_number":{"type":"string_t","description":"The telephone number of the user.","requirement":"optional","caption":"Telephone Number","type_name":"String"},"programmatic_credentials":{"type":"object_t","description":"Details about the programmatic credential (API keys, access tokens, certificates, etc) associated to the user.","is_array":true,"requirement":"optional","object_type":"programmatic_credential","caption":"Programmatic Credentials","object_name":"Programmatic Credential"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","requirement":"optional","caption":"Risk Level","type_name":"String"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","requirement":"optional","caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","requirement":"optional","caption":"Risk Score","type_name":"Integer"},"uid_alt":{"type":"string_t","description":"The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID.","requirement":"optional","caption":"Alternate ID","type_name":"String"}},"name":"user","description":"The User object describes the characteristics of a user/person or a security principal.","extends":"_entity","constraints":{"at_least_one":["account","name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:UserAccount","url":"https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/"}],"caption":"User","observable":21},"baseline":{"attributes":{"observation_parameter":{"type":"string_t","description":"The specific parameter or property being monitored. Examples include: CPU usage percentage, API response time in milliseconds, HTTP error rate, memory utilization, network latency, transaction volume, etc.","requirement":"required","caption":"Observation Parameter","type_name":"String"},"observation_type":{"type":"string_t","description":"The type of analysis being performed to establish baseline behavior. Common types include: Frequency Analysis, Time Pattern Analysis, Volume Analysis, Sequence Analysis, Distribution Analysis, etc.","requirement":"recommended","caption":"Observation Type","type_name":"String"},"observations":{"type":"object_t","description":"Collection of actual measured values, data points and observations recorded for this baseline.","is_array":true,"requirement":"required","object_type":"observation","caption":"Observations","object_name":"Observation"},"observed_pattern":{"type":"string_t","description":"The specific pattern identified within the observation type. For Frequency Analysis, this could be 'FREQUENT', 'INFREQUENT', 'RARE', or 'UNSEEN'. For Time Pattern Analysis, this could be 'BUSINESS_HOURS', 'OFF_HOURS', or 'UNUSUAL_TIME'. For Volume Analysis, this could be 'NORMAL_VOLUME', 'HIGH_VOLUME', or 'SURGE'. The pattern values are specific to each observation type and indicate the baseline behavior.","requirement":"recommended","caption":"Observed Pattern","type_name":"String"}},"name":"baseline","description":"Describes the baseline or expected behavior of a system, service, or component based on historical observations and measurements. It establishes reference points for comparison to detect anomalies, trends, and deviations from typical patterns.","extends":"object","caption":"Baseline"},"sso":{"attributes":{"name":{"type":"string_t","description":"The name of the SSO resource.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"A unique identifier for a SSO resource.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"protocol_name":{"type":"string_t","description":"The supported protocol for the SSO resource. E.g., SAML or OIDC.","requirement":"optional","caption":"Supported Protocol","type_name":"String"},"certificate":{"type":"object_t","description":"Digital Signature associated with the SSO resource, e.g., SAML X.509 certificate details.","requirement":"recommended","object_type":"certificate","caption":"SAML Certificate","object_name":"Digital Certificate"},"idle_timeout":{"type":"integer_t","description":"Duration (in minutes) of allowed inactivity before Single Sign-On (SSO) session expiration.","requirement":"optional","caption":"SSO Idle Timeout","type_name":"Integer"},"auth_protocol":{"type":"string_t","description":"The authorization protocol as defined by the caption of auth_protocol_id. In the case of Other, it is defined by the event source.","requirement":"optional","caption":"Auth Protocol","type_name":"String"},"auth_protocol_id":{"type":"integer_t","enum":{"3":{"caption":"Digest"},"6":{"caption":"OAUTH 2.0"},"0":{"description":"The authentication protocol is unknown.","caption":"Unknown"},"1":{"caption":"NTLM"},"2":{"caption":"Kerberos"},"99":{"description":"The authentication protocol is not mapped. See the auth_protocol attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"OpenID"},"5":{"caption":"SAML"},"7":{"caption":"PAP"},"8":{"caption":"CHAP"},"9":{"caption":"EAP"},"10":{"caption":"RADIUS"},"11":{"caption":"Basic Authentication"},"12":{"caption":"LDAP"}},"description":"The normalized identifier of the authentication protocol used by the SSO resource.","requirement":"optional","caption":"Auth Protocol ID","sibling":"auth_protocol","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"When the SSO resource was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"duration_mins":{"type":"integer_t","description":"The duration (in minutes) for an SSO session, after which re-authentication is required.","requirement":"optional","caption":"SSO Session Duration","type_name":"Integer"},"login_endpoint":{"type":"url_t","description":"URL for initiating an SSO login request.","requirement":"optional","caption":"SSO Login Endpoint","type_name":"URL String"},"logout_endpoint":{"type":"url_t","description":"URL for initiating an SSO logout request, allowing sessions to be terminated across applications.","requirement":"optional","caption":"SSO Logout Endpoint","type_name":"URL String"},"metadata_endpoint":{"type":"url_t","description":"URL where metadata about the SSO configuration is available (e.g., for SAML configurations).","requirement":"optional","caption":"SSO Metadata Endpoint","type_name":"URL String"},"modified_time":{"type":"timestamp_t","description":"The most recent time when the SSO resource was updated.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"scopes":{"type":"string_t","description":"Scopes define the specific permissions or actions that the client is allowed to perform on behalf of the user. Each scope represents a different set of permissions, and the user can selectively grant or deny access to specific scopes during the authorization process.","is_array":true,"requirement":"optional","caption":"Scopes","type_name":"String"},"vendor_name":{"type":"string_t","description":"Name of the vendor or service provider implementing SSO. E.g., Okta, Auth0, Microsoft.","requirement":"optional","caption":"Service Provider","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"When the SSO resource was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The most recent time when the SSO resource was updated.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"sso","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","extends":"object","profiles":["datetime"],"caption":"SSO"},"cloud":{"attributes":{"org":{"type":"object_t","description":"The Organization object containing details about the organizational unit or management structure that governs the account, subscription, or project where the event or finding was created. This object includes properties such as the organization name, unique identifier, type, and other organizational metadata.

Examples:

","requirement":"optional","object_type":"organization","caption":"Organization","object_name":"Organization"},"account":{"type":"object_t","description":"The Account object containing details about the cloud account, subscription, or billing unit where the event or finding was created. This object includes properties such as the account name, unique identifier, type, labels, and tags.

Examples:","requirement":"optional","object_type":"account","caption":"Account","object_name":"Account"},"cloud_partition":{"type":"string_t","description":"The logical grouping or isolated segment within a cloud provider's infrastructure where the event or finding was created, often used for compliance, governance, or regional separation.

Examples:","requirement":"optional","caption":"Cloud Partition","type_name":"String"},"project_uid":{"type":"string_t","description":"The unique identifier of a Cloud project.","requirement":"optional","caption":"Project ID","type_name":"String","@deprecated":{"message":"Use the account.uid attribute instead.","since":"1.4.0"}},"provider":{"type":"string_t","description":"The unique name of the Cloud services provider where the event or finding was created. Examples include AWS, Azure, GCP (Google Cloud Platform), Oracle Cloud, IBM Cloud, Alibaba Cloud, or other public, private, or hybrid cloud providers.","requirement":"required","caption":"Cloud Provider","type_name":"String"},"region":{"type":"string_t","description":"The cloud region where the event or finding was created, as defined by the cloud provider.

Examples:","requirement":"recommended","caption":"Region","type_name":"String"},"zone":{"type":"string_t","description":"The availability zone in the cloud region where the event or finding was created, as defined by the cloud provider.

Examples:","requirement":"optional","caption":"Cloud Availability Zone","type_name":"String"}},"name":"cloud","description":"The Cloud object describes the cloud computing environment where an event or finding originated. It provides comprehensive context about the cloud infrastructure, including the cloud service provider, account or subscription details, organizational structure, geographic regions, availability zones, and logical partitions.","extends":"object","caption":"Cloud"},"message_context":{"attributes":{"name":{"type":"string_t","description":"The name or identifier of the message context. In AI systems, this could be the conversation ID, session name, thread identifier, or interaction name (e.g., 'user-session-123', 'conversation-abc', 'chat-thread-456').","requirement":"recommended","caption":"Name","type_name":"String"},"service":{"type":"object_t","description":"The server or service handling the request. In AI systems, this represents the AI service, API endpoint, or agent that processes and responds to requests (e.g., OpenAI API service, Claude API service, internal AI model service).","requirement":"recommended","object_type":"service","caption":"Service","object_name":"Service"},"application":{"type":"object_t","description":"The initiating client application. In AI systems, this represents the client-side application or framework that initiates requests (e.g., LangChain application, web browser, mobile app, SDK implementation).","requirement":"recommended","object_type":"application","caption":"Application","object_name":"Application"},"uid":{"type":"string_t","description":"The unique identifier of the message context. This could be a session ID, conversation ID, or other unique identifier that allows correlation of messages within the same context.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"ai_role":{"type":"string_t","description":"The normalized caption of the ai_role_id.","requirement":"optional","caption":"AI Role","type_name":"String"},"ai_role_id":{"type":"integer_t","enum":{"3":{"description":"A callable tool or API invoked by the assistant.","caption":"Tool"},"6":{"description":"A component that retrieves information or context from a knowledge source (e.g., vector DB, search system, or API).","caption":"Retriever"},"0":{"description":"Unknown role type.","caption":"Unknown"},"1":{"description":"The human user initiating a request.","caption":"User"},"2":{"description":"The AI model generating a response.","caption":"Assistant"},"99":{"description":"Other role type not covered above.","caption":"Other"},"4":{"description":"A software agent that performs tasks with autonomy or delegated intent.","caption":"Agent"},"5":{"description":"The component coordinating multiple agents or tools.","caption":"Orchestrator"}},"description":"Specifies the functional role of the AI within the context of this message, such as retrieving information, assisting reasoning, executing a tool, or generating content.","requirement":"recommended","caption":"AI Role ID","sibling":"ai_role","type_name":"Integer"},"completion_tokens":{"type":"integer_t","description":"Number of tokens in the model's response/completion for this message.","requirement":"optional","caption":"Completion Tokens","type_name":"Integer"},"prompt_tokens":{"type":"integer_t","description":"Number of tokens in the input prompt for this message.","requirement":"optional","caption":"Prompt Tokens","type_name":"Integer"},"total_tokens":{"type":"integer_t","description":"Total number of tokens used for this message (prompt + completion).","requirement":"optional","caption":"Total Tokens","type_name":"Integer"}},"name":"message_context","description":"Communication context for AI system interactions including protocols, roles, clients, and session information for MCP and other AI communication systems.","extends":"_entity","constraints":{"at_least_one":["application","service"]},"references":[{"description":"OWASP AI Security and Privacy Guide - Agent Security","url":"https://owasp.org/www-project-ai-security-and-privacy-guide/"},{"description":"Model Context Protocol (MCP) Specification","url":"https://modelcontextprotocol.io/"}],"profiles":["data_classification"],"caption":"Message Context"},"port_info":{"attributes":{"port":{"type":"port_t","description":"The port number. For example: 80, 443, 22.","requirement":"required","caption":"Port","type_name":"Port"},"protocol_name":{"type":"string_t","description":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: tcp or udp.","references":[{"description":"IANA Protocol Numbers","url":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}],"requirement":"recommended","caption":"Protocol Name","type_name":"String"},"protocol_num":{"type":"integer_t","description":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: 6 for TCP and 17 for UDP.","references":[{"description":"IANA Protocol Numbers","url":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}],"requirement":"optional","caption":"Protocol Number","type_name":"Integer"}},"name":"port_info","description":"The Port Information object describes a port and its associated protocol details.","extends":"object","caption":"Port Information"},"container":{"attributes":{"name":{"type":"string_t","description":"The container name.","requirement":"recommended","caption":"Name","type_name":"String"},"runtime":{"type":"string_t","description":"The backend running the container, such as containerd or cri-o.","requirement":"optional","caption":"Runtime","type_name":"String"},"size":{"type":"long_t","description":"The size of the container image.","requirement":"recommended","caption":"Size","type_name":"Long"},"tag":{"type":"string_t","description":"The tag used by the container. It can indicate version, format, OS.","requirement":"optional","caption":"Image Tag","type_name":"String","@deprecated":{"message":"Use the labels or tags attribute instead.","since":"1.4.0"}},"uid":{"type":"string_t","description":"The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"image":{"type":"object_t","description":"The container image used as a template to run the container.","requirement":"recommended","object_type":"image","caption":"Image","object_name":"Image"},"hash":{"type":"object_t","description":"Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de.","requirement":"recommended","object_type":"fingerprint","caption":"Hash","object_name":"Fingerprint"},"labels":{"type":"string_t","description":"The list of labels associated to the container.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the container.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"network_driver":{"type":"string_t","description":"The network driver used by the container. For example, bridge, overlay, host, none, etc.","requirement":"optional","caption":"Network Driver","type_name":"String"},"orchestrator":{"type":"string_t","description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift.","requirement":"optional","caption":"Orchestrator","type_name":"String"},"pod_uuid":{"type":"uuid_t","description":"The unique identifier of the pod (or equivalent) that the container is executing on.","requirement":"optional","caption":"Pod UUID","type_name":"UUID"}},"name":"container","description":"The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","extends":"object","constraints":{"at_least_one":["uid","name"]},"references":[{"description":"D3FEND™ Ontology d3f:ContainerProcess.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ContainerProcess/"}],"caption":"Container","observable":27},"mitigation":{"attributes":{"name":{"type":"string_t","description":"The Mitigation name that is associated with the attack technique. For example: Password Policies, or Code Signing.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The Mitigation ID that is associated with the attack technique. For example: M1027, or AML.M0013.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"countermeasures":{"type":"object_t","description":"The D3FEND countermeasures that are associated with the attack technique. For example: ATT&CK Technique T1003 is addressed by Mitigation M1027, and D3FEND Technique D3-OTP.","is_array":true,"requirement":"optional","object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"src_url":{"type":"url_t","description":"The versioned permalink of the Mitigation. For example: https://attack.mitre.org/versions/v14/mitigations/M1027.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"mitigation","description":"The MITRE Mitigation object describes the ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"},{"description":"ATT&CK® Mitigation to D3FEND™ Technique Mappings","url":"https://d3fend.mitre.org/mappings/attack-mitigations/"}],"caption":"MITRE Mitigation"},"http_header":{"attributes":{"name":{"type":"string_t","description":"The name of the HTTP header.","requirement":"required","caption":"Name","type_name":"String"},"value":{"type":"string_t","description":"The value of the HTTP header.","requirement":"required","caption":"Value","type_name":"String"}},"name":"http_header","description":"The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.","extends":"object","caption":"HTTP Header"},"idp":{"attributes":{"name":{"type":"string_t","description":"The name of the Identity Provider.","requirement":"recommended","caption":"Name","type_name":"String"},"state":{"type":"string_t","description":"The configuration state of the Identity Provider, normalized to the caption of the state_id value. In the case of Other, it is defined by the event source.","requirement":"optional","caption":"State","type_name":"String"},"domain":{"type":"string_t","description":"The primary domain associated with the Identity Provider.","requirement":"optional","caption":"Domain","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the Identity Provider.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"protocol_name":{"type":"string_t","description":"The supported protocol of the Identity Provider. E.g., SAML, OIDC, or OAuth2.","requirement":"optional","caption":"Supported Protocol","type_name":"String"},"issuer":{"type":"string_t","description":"The unique identifier (often a URL) used by the Identity Provider as its issuer.","requirement":"optional","caption":"Issuer Details","type_name":"String"},"fingerprint":{"type":"object_t","description":"The fingerprint of the X.509 certificate used by the Identity Provider.","requirement":"optional","object_type":"fingerprint","caption":"Certificate Fingerprint","object_name":"Fingerprint"},"auth_factors":{"type":"object_t","description":"The Authentication Factors object describes the different types of Multi-Factor Authentication (MFA) methods and/or devices supported by the Identity Provider.","is_array":true,"requirement":"optional","object_type":"auth_factor","caption":"Authentication Factors","object_name":"Authentication Factor"},"has_mfa":{"type":"boolean_t","description":"The Identity Provider enforces Multi Factor Authentication (MFA).","requirement":"optional","caption":"MFA Enforced","type_name":"Boolean"},"scim":{"type":"object_t","description":"The System for Cross-domain Identity Management (SCIM) resource object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in RFC-7634","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"requirement":"optional","object_type":"scim","caption":"SCIM","object_name":"SCIM"},"sso":{"type":"object_t","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","requirement":"optional","object_type":"sso","caption":"SSO","object_name":"SSO"},"state_id":{"type":"integer_t","enum":{"3":{"description":"The Identity Provider is in a Deprecated state, or is otherwise disabled.","caption":"Deprecated"},"0":{"description":"The configuration state of the Identity Provider is unknown.","caption":"Unknown"},"1":{"description":"The Identity Provider is in an Active state, or otherwise enabled.","caption":"Active"},"2":{"description":"The Identity Provider is in a Suspended state.","caption":"Suspended"},"99":{"description":"The configuration state of the Identity Provider is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Identity Provider is in a Deleted state.","caption":"Deleted"}},"description":"The normalized state ID of the Identity Provider to reflect its configuration or activation status.","requirement":"optional","caption":"State ID","sibling":"state","type_name":"Integer"},"tenant_uid":{"type":"string_t","description":"The tenant ID associated with the Identity Provider.","requirement":"optional","caption":"Tenant UID","type_name":"String"},"url_string":{"type":"url_t","description":"The URL for accessing the configuration or metadata of the Identity Provider.","requirement":"optional","caption":"Configuration URL","type_name":"URL String"}},"name":"idp","description":"The Identity Provider object contains detailed information about a provider responsible for creating, maintaining, and managing identity information while offering authentication services to applications. An Identity Provider (IdP) serves as a trusted authority that verifies the identity of users and issues authentication tokens or assertions to enable secure access to applications or services.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["container"],"caption":"Identity Provider"},"sbom":{"attributes":{"type":{"type":"string_t","description":"The type of SBOM, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The specification (spec) version of the particular SBOM, e.g., 1.6.","requirement":"optional","caption":"Version","type_name":"String"},"product":{"type":"object_t","description":"Details about the upstream product that generated the SBOM e.g. cdxgen or Syft.","requirement":"recommended","object_type":"product","caption":"Product","object_name":"Product"},"uid":{"type":"string_t","description":"A unique identifier for the SBOM or the SBOM generation by a source tool, such as the SPDX metadata.component.bom-ref.","requirement":"optional","caption":"SBOM ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) publishes, ISO/IEC 19770-2, a standard for software identification (SWID) tags that defines a structured metadata format for describing a software product. A SWID tag document is composed of a structured set of data elements that identify the software product","caption":"SWID"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"System Package Data Exchange (SPDX®) is an open standard capable of representing systems with software components in as SBOMs (Software Bill of Materials) and other AI, data and security references supporting a range of risk management use cases. The SPDX specification is a freely available international open standard (ISO/IEC 5692:2021).","caption":"SPDX"},"2":{"description":"CycloneDX is an International Standard for Bill of Materials (ECMA-424).","caption":"CycloneDX"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The type of SBOM.","references":[{"description":"SPDX","url":"https://spdx.dev/"},{"description":"ISO/IEC 5692:2021","url":"https://www.iso.org/standard/81870.html"},{"description":"CycloneDX","url":"https://cyclonedx.org/"},{"description":"ECMA-424","url":"https://ecma-international.org/publications-and-standards/standards/ecma-424/"},{"description":"SWID","url":"https://nvd.nist.gov/products/swid"},{"description":"ISO/IEC 19770-2:2015","url":"https://www.iso.org/standard/65666.html"}],"requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time when the SBOM was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"package":{"type":"object_t","description":"The software package or library that is being discovered or inventoried by an SBOM.","references":[{"description":"D3FEND™ Ontology d3f:SoftwarePackage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}],"requirement":"required","object_type":"package","caption":"Software Package","object_name":"Software Package"},"software_components":{"type":"object_t","description":"The list of software components used in the software package.","is_array":true,"requirement":"required","object_type":"software_component","caption":"Software Components","object_name":"Software Component"},"created_time_dt":{"type":"datetime_t","description":"The time when the SBOM was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"sbom","description":"The Software Bill of Materials object describes characteristics of a generated SBOM.","extends":"object","profiles":["data_classification","datetime"],"caption":"Software Bill of Materials"},"kernel":{"attributes":{"name":{"type":"string_t","description":"The name of the kernel resource.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the kernel resource.","requirement":"optional","caption":"Type","type_name":"String"},"path":{"type":"file_path_t","description":"The full path of the kernel resource.","requirement":"optional","caption":"Path","type_name":"File Path"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Shared Mutex"},"2":{"caption":"System Call"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The type of the kernel resource.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"is_system":{"type":"boolean_t","description":"The indication of whether the object is part of the operating system.","requirement":"optional","caption":"System","type_name":"Boolean"},"system_call":{"type":"string_t","description":"The system call that was invoked.","requirement":"optional","caption":"System Call","type_name":"String"}},"name":"kernel","description":"The Kernel Resource object provides information about a specific kernel resource, including its name and type. It describes essential attributes associated with a resource managed by the kernel of an operating system.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:Kernel","url":"https://d3fend.mitre.org/dao/artifact/d3f:Kernel/"}],"caption":"Kernel Resource"},"network_traffic":{"attributes":{"bytes_in":{"type":"long_t","description":"The number of bytes sent from the destination to the source (inbound direction).","requirement":"optional","caption":"Bytes In","type_name":"Long"},"bytes_out":{"type":"long_t","description":"The number of bytes sent from the source to the destination (outbound direction).","requirement":"optional","caption":"Bytes Out","type_name":"Long"},"chunks":{"type":"long_t","description":"The total number of chunks transferred in both directions (sum of chunks_in and chunks_out).","requirement":"optional","caption":"Chunks","type_name":"Long"},"bytes":{"type":"long_t","description":"The total number of bytes transferred in both directions (sum of bytes_in and bytes_out).","requirement":"recommended","caption":"Total Bytes","type_name":"Long"},"start_time":{"type":"timestamp_t","description":"The start time of the observation or reporting period.","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"end_time":{"type":"timestamp_t","description":"The end time of the observation or reporting period.","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The start time of the observation or reporting period.","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The end time of the observation or reporting period.","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"bytes_missed":{"type":"long_t","description":"The number of bytes that were missed during observation, typically due to packet loss or sampling limitations.","requirement":"optional","caption":"Bytes Missed","type_name":"Long"},"chunks_in":{"type":"long_t","description":"The number of chunks sent from the destination to the source (inbound direction).","requirement":"optional","caption":"Chunks In","type_name":"Long"},"chunks_out":{"type":"long_t","description":"The number of chunks sent from the source to the destination (outbound direction).","requirement":"optional","caption":"Chunks Out","type_name":"Long"},"packets":{"type":"long_t","description":"The total number of packets transferred in both directions (sum of packets_in and packets_out).","requirement":"recommended","caption":"Total Packets","type_name":"Long"},"packets_in":{"type":"long_t","description":"The number of packets sent from the destination to the source (inbound direction).","requirement":"optional","caption":"Packets In","type_name":"Long"},"packets_out":{"type":"long_t","description":"The number of packets sent from the source to the destination (outbound direction).","requirement":"optional","caption":"Packets Out","type_name":"Long"},"timespan":{"type":"object_t","description":"The time span object representing the duration of the observation or reporting period.","requirement":"optional","object_type":"timespan","caption":"Time Span","object_name":"Time Span"}},"name":"network_traffic","description":"The Network Traffic object describes characteristics of network traffic over a time period. The metrics represent network data transferred between source and destination during an observation window.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:NetworkTraffic","url":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkTraffic/"}],"profiles":["datetime"],"caption":"Network Traffic"},"packet":{"attributes":{"value":{"type":"string_t","description":"The actual packet data, represented as a string. The format of this string is determined by the specified encoding_id (e.g., Base64, Hexadecimal, or URL Encoded).","requirement":"required","caption":"Value","type_name":"String"},"format":{"type":"string_t","description":"The human-readable name of the packet capture file format in which the packet is stored. This should match the caption associated with format_id. If format_id is 99 (Other), this field contains the original data source–specific format value.","requirement":"optional","caption":"Format","type_name":"String"},"encoding":{"type":"string_t","description":"The human-readable name of the encoding used to represent the packet data in the value field. This should match the caption associated with encoding_id. If encoding_id is 99 (Other), this field contains the original data source–specific encoding value.","requirement":"optional","caption":"Encoding","type_name":"String"},"source":{"type":"string_t","description":"The human-readable name describing how or where the packet was obtained. This should match the caption associated with source_id. If source_id is 99 (Other), this field contains the original data source–specific value.","requirement":"optional","caption":"Source","type_name":"String"},"sequence_number":{"type":"long_t","description":"The relative order number of this packet within its capture context (such as a PCAP file, network session, or reconstructed stream). This represents chronological capture order, distinct from both protocol-level sequencing (such as TCP sequence numbers).","requirement":"optional","caption":"Sequence Number","type_name":"Long"},"encoding_id":{"type":"integer_t","enum":{"3":{"description":"The packet data is encoded using percent-encoding (URL encoding).","caption":"URL Encoded"},"0":{"description":"The encoding format of the packet data is not known.","caption":"Unknown"},"1":{"description":"The packet data is encoded using Base64.","caption":"Base64"},"2":{"description":"The packet data is encoded as a hexadecimal string representation of the raw bytes.","caption":"Hexadecimal"},"99":{"description":"The encoding method is not mapped. Refer to the encoding field for the original source-specific value.","caption":"Other"}},"description":"The normalized identifier of the encoding method used to represent the packet data as a string.","requirement":"recommended","caption":"Encoding ID","sibling":"encoding","type_name":"Integer"},"end_offset":{"type":"long_t","description":"The ending byte position of this packet within a capture file or stream.","requirement":"optional","caption":"End Offset","type_name":"Long"},"format_id":{"type":"integer_t","enum":{"3":{"description":"Solaris/Unix capture format.","caption":"Snoop"},"6":{"description":"Accellent 5Views packet capture format.","caption":"5Views"},"0":{"description":"The packet format is unknown.","caption":"Unknown"},"1":{"description":"Standard libpcap/tcpdump packet capture file format.","caption":"PCAP"},"2":{"description":"Next-generation PCAP format that supports multiple interfaces and enhanced metadata.","caption":"PCAPNG"},"99":{"description":"The packet format is not mapped. Refer to the format field for the original source-specific value.","caption":"Other"},"4":{"description":"Extensible Record Format used by Endace network monitoring hardware.","caption":"ERF"},"5":{"description":"Microsoft Network Monitor capture file format.","caption":"NetMon"}},"description":"The normalized identifier of the packet capture format.","requirement":"recommended","caption":"Format ID","sibling":"format","type_name":"Integer"},"source_id":{"type":"integer_t","enum":{"3":{"description":"The packet was generated or extracted by a protocol decoder or analysis engine.","caption":"Decoder"},"6":{"description":"The packet was captured by a host-based agent or endpoint detection and response (EDR) sensor.","caption":"Endpoint"},"0":{"description":"The packet source is unknown.","caption":"Unknown"},"1":{"description":"The packet was captured directly from a network interface.","caption":"Wire"},"2":{"description":"The packet was reconstructed or derived from a stream of packets.","caption":"Stream"},"99":{"description":"The packet source is not mapped. Refer to the source field for the original source-specific value.","caption":"Other"},"4":{"description":"The packet was captured from a physical network Test Access Point (TAP) device used for passive monitoring.","caption":"TAP"},"5":{"description":"The packet was captured from a switch Switched Port Analyzer (SPAN) or mirror port.","caption":"SPAN"},"7":{"description":"The packet was captured from a virtual network interface, virtual switch, or container network.","caption":"Virtual"}},"description":"A normalized numeric identifier that specifies how the packet was obtained or generated.","requirement":"recommended","caption":"Source ID","sibling":"source","type_name":"Integer"},"start_offset":{"type":"long_t","description":"The starting byte position of this packet within a capture file or stream.","requirement":"optional","caption":"Start Offset","type_name":"Long"}},"name":"packet","description":"The Packet object represents a single captured network packet and its associated metadata. It describes where the packet came from, how it is stored or encoded, and how it can be located within a capture file or stream. This object does not interpret protocol content; it only represents the captured packet data and its positioning information.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:NetworkPacket.","url":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkPacket/"},{"description":"D3FEND™ Ontology d3f:PacketCaptureFile.","url":"https://d3fend.mitre.org/dao/artifact/d3f:PacketCaptureFile/"},{"description":"D3FEND™ Ontology d3f:PacketLog.","url":"https://d3fend.mitre.org/dao/artifact/d3f:PacketLog/"}],"caption":"Packet"},"ja4_fingerprint":{"attributes":{"type":{"type":"string_t","description":"The JA4+ fingerprint type as defined by FoxIO, normalized to the caption of 'type_id'. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"value":{"type":"string_t","description":"The JA4+ fingerprint value.","requirement":"required","caption":"Value","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"HTTP Client Fingerprint.","caption":"JA4HTTP"},"6":{"description":"SSH Traffic Fingerprint.","caption":"JA4SSH"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"TLS Client Fingerprint.","caption":"JA4"},"2":{"description":"TLS Server Response/Session Fingerprint.","caption":"JA4Server"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Latency Measurement/Light Distance Fingerprint.","caption":"JA4Latency"},"5":{"description":"X509 TLS Certificate Fingerprint.","caption":"JA4X509"},"7":{"description":"Passive TCP Client Fingerprint.","caption":"JA4TCP"},"8":{"description":"Passive TCP Server Fingerprint.","caption":"JA4TCPServer"},"9":{"description":"Active TCP Server Fingerprint.","caption":"JA4TCPScan"}},"description":"The identifier of the JA4+ fingerprint type.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"section_a":{"type":"string_t","description":"The 'a' section of the JA4 fingerprint.","requirement":"optional","caption":"JA4 Section A","type_name":"String"},"section_b":{"type":"string_t","description":"The 'b' section of the JA4 fingerprint.","requirement":"optional","caption":"JA4 Section B","type_name":"String"},"section_c":{"type":"string_t","description":"The 'c' section of the JA4 fingerprint.","requirement":"optional","caption":"JA4 Section C","type_name":"String"},"section_d":{"type":"string_t","description":"The 'd' section of the JA4 fingerprint.","requirement":"optional","caption":"JA4 Section D","type_name":"String"}},"name":"ja4_fingerprint","description":"The JA4+ fingerprint object provides detailed fingerprint information about various aspects of network traffic which is both machine and human readable.","extends":"object","caption":"JA4+ Fingerprint"},"module":{"attributes":{"type":{"type":"string_t","description":"The module type.","requirement":"recommended","caption":"Type","type_name":"String"},"file":{"type":"object_t","description":"The module file object.","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"base_address":{"type":"string_t","description":"The memory address where the module was loaded.","requirement":"recommended","caption":"Base Address","type_name":"String"},"function_invocation":{"type":"object_t","description":"Details about the invocation of the function given in function_name.","requirement":"optional","object_type":"function_invocation","caption":"Function Invocation","object_name":"Function Invocation"},"function_name":{"type":"string_t","description":"The invoked function in the module. For load and unload events, this is the entry-point function of the module. The system calls the entry-point function whenever a process or thread loads or unloads the module.","requirement":"recommended","caption":"Function Name","type_name":"String"},"load_type":{"type":"string_t","description":"The load type, normalized to the caption of the load_type_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Load Type","type_name":"String"},"load_type_id":{"type":"integer_t","enum":{"3":{"description":"A raw module in process memory that is READWRITE_EXECUTE and had a thread started in its range.","caption":"ShellCode"},"0":{"description":"The load type is unknown.","caption":"Unknown"},"1":{"description":"A normal module loaded by the normal windows loading mechanism i.e. LoadLibrary.","caption":"Standard"},"2":{"description":"A module loaded in a way avoidant of normal windows procedures. i.e. Bootstrapped Loading/Manual Dll Loading.","caption":"Non Standard"},"99":{"description":"The load type is not mapped. See the load_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A memory mapped file, typically created with CreatefileMapping/MapViewOfFile.","caption":"Mapped"},"5":{"description":"A module loaded in a non standard way. However, GetModuleFileName succeeds on this allocation.","caption":"NonStandard Backed"}},"description":"The normalized identifier for how the module was loaded in memory.","requirement":"recommended","caption":"Load Type ID","sibling":"load_type","type_name":"Integer"},"start_address":{"type":"string_t","description":"The start address of the execution.","requirement":"recommended","caption":"Start Address","type_name":"String"}},"name":"module","description":"The Module object describes the attributes of a module.","extends":"object","constraints":{"at_least_one":["load_type_id","function_name"]},"profiles":["data_classification"],"caption":"Module"},"vulnerability":{"attributes":{"title":{"type":"string_t","description":"A title or a brief phrase summarizing the discovered vulnerability.","requirement":"optional","caption":"Title","type_name":"String"},"desc":{"type":"string_t","description":"The description of the vulnerability.","requirement":"optional","caption":"Description","type_name":"String"},"category":{"type":"string_t","description":"The category of a vulnerability or weakness, as reported by the source tool, such as Container Security or Open Source Security.","requirement":"optional","caption":"Category","type_name":"String"},"references":{"type":"string_t","description":"A list of reference URLs with additional information about the vulnerability.","is_array":true,"requirement":"recommended","caption":"References","type_name":"String"},"severity":{"type":"string_t","description":"The vendor assigned severity of the vulnerability.","requirement":"optional","caption":"Severity","type_name":"String"},"remediation":{"type":"object_t","description":"The remediation recommendations on how to mitigate the identified vulnerability.","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"advisory":{"type":"object_t","description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor.","requirement":"optional","object_type":"advisory","caption":"Security Advisory","object_name":"Advisory"},"affected_code":{"type":"object_t","description":"List of Affected Code objects that describe details about code blocks identified as vulnerable.","is_array":true,"requirement":"optional","object_type":"affected_code","caption":"Affected Code","object_name":"Affected Code"},"affected_packages":{"type":"object_t","description":"List of software packages identified as affected by a vulnerability/vulnerabilities.","is_array":true,"requirement":"optional","object_type":"affected_package","caption":"Affected Software Packages","object_name":"Affected Software Package"},"cve":{"type":"object_t","description":"Describes the Common Vulnerabilities and Exposures (CVE) details related to the vulnerability.","requirement":"recommended","object_type":"cve","caption":"CVE","object_name":"CVE"},"cwe":{"type":"object_t","description":"Describes the Common Weakness Enumeration (CWE) details related to the vulnerability.","requirement":"recommended","object_type":"cwe","caption":"CWE","object_name":"CWE"},"dependency_chain":{"type":"string_t","description":"Information about the chain of dependencies related to the issue as reported by an Application Security or Vulnerability Management tool. E.g., serverless-offline -> @serverless/utils -> memoizee -> es5-ext.","requirement":"optional","caption":"Dependency Chain","type_name":"String"},"exploit_last_seen_time":{"type":"timestamp_t","description":"The time when the exploit was most recently observed.","requirement":"optional","caption":"Exploit Last Seen Time","type_name":"Timestamp"},"exploit_ref_url":{"type":"url_t","description":"The URL of the exploit code or Proof-of-Concept (PoC).","requirement":"optional","caption":"Exploit URL","type_name":"URL String"},"exploit_requirement":{"type":"string_t","description":"The requirement description related to any constraints around exploit execution.","requirement":"optional","caption":"Exploit Requirement","type_name":"String"},"exploit_type":{"type":"string_t","description":"The categorization or type of Exploit. E.g., Network or Physical.","requirement":"optional","caption":"Exploit Type","type_name":"String"},"first_seen_time":{"type":"timestamp_t","description":"The time when the vulnerability was first observed.","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"fix_available":{"type":"boolean_t","description":"Indicates if a fix is available for the reported vulnerability.","requirement":"optional","caption":"Fix Availability","type_name":"Boolean","@deprecated":{"message":"Use the is_fix_available attribute instead.","since":"1.1.0"}},"fix_coverage":{"type":"string_t","description":"The fix coverage, normalized to the caption of the fix_coverage_id value.","requirement":"optional","caption":"Fix Coverage","type_name":"String"},"fix_coverage_id":{"type":"integer_t","enum":{"3":{"description":"No fixes or patches are currently available for any of the affected packages and components.","caption":"None"},"0":{"description":"The fix coverage is unknown.","caption":"Unknown"},"1":{"description":"All affected packages and components have available fixes or patches to remediate the vulnerability.","caption":"Complete"},"2":{"description":"Only some of the affected packages and components have available fixes or patches, while others remain vulnerable.","caption":"Partial"},"99":{"description":"The fix coverage is not mapped. See the fix_coverage attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier for fix coverage, applicable to this vulnerability. Typically useful, when there are multiple affected packages but only a subset have available fixes.","requirement":"optional","caption":"Fix Coverage ID","sibling":"fix_coverage","type_name":"Integer"},"is_exploit_available":{"type":"boolean_t","description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability.","requirement":"optional","caption":"Exploit Availability","type_name":"Boolean"},"is_fix_available":{"type":"boolean_t","description":"Indicates if a fix is available for the reported vulnerability.","requirement":"optional","caption":"Fix Availability","type_name":"Boolean"},"kb_article_list":{"type":"object_t","description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.","is_array":true,"requirement":"optional","object_type":"kb_article","caption":"Knowledgebase Articles","@deprecated":{"message":"Use advisory attribute instead.","since":"1.4.0"},"object_name":"KB Article"},"kb_articles":{"type":"string_t","description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.","is_array":true,"requirement":"optional","caption":"Knowledgebase Articles","type_name":"String","@deprecated":{"message":"Use the kb_article_list attribute instead.","since":"1.1.0"}},"last_seen_time":{"type":"timestamp_t","description":"The time when the vulnerability was most recently observed.","requirement":"optional","caption":"Last Seen","type_name":"Timestamp"},"packages":{"type":"object_t","description":"List of vulnerable packages as identified by the security product","is_array":true,"requirement":"optional","object_type":"package","caption":"Software Packages","@deprecated":{"message":"Use the affected_packages attribute instead.","since":"1.1.0"},"object_name":"Software Package"},"related_vulnerabilities":{"type":"string_t","description":"List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability.","is_array":true,"requirement":"optional","caption":"Related Vulnerability IDs","type_name":"String"},"vendor_name":{"type":"string_t","description":"The name of the vendor that identified the vulnerability.","requirement":"optional","caption":"Vendor Name","type_name":"String"},"exploit_last_seen_time_dt":{"type":"datetime_t","description":"The time when the exploit was most recently observed.","requirement":"optional","profiles":["datetime"],"caption":"Exploit Last Seen Time","type_name":"Datetime"},"first_seen_time_dt":{"type":"datetime_t","description":"The time when the vulnerability was first observed.","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"The time when the vulnerability was most recently observed.","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"}},"name":"vulnerability","description":"The vulnerability is an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.","extends":"object","constraints":{"just_one":["advisory","cve","cwe"]},"profiles":["data_classification","datetime"],"caption":"Vulnerability Details"},"image":{"attributes":{"name":{"type":"string_t","description":"The image name. For example: elixir.","requirement":"recommended","caption":"Name","type_name":"String"},"tag":{"type":"string_t","description":"The image tag. For example: 1.11-alpine.","requirement":"optional","caption":"Image Tag","type_name":"String","@deprecated":{"message":"Use the labels or tags attribute instead.","since":"1.4.0"}},"path":{"type":"file_path_t","description":"The full path to the image file.","requirement":"optional","caption":"Path","type_name":"File Path"},"uid":{"type":"string_t","description":"The unique image ID. For example: 77af4d6b9913.","requirement":"required","caption":"Unique ID","type_name":"String"},"labels":{"type":"string_t","description":"The list of labels associated to the image.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the image.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"}},"name":"image","description":"The Image object provides a description of a specific Virtual Machine (VM) or Container image.","extends":"_entity","constraints":{},"references":[{"description":"D3FEND™ Ontology d3f:ContainerImage","url":"https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/"}],"caption":"Image"},"software_component":{"attributes":{"name":{"type":"string_t","description":"The software component name.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of software component, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The software component version.","requirement":"required","caption":"Version","type_name":"String"},"author":{"type":"string_t","description":"The author(s) who published the software component.","requirement":"recommended","caption":"Author","type_name":"String"},"hash":{"type":"object_t","description":"Cryptographic hash to identify the binary instance of a software component.","requirement":"optional","object_type":"fingerprint","caption":"Hash","object_name":"Fingerprint"},"relationship":{"type":"string_t","description":"The relationship between two software components, normalized to the caption of the relationship_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Relationship","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"An operating system. Useful for SBOMs of container images.","caption":"Operating System"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A software framework.","caption":"Framework"},"2":{"description":"A software library.","caption":"Library"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The type of software component.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"license":{"type":"string_t","description":"The software license applied to this component.","requirement":"optional","caption":"Software License","type_name":"String"},"purl":{"type":"string_t","description":"The Package URL (PURL) to identify the software component. This is a URL that uniquely identifies the component, including the component's name, version, and type. The URL is used to locate and retrieve the component's metadata and content.","requirement":"recommended","caption":"Package URL","type_name":"String"},"related_component":{"type":"string_t","description":"The package URL (PURL) of the component that this software component has a relationship with.","requirement":"recommended","caption":"Related Component","type_name":"String"},"relationship_id":{"type":"integer_t","enum":{"0":{"description":"The relationship is unknown.","caption":"Unknown"},"1":{"description":"The component is a dependency of another component. Can be used to define both direct and transitive dependencies.","caption":"Depends On"},"99":{"description":"The relationship is not mapped. See the relationship attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the relationship between two software components.","requirement":"recommended","caption":"Relationship ID","sibling":"relationship","type_name":"Integer"}},"name":"software_component","description":"The Software Component object describes characteristics of a software component within a software package.","extends":"object","caption":"Software Component"},"parameter":{"attributes":{"name":{"type":"string_t","description":"The parameter name.","requirement":"optional","caption":"Name","type_name":"String"},"post_value":{"type":"string_t","description":"The parameter value after function execution.","requirement":"optional","caption":"Post-Value","type_name":"String"},"pre_value":{"type":"string_t","description":"The parameter value before function execution.","requirement":"optional","caption":"Pre-Value","type_name":"String"}},"name":"parameter","description":"The Parameter object provides details regarding a parameter of a a function.","extends":"object","constraints":{"at_least_one":["name","pre_value","post_value"]},"caption":"Parameter"},"advisory":{"attributes":{"size":{"type":"long_t","description":"The size in bytes for the Advisory. Usually populated for a KB Article patch.","requirement":"optional","caption":"Size","type_name":"Long"},"os":{"type":"object_t","description":"The operating system the Advisory applies to.","requirement":"recommended","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"title":{"type":"string_t","description":"A title or a brief phrase summarizing the Advisory.","requirement":"recommended","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"The product where the vulnerability was discovered.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"desc":{"type":"string_t","description":"A brief description of the Advisory Record.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier assigned to the advisory or disclosed vulnerability, e.g, GHSA-5mrr-rgp6-x4gr.","requirement":"required","caption":"Advisory ID","type_name":"String","observable":44},"references":{"type":"string_t","description":"A list of reference URLs with additional information about the vulnerabilities disclosed in the Advisory.","is_array":true,"requirement":"recommended","caption":"References","type_name":"String"},"avg_timespan":{"type":"object_t","description":"The average time to patch.","requirement":"optional","object_type":"timespan","caption":"Average Timespan","object_name":"Time Span"},"bulletin":{"type":"string_t","description":"The Advisory bulletin identifier.","requirement":"optional","caption":"Patch Bulletin","type_name":"String"},"classification":{"type":"string_t","description":"The vendors classification of the Advisory.","requirement":"optional","caption":"Classification","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the Advisory record was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"install_state":{"type":"string_t","description":"The install state of the Advisory.","requirement":"recommended","caption":"Install State","type_name":"String"},"install_state_id":{"type":"integer_t","enum":{"3":{"description":"The item is installed pending reboot operation.","caption":"Installed Pending Reboot"},"0":{"description":"The normalized install state is unknown.","caption":"Unknown"},"1":{"description":"The item is installed.","caption":"Installed"},"2":{"description":"The item is not installed.","caption":"Not Installed"},"99":{"description":"The install state is not mapped. See the install_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized install state ID of the Advisory.","requirement":"recommended","caption":"Install State ID","sibling":"install_state","type_name":"Integer"},"is_superseded":{"type":"boolean_t","description":"The Advisory has been replaced by another.","requirement":"optional","caption":"The patch is superseded.","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The time when the Advisory record was last updated.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"related_cves":{"type":"object_t","description":"A list of Common Vulnerabilities and Exposures (CVE) identifiers related to the vulnerabilities disclosed in the Advisory.","is_array":true,"requirement":"optional","object_type":"cve","caption":"Related CVEs","object_name":"CVE"},"related_cwes":{"type":"object_t","description":"A list of Common Weakness Enumeration (CWE) identifiers related to the vulnerabilities disclosed in the Advisory.","is_array":true,"requirement":"optional","object_type":"cwe","caption":"Related CWEs","object_name":"CWE"},"src_url":{"type":"url_t","description":"The Advisory link from the source vendor.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"created_time_dt":{"type":"datetime_t","description":"The time when the Advisory record was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the Advisory record was last updated.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"advisory","description":"The Advisory object represents publicly disclosed cybersecurity vulnerabilities defined in a Security advisory. e.g. Microsoft KB Article, Apple Security Advisory, or a GitHub Security Advisory (GHSA)","extends":"object","profiles":["data_classification","datetime"],"caption":"Advisory"},"win/reg_value":{"attributes":{"data":{"type":"json_t","description":"The data of the registry value. Where the value type is known, implementers should instead use a type-specific attribute, i.e. reg_binary_data, reg_integer_data, reg_string_data, or reg_string_list_data.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the registry value.","requirement":"required","caption":"Name","type_name":"String","observable":43},"type":{"type":"string_t","description":"A string representation of the value type as specified in Registry Value Types.","requirement":"optional","caption":"Type","type_name":"String"},"path":{"type":"reg_key_path_t","description":"The full path to the registry key, where the value is located.","requirement":"required","caption":"Path","type_name":"Registry Key Path"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A 32-bit integer in big-endian byte order.","caption":"REG_DWORD_BIG_ENDIAN"},"6":{"description":"A sequence of zero or more strings.","caption":"REG_MULTI_SZ"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"Arbitrary binary data.","caption":"REG_BINARY"},"2":{"description":"A 32-bit integer.","caption":"REG_DWORD"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A string containing unexpanded environment variables, e.g. %USERPROFILE%\\Downloads.","caption":"REG_EXPAND_SZ"},"5":{"description":"A string containing the target path of a symbolic link created by calling RegCreateKeyEx with REG_OPTION_CREATE_LINK.","caption":"REG_LINK"},"7":{"description":"A value with no declared type.","caption":"REG_NONE"},"8":{"description":"A 64-bit integer.","caption":"REG_QWORD"},"9":{"description":"Not defined in Windows documentation and previously added to OCSF in error.","caption":"REG_QWORD_LITTLE_ENDIAN","@deprecated":{"message":"Use REG_QWORD instead.","since":"1.6.0"}},"10":{"description":"A string.","caption":"REG_SZ"}},"description":"The value type ID.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"is_default":{"type":"boolean_t","description":"The indication of whether the value is from a default value name. For example, the value name could be missing.","requirement":"optional","caption":"Default Value","type_name":"Boolean"},"is_system":{"type":"boolean_t","description":"The indication of whether the object is part of the operating system.","requirement":"optional","caption":"System","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The time when the registry value was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"modified_time_dt":{"type":"datetime_t","description":"The time when the registry value was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"reg_binary_data":{"type":"bytestring_t","description":"The data of the registry value when type_id is REG_BINARY or REG_NONE.","extension":"win","requirement":"optional","extension_id":2,"caption":"Registry Binary Data","type_name":"Byte String"},"reg_integer_data":{"type":"long_t","description":"The data of the registry value when type_id is REG_DWORD, REG_DWORD_BIG_ENDIAN, or REG_QWORD.","extension":"win","requirement":"optional","extension_id":2,"caption":"Registry Integer Data","type_name":"Long"},"reg_string_data":{"type":"string_t","description":"The data of the registry value when type_id is REG_SZ, REG_EXPAND_SZ, or REG_LINK.","extension":"win","requirement":"optional","extension_id":2,"caption":"Registry String Data","type_name":"String"},"reg_string_list_data":{"type":"string_t","description":"The data of the registry value when type_id is REG_MULTI_SZ.","extension":"win","is_array":true,"requirement":"optional","extension_id":2,"caption":"Registry String List Data","type_name":"String"}},"name":"reg_value","description":"The registry value object describes a Windows registry value.","extension":"win","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:WindowsRegistryValue.","url":"https://d3fend.mitre.org/dao/artifact/d3f:WindowsRegistryValue/"}],"extension_id":2,"profiles":["datetime"],"caption":"Registry Value","observable":29},"managed_entity":{"attributes":{"data":{"type":"json_t","description":"The managed entity content as a JSON object.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The managed entity type. For example: Policy, User, Organization, Device.","requirement":"recommended","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The version of the managed entity. For example: 1.2.3.","requirement":"recommended","caption":"Version","type_name":"String"},"user":{"type":"object_t","description":"The user that pertains to the event or object.","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","requirement":"recommended","object_type":"device","caption":"Device","object_name":"Device"},"group":{"type":"object_t","description":"The group object associated with an entity such as user, policy, or rule.","requirement":"recommended","object_type":"group","caption":"Group","object_name":"Group"},"location":{"type":"object_t","description":"The detailed geographical location usually associated with an IP address.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"uid":{"type":"string_t","description":"The identifier of the managed entity. It should match the uid of the specific entity's object UID if populated, or the source specific ID if the type_id is 'Other'.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"email":{"type":"object_t","description":"The email object.","requirement":"recommended","object_type":"email","caption":"Email","object_name":"Email"},"org":{"type":"object_t","description":"The Organization object containing details about the managed organizational entity. This object includes properties such as the organization name, unique identifier, type, and other organizational metadata. This attribute should be populated when type_id is 4 (Organization).","requirement":"recommended","object_type":"organization","caption":"Organization","object_name":"Organization"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A managed Group entity. This item corresponds to population of the group attribute.","caption":"Group"},"6":{"description":"A managed Email entity. This item corresponds to population of the email attribute.","caption":"Email"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A managed Device entity. This item corresponds to population of the device attribute.","caption":"Device"},"2":{"description":"A managed User entity. This item corresponds to population of the user attribute.","caption":"User"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A managed Organization entity. This item corresponds to population of the org attribute.","caption":"Organization"},"5":{"description":"A managed Policy entity. This item corresponds to population of the policy attribute.","caption":"Policy"},"7":{"description":"A managed Network Zone entity. Populate the name attribute with the zone name and/or the uid attribute with the zone ID. Additional zone information can be added to the data attribute.","caption":"Network Zone"}},"description":"The type of the Managed Entity. It is recommended to also populate the type attribute with the associated label, or the source specific name if Other.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"policy":{"type":"object_t","description":"Describes details of a managed policy.","requirement":"recommended","object_type":"policy","caption":"Policy","object_name":"Policy"}},"name":"managed_entity","description":"The Managed Entity object describes the type and version of an entity, such as a user, device, or policy. For types in the type_id enum list, an associated attribute should be populated. If the type of entity is not in the type_id list, information can be put into the data attribute, type_id should be 'Other' and the type attribute should label the entity type.","extends":"_entity","constraints":{"at_least_one":["name","uid","device","group","org","policy","user"]},"profiles":["container","data_classification"],"caption":"Managed Entity"},"fingerprint":{"attributes":{"value":{"type":"file_hash_t","description":"The fingerprint value.

Note: This uses type file_hash_t ("Hash"), which has been generalized for all fingerprints but retains the same name and caption for backwards compatibility.

","requirement":"required","caption":"Value","type_name":"Hash"},"algorithm":{"type":"string_t","description":"The algorithm or scheme used to create the fingerprint, normalized to the caption of algorithm_id. In the case of Other, it is defined by the event source.","requirement":"optional","caption":"Algorithm","type_name":"String"},"algorithm_id":{"type":"integer_t","enum":{"3":{"description":"Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-256"},"6":{"description":"The TLSH fuzzy hashing algorithm.","caption":"TLSH"},"0":{"description":"The algorithm is unknown.","caption":"Unknown"},"1":{"description":"MD5 message-digest algorithm producing a 128-bit (16-byte) hash value.","references":[{"description":"RFC 1321","url":"https://www.rfc-editor.org/rfc/rfc1321"}],"caption":"MD5"},"2":{"description":"Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-1"},"99":{"description":"The algorithm is not mapped. See the algorithm attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-512"},"5":{"description":"The ssdeep generated fuzzy checksum. Also known as Context Triggered Piecewise Hash (CTPH).","caption":"CTPH"},"7":{"description":"Microsoft simple non-cryptographic hash algorithm that works by XORing the bytes in a circular-shifting fashion.","caption":"quickXorHash"},"8":{"description":"Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-224"},"9":{"description":"Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-384"},"10":{"description":"Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 224-bit (28-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-512/224"},"11":{"description":"Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 256-bit (32-byte) hash value.","references":[{"description":"FIPS 180","url":"https://csrc.nist.gov/pubs/fips/180-4/upd1/final"}],"caption":"SHA-512/256"},"12":{"description":"Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash value.","references":[{"description":"FIPS 202","url":"https://csrc.nist.gov/pubs/fips/202/final"}],"caption":"SHA3-224"},"14":{"description":"Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash value.","references":[{"description":"FIPS 202","url":"https://csrc.nist.gov/pubs/fips/202/final"}],"caption":"SHA3-384"},"15":{"description":"Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash value.","references":[{"description":"FIPS 202","url":"https://csrc.nist.gov/pubs/fips/202/final"}],"caption":"SHA3-512"},"16":{"description":"xxHash H3 producing a 64-bit hash value.","references":[{"description":"xxHASH H3","url":"https://xxhash.com/doc/v0.8.3/group___x_x_h3__family.html"}],"caption":"xxHash H3 64-bit"},"17":{"description":"xxHash H3 producing a 128-bit hash value.","references":[{"description":"xxHASH H3","url":"https://xxhash.com/doc/v0.8.3/group___x_x_h3__family.html"}],"caption":"xxHash H3 128-bit"},"18":{"description":"Import hash (imphash) based on the import table of a Portable Executable (PE) file producing a 128-bit (16-byte) hash value.","references":[{"description":"Tracking Malware with Import Hashing","url":"https://cloud.google.com/blog/topics/threat-intelligence/tracking-malware-import-hashing/"}],"caption":"Imphash"},"20":{"description":"HASSH is a network fingerprinting standard which can be used to identify specific SSH client and server implementations.","caption":"HASSH"},"13":{"description":"Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash value.","references":[{"description":"FIPS 202","url":"https://csrc.nist.gov/pubs/fips/202/final"}],"caption":"SHA3-256"},"19":{"description":"Network Protocol Fingerprint (NPF) used to identify network protocols and applications.","references":[{"description":"Mercury Network Protocol Fingerprint Documentation","url":"https://github.com/cisco/mercury/blob/main/doc/npf.md"}],"caption":"NPF"}},"description":"The identifier of the normalized algorithm or scheme, which was used to create the fingerprint.","requirement":"required","caption":"Algorithm ID","sibling":"algorithm","type_name":"Integer"}},"name":"fingerprint","description":"The Fingerprint object provides detailed information about a fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key, file content, or application implementation. It contains the algorithm or scheme and value of the fingerprint, enabling efficient and reliable identification of the associated data.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:DigitalFingerprint.","url":"https://d3fend.mitre.org/dao/artifact/d3f:DigitalFingerprint/"}],"caption":"Fingerprint","observable":30},"product":{"attributes":{"name":{"type":"string_t","description":"The name of the product.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The version of the product, as defined by the event source. For example: 2013.1.3-beta.","requirement":"recommended","caption":"Version","type_name":"String"},"path":{"type":"string_t","description":"The installation path of the product.","requirement":"optional","caption":"Path","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the product.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"feature":{"type":"object_t","description":"The feature that reported the event.","requirement":"optional","object_type":"feature","caption":"Feature","object_name":"Feature"},"lang":{"type":"string_t","description":"The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).","requirement":"optional","caption":"Language","type_name":"String"},"cpe_name":{"type":"string_t","description":"The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.","requirement":"optional","caption":"The product CPE identifier","type_name":"String"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"url_string":{"type":"url_t","description":"The URL pointing towards the product.","requirement":"optional","caption":"URL String","type_name":"URL String"},"vendor_name":{"type":"string_t","description":"The name of the vendor of the product.","requirement":"recommended","caption":"Vendor Name","type_name":"String"}},"name":"product","description":"The Product object describes characteristics of a software product.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["data_classification"],"caption":"Product"},"group":{"attributes":{"name":{"type":"string_t","description":"The group name.","requirement":"recommended","caption":"Name","type_name":"String","observable":32},"type":{"type":"string_t","description":"The type of the group.","requirement":"optional","caption":"Group Type","type_name":"String"},"domain":{"type":"string_t","description":"The domain where the group is defined. For example: the LDAP or Active Directory domain.","requirement":"optional","caption":"Domain","type_name":"String"},"desc":{"type":"string_t","description":"The group description.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. Another example, pool id or desktop id that the device belongs to.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":33},"privileges":{"type":"string_t","description":"The group privileges.","is_array":true,"requirement":"optional","caption":"Privileges","type_name":"String"},"uid_alt":{"type":"string_t","description":"The alternate unique identifier.","requirement":"optional","caption":"Alternate ID","type_name":"String"}},"name":"group","description":"The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization, including but not limited to purposes of access control.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:AccessControlGroup.","url":"https://d3fend.mitre.org/dao/artifact/d3f:AccessControlGroup/"}],"caption":"Group"},"peripheral_device":{"attributes":{"name":{"type":"string_t","description":"The name of the peripheral device.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The Peripheral Device type, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Peripheral Device Type","type_name":"String"},"class":{"type":"string_t","description":"The class of the peripheral device.","requirement":"optional","caption":"Class","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the peripheral device.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"The peripheral device is a mouse.","caption":"Mouse"},"6":{"description":"The peripheral device is a microphone.","caption":"Microphone"},"0":{"description":"The peripheral device type is unknown.","caption":"Unknown"},"1":{"description":"The peripheral device is an external storage device.","caption":"External Storage"},"2":{"description":"The peripheral device is a keyboard.","caption":"Keyboard"},"99":{"description":"The peripheral device type is not mapped. See the type attribute which contains an event source specific value.","caption":"Other"},"4":{"description":"The peripheral device is a printer.","caption":"Printer"},"5":{"description":"The peripheral device is a monitor.","caption":"Monitor"},"7":{"description":"The peripheral device is a webcam.","caption":"Webcam"}},"description":"The normalized peripheral device type ID.","requirement":"recommended","caption":"Peripheral Device Type ID","sibling":"type","type_name":"Integer"},"model":{"type":"string_t","description":"The peripheral device model.","requirement":"recommended","caption":"Model","type_name":"String"},"serial_number":{"type":"string_t","description":"The peripheral device serial number.","requirement":"recommended","caption":"Serial Number","type_name":"String","observable":37},"vendor_id_list":{"type":"string_t","description":"The list of vendor IDs for the peripheral device.","is_array":true,"requirement":"recommended","caption":"Vendor ID List","type_name":"String"},"vendor_name":{"type":"string_t","description":"The primary vendor name for the peripheral device.","requirement":"recommended","caption":"Vendor Name","type_name":"String"}},"name":"peripheral_device","description":"The peripheral device object describes the properties of external, connectable, and detachable hardware.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Peripheral Device"},"databucket":{"attributes":{"is_backed_up":{"type":"boolean_t","description":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the cloudBackupEnabled value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service.","requirement":"optional","caption":"Back Ups Configured","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The most recent time when any changes, updates, or modifications were made within the databucket.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"zone":{"type":"string_t","description":"The specific availability zone within a cloud region where the databucket is located.","requirement":"optional","profiles":["cloud"],"caption":"Cloud Availability Zone","type_name":"String"},"uid":{"type":"resource_uid_t","description":"The unique identifier of the databucket.","requirement":"recommended","caption":"Unique ID","type_name":"Resource UID"},"is_public":{"type":"boolean_t","description":"Indicates if the databucket is publicly accessible.","requirement":"recommended","caption":"Public","type_name":"Boolean"},"namespace":{"type":"string_t","description":"The namespace is useful when similar entities exist that you need to keep separate.","requirement":"optional","caption":"Namespace","type_name":"String"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the databucket.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The databucket type.","requirement":"recommended","caption":"Type","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"GCP Bucket"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"S3"},"2":{"caption":"Azure Blob"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the databucket type.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"data":{"type":"json_t","description":"Additional data describing the resource.","requirement":"optional","caption":"Data","type_name":"JSON"},"modified_time_dt":{"type":"datetime_t","description":"The most recent time when any changes, updates, or modifications were made within the databucket.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"labels":{"type":"string_t","description":"The list of labels associated to the resource.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"group":{"type":"object_t","description":"The name of the related resource group.","requirement":"optional","object_type":"group","caption":"Group","@deprecated":{"message":"Use the groups attribute instead.","since":"1.6.0"},"object_name":"Group"},"is_encrypted":{"type":"boolean_t","description":"Indicates if the databucket is encrypted.","requirement":"optional","caption":"Encrypted","type_name":"Boolean"},"name":{"type":"string_t","description":"The databucket name.","requirement":"recommended","caption":"Name","type_name":"String"},"desc":{"type":"string_t","description":"The description of the databucket.","requirement":"optional","caption":"Description","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the databucket was known to have been created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"hostname":{"type":"hostname_t","description":"The fully qualified hostname of the databucket.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"cloud_partition":{"type":"string_t","description":"The logical grouping or isolated segment within a cloud provider's infrastructure where the databucket is located.","requirement":"optional","profiles":["cloud"],"caption":"Cloud Partition","type_name":"String"},"criticality":{"type":"string_t","description":"The criticality of the databucket as defined by the event source.","requirement":"optional","caption":"Criticality","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time when the databucket was known to have been created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"version":{"type":"string_t","description":"The version of the resource. For example 1.2.3.","requirement":"optional","caption":"Version","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the resource.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"resource_relationship":{"type":"object_t","description":"A graph representation showing how this databucket relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections.","requirement":"optional","object_type":"graph","caption":"Resource Relationship","object_name":"Graph"},"size":{"type":"long_t","description":"The size of the databucket in bytes.","requirement":"optional","caption":"Size","type_name":"Long"},"uid_alt":{"type":"resource_uid_t","description":"The alternative unique identifier of the resource.","requirement":"optional","caption":"Alternate ID","type_name":"Resource UID"},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"encryption_details":{"type":"object_t","description":"The encryption details of the databucket. Should be populated if the databucket is encrypted.","requirement":"optional","object_type":"encryption_details","caption":"Encryption Details","object_name":"Encryption Details"},"groups":{"type":"object_t","description":"The group names to which the databucket belongs.","is_array":true,"requirement":"optional","object_type":"group","caption":"Groups","object_name":"Group"},"ip":{"type":"ip_t","description":"The IP address of the resource, in either IPv4 or IPv6 format.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"region":{"type":"string_t","description":"The cloud region of the databucket.","requirement":"optional","profiles":["cloud"],"caption":"Region","type_name":"String"},"file":{"type":"object_t","description":"Details about the file/object within a databucket.","requirement":"optional","object_type":"file","caption":"File","object_name":"File"}},"name":"databucket","description":"The databucket object is a basic container that holds data, typically organized through the use of data partitions.","extends":"_resource","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:CloudStorage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:CloudStorage/"}],"profiles":["cloud","data_classification","datetime"],"caption":"Databucket"},"d3f_tactic":{"attributes":{"name":{"type":"string_t","description":"The tactic name that is associated with the defensive technique. For example: Isolate.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the defensive tactic.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"src_url":{"type":"url_t","description":"The versioned permalink of the defensive tactic. For example: https://d3fend.mitre.org/tactic/d3f:Isolate/.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"d3f_tactic","description":"The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that is associated to an attack.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Matrix","url":"https://d3fend.mitre.org"}],"caption":"MITRE D3FEND™ Tactic"},"evidences":{"attributes":{"data":{"type":"json_t","description":"Additional evidence data that is not accounted for in the specific evidence attributes. Use only when absolutely necessary.","requirement":"optional","caption":"Data","type_name":"JSON"},"http_response":{"type":"object_t","description":"Describes details about the http response associated to the activity that triggered the detection.","requirement":"recommended","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"http_request":{"type":"object_t","description":"Describes details about the http request associated to the activity that triggered the detection.","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"name":{"type":"string_t","description":"The naming convention or type identifier of the evidence associated with the security detection. For example, the @odata.type from Microsoft Graph Alerts V2 or display_name from CrowdStrike Falcon Incident Behaviors.","requirement":"optional","caption":"Name","type_name":"String"},"process":{"type":"object_t","description":"Describes details about the process associated to the activity that triggered the detection.","requirement":"recommended","object_type":"process","caption":"Process","object_name":"Process"},"file":{"type":"object_t","description":"Describes details about the file associated to the activity that triggered the detection.","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"user":{"type":"object_t","description":"Describes details about the user that was the target or somehow else associated with the activity that triggered the detection.","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"script":{"type":"object_t","description":"Describes details about the script that was associated with the activity that triggered the detection.","requirement":"recommended","object_type":"script","caption":"Script","object_name":"Script"},"device":{"type":"object_t","description":"An addressable device, computer system or host associated to the activity that triggered the detection.","requirement":"recommended","object_type":"device","caption":"Device","object_name":"Device"},"uid":{"type":"string_t","description":"The unique identifier of the evidence associated with the security detection. For example, the activity_id from CrowdStrike Falcon Alerts or behavior_id from CrowdStrike Falcon Incident Behaviors.","requirement":"optional","caption":"Unique ID","type_name":"String"},"query":{"type":"object_t","description":"Describes details about the DNS query associated to the activity that triggered the detection.","requirement":"recommended","object_type":"dns_query","caption":"DNS Query","object_name":"DNS Query"},"connection_info":{"type":"object_t","description":"Describes details about the network connection associated to the activity that triggered the detection.","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"url":{"type":"object_t","description":"The URL object that pertains to the event or object associated to the activity that triggered the detection.","requirement":"recommended","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"email":{"type":"object_t","description":"The email object associated to the activity that triggered the detection.","requirement":"recommended","object_type":"email","caption":"Email","object_name":"Email"},"tls":{"type":"object_t","description":"Describes details about the Transport Layer Security (TLS) activity that triggered the detection.","requirement":"recommended","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"api":{"type":"object_t","description":"Describes details about the API call associated to the activity that triggered the detection.","requirement":"recommended","object_type":"api","caption":"API Details","object_name":"API"},"resources":{"type":"object_t","description":"Describes details about the cloud resources directly related to activity that triggered the detection. For resources impacted by the detection, use Affected Resources at the top-level of the finding.","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Cloud Resources","object_name":"Resource Details"},"actor":{"type":"object_t","description":"Describes details about the user/role/process that was the source of the activity that triggered the detection.","requirement":"recommended","object_type":"actor","caption":"Actor","object_name":"Actor"},"container":{"type":"object_t","description":"Describes details about the container associated to the activity that triggered the detection.","requirement":"recommended","object_type":"container","caption":"Container","object_name":"Container"},"database":{"type":"object_t","description":"Describes details about the database associated to the activity that triggered the detection.","requirement":"recommended","object_type":"database","caption":"Database","object_name":"Database"},"databucket":{"type":"object_t","description":"Describes details about the databucket associated to the activity that triggered the detection.","requirement":"recommended","object_type":"databucket","caption":"Databucket","object_name":"Databucket"},"dst_endpoint":{"type":"object_t","description":"Describes details about the destination of the network activity that triggered the detection.","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"ja4_fingerprint_list":{"type":"object_t","description":"Describes details about the JA4+ fingerprints that triggered the detection.","is_array":true,"requirement":"recommended","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"job":{"type":"object_t","description":"Describes details about the scheduled job that was associated with the activity that triggered the detection.","requirement":"recommended","object_type":"job","caption":"Job","object_name":"Job"},"src_endpoint":{"type":"object_t","description":"Describes details about the source of the network activity that triggered the detection.","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"verdict":{"type":"string_t","description":"The normalized verdict of the evidence associated with the security detection. ","requirement":"optional","caption":"Verdict","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The verdict for the evidence is that is should be Disregarded.","caption":"Disregard"},"6":{"description":"The evidence is part of a Test, or other sanctioned behavior(s).","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The verdict for the evidence has been identified as a False Positive.","caption":"False Positive"},"2":{"description":"The verdict for the evidence has been identified as a True Positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The verdict for the evidence is that the behavior has been identified as Suspicious.","caption":"Suspicious"},"5":{"description":"The verdict for the evidence is that the behavior has been identified as Benign.","caption":"Benign"},"7":{"description":"There is insufficient data to render a verdict on the evidence.","caption":"Insufficient Data"},"8":{"description":"The verdict for the evidence is that the behavior has been identified as a Security Risk.","caption":"Security Risk"},"9":{"description":"The verdict for the evidence is Managed Externally, such as in a case management tool.","caption":"Managed Externally"},"10":{"description":"This evidence duplicates existing evidence related to this finding.","caption":"Duplicate"}},"description":"The normalized verdict (or status) ID of the evidence associated with the security detection. For example, Microsoft Graph Security Alerts contain a verdict enumeration for each type of evidence associated with the Alert. This is typically set by an automated investigation process or an analyst/investigator assigned to the finding.","requirement":"optional","caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"reg_key":{"type":"object_t","description":"Describes details about the registry key that triggered the detection.","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/reg_key","caption":"Registry Key","object_name":"Registry Key"},"win_service":{"type":"object_t","description":"Describes details about the Windows service that triggered the detection.","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/win_service","caption":"Windows Service","object_name":"Windows Service"},"reg_value":{"type":"object_t","description":"Describes details about the registry value that triggered the detection.","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/reg_value","caption":"Registry Value","object_name":"Registry Value"}},"name":"evidences","description":"A collection of evidence artifacts associated to the activity/activities that triggered a security detection.","extends":"_entity","constraints":{"at_least_one":["actor","api","connection_info","data","database","databucket","device","dst_endpoint","email","file","process","query","src_endpoint","url","user","job","script","reg_key","reg_value","win_service"]},"profiles":["cloud","container","data_classification","linux/linux_users","macos/macos_users"],"caption":"Evidence Artifacts"},"malware_scan_info":{"attributes":{"name":{"type":"string_t","description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\"","requirement":"recommended","caption":"Name","type_name":"String"},"size":{"type":"long_t","description":"The total size in bytes of all files that were scanned.","requirement":"optional","caption":"Size","type_name":"Long"},"type":{"type":"string_t","description":"The type of scan.","requirement":"optional","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The application-defined unique identifier assigned to an instance of a scan.","requirement":"recommended","caption":"Scan UID","type_name":"String"},"start_time":{"type":"timestamp_t","description":"The timestamp indicating when the scan job began execution.","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"type_id":{"type":"integer_t","enum":{"3":{"description":"The scan was triggered by a content update.","caption":"Updated Content"},"6":{"description":"The scan was started due to a user logon.","caption":"User Logon"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The scan was manually initiated by the user or administrator.","caption":"Manual"},"2":{"description":"The scan was started based on scheduler.","caption":"Scheduled"},"99":{"description":"The scan type id is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The scan was triggered by newly quarantined items.","caption":"Quarantined Items"},"5":{"description":"The scan was triggered by the attachment of removable media.","caption":"Attached Media"},"7":{"description":"The scan was triggered by an Early Launch Anti-Malware (ELAM) detection.","caption":"ELAM"}},"description":"The type id of the scan.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"end_time":{"type":"timestamp_t","description":"The timestamp indicating when the scan job completed execution.","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The timestamp indicating when the scan job began execution.","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The timestamp indicating when the scan job completed execution.","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"num_files":{"type":"integer_t","description":"The total number of files analyzed during the scan.","requirement":"optional","caption":"Scanned Files","type_name":"Integer"},"num_infected":{"type":"integer_t","description":"The total number of files identified as infected with malware during the scan.","requirement":"optional","caption":"Number of Infected Entities","type_name":"Integer"},"num_volumes":{"type":"integer_t","description":"The total number of storage volumes examined during the malware scan.","requirement":"optional","caption":"Number of Volumes","type_name":"Integer"},"unique_malware_count":{"type":"integer_t","description":"The number of unique malware detected across all infected files.","requirement":"optional","caption":"Unique Malware Count","type_name":"Integer"}},"name":"malware_scan_info","description":"The malware scan information object describes characteristics, metadata of a malware scanning job.","extends":"scan","constraints":{"at_least_one":["name","uid"]},"profiles":["datetime"],"caption":"Malware Scan Info"},"object":{"attributes":{},"name":"object","description":"An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.","caption":"Object"},"metadata":{"attributes":{"modified_time":{"type":"timestamp_t","description":"The time when the event was last modified or enriched.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"logged_time_dt":{"type":"datetime_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","requirement":"optional","profiles":["datetime"],"caption":"Logged Time","type_name":"Datetime"},"processed_time":{"type":"timestamp_t","description":"The event processed time, such as an ETL operation.","requirement":"optional","caption":"Processed Time","type_name":"Timestamp"},"uid":{"type":"string_t","description":"A unique identifier assigned to the OCSF event. This ID is specific to the OCSF event itself and is distinct from the original event identifier in the source system (see original_event_uid).","requirement":"optional","caption":"Event UID","type_name":"String"},"tenant_uid":{"type":"string_t","description":"The unique tenant identifier.","requirement":"recommended","caption":"Tenant UID","type_name":"String"},"untruncated_size":{"type":"integer_t","description":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when is_truncated is true to indicate the full size of the original event.","requirement":"optional","caption":"Untruncated Size","type_name":"Integer"},"log_format":{"type":"string_t","description":"The format of data in the log where the data originated. For example CSV, XML, Windows Multiline, JSON, syslog or Cisco Log Schema.","requirement":"optional","caption":"Log Source Format","type_name":"String"},"extensions":{"type":"object_t","description":"The schema extensions used to create the event.","is_array":true,"requirement":"optional","object_type":"extension","caption":"Schema Extensions","object_name":"Schema Extension"},"type":{"type":"string_t","description":"The type of the event or finding as a subset of the source of the event. This can be any distinguishing characteristic of the data. For example 'Management Events' or 'Device Penetration Test'.","requirement":"optional","caption":"Type","type_name":"String"},"loggers":{"type":"object_t","description":"An array of Logger objects that describe the pipeline of devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow and/or to track the chain of custody of the data.","is_array":true,"requirement":"optional","object_type":"logger","caption":"Loggers","object_name":"Logger"},"log_version":{"type":"string_t","description":"The event log schema version of the original event. For example the syslog version or the Cisco Log Schema version","requirement":"optional","caption":"Log Version","type_name":"String"},"modified_time_dt":{"type":"datetime_t","description":"The time when the event was last modified or enriched.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"labels":{"type":"string_t","description":"The list of labels attached to the event. For example: [\"sample\", \"dev\"]","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"product":{"type":"object_t","description":"The product that reported the event.","requirement":"required","object_type":"product","caption":"Product","object_name":"Product"},"reporter":{"type":"object_t","description":"The entity from which the event or finding was first reported.","requirement":"recommended","object_type":"reporter","caption":"Reporter","object_name":"Reporter"},"sequence":{"type":"integer_t","description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.","requirement":"optional","caption":"Sequence Number","type_name":"Integer"},"logged_time":{"type":"timestamp_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","requirement":"optional","caption":"Logged Time","type_name":"Timestamp"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"original_event_uid":{"type":"string_t","description":"The unique identifier assigned to the event in its original logging system before transformation to OCSF format. This field preserves the source system's native event identifier, enabling traceability back to the raw log entry. For example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or a database transaction log sequence number.","requirement":"optional","caption":"Original Event ID","type_name":"String"},"transmit_time_dt":{"type":"datetime_t","description":"The time when the event was transmitted from the logging device to it's next destination.","requirement":"optional","profiles":["datetime"],"caption":"Transmission Time","type_name":"Datetime"},"profiles":{"type":"string_t","description":"The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.","is_array":true,"requirement":"optional","caption":"Profiles","type_name":"String"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"transformation_info_list":{"type":"object_t","description":"An array of transformation info that describes the mappings or transforms applied to the data.","is_array":true,"requirement":"optional","object_type":"transformation_info","caption":"Transformation Info","object_name":"Transformation Info"},"version":{"type":"string_t","description":"The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.","requirement":"required","caption":"Version","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the event.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"is_truncated":{"type":"boolean_t","description":"Indicates whether the OCSF event data has been truncated due to size limitations. When true, some event data may have been omitted to fit within system constraints.","requirement":"optional","caption":"Is Truncated","type_name":"Boolean"},"log_source":{"type":"string_t","description":"The log system or component where the data originated. For example, a file path, syslog server name or a Windows hostname and logging subsystem such as Security.","requirement":"optional","caption":"Log Source","type_name":"String"},"source":{"type":"string_t","description":"The source of the event or finding. This can be any distinguishing name for the logical origin of the data — for example, 'CloudTrail Events', or a use case like 'Attack Simulations' or 'Vulnerability Scans'.","requirement":"optional","caption":"Source","type_name":"String"},"debug":{"type":"string_t","description":"Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array.","is_array":true,"requirement":"optional","caption":"Debug Information","type_name":"String"},"processed_time_dt":{"type":"datetime_t","description":"The event processed time, such as an ETL operation.","requirement":"optional","profiles":["datetime"],"caption":"Processed Time","type_name":"Datetime"},"event_code":{"type":"string_t","description":"The identifier of the original event. For example the numerical Windows Event Code or Cisco syslog code.","requirement":"optional","caption":"Event Code","type_name":"String"},"log_level":{"type":"string_t","description":"The level at which an event was logged. This can be log provider specific. For example the audit level.","requirement":"optional","caption":"Log Level","type_name":"String"},"transmit_time":{"type":"timestamp_t","description":"The time when the event was transmitted from the logging device to it's next destination.","requirement":"optional","caption":"Transmission Time","type_name":"Timestamp"},"correlation_uid":{"type":"string_t","description":"A unique identifier used to correlate this OCSF event with other related OCSF events, distinct from the event's uid value. This enables linking multiple OCSF events that are part of the same activity, transaction, or security incident across different systems or time periods.","requirement":"optional","caption":"Correlation UID","type_name":"String"},"log_provider":{"type":"string_t","description":"The logging provider or logging service that logged the event. For example AWS CloudWatch or Splunk.","requirement":"optional","caption":"Log Provider","type_name":"String"},"extension":{"type":"object_t","description":"The schema extension used to create the event.","requirement":"optional","object_type":"extension","caption":"Schema Extension","@deprecated":{"message":"Use the extensions attribute instead.","since":"1.1.0"},"object_name":"Schema Extension"},"total_queued_duration":{"type":"object_t","description":"The amount of time an event spent in a queue awaiting processing. In this case, the value is the difference between processed_time and logged_time. This duration is inclusive of all queues between the originator of the event and the intended long-term storage destination of the event.","requirement":"optional","object_type":"timespan","caption":"Total Queued Duration","object_name":"Time Span"},"original_time":{"type":"string_t","description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.","requirement":"recommended","caption":"Original Time","type_name":"String"},"log_name":{"type":"string_t","description":"The event log name, typically for the consumer of the event. For example, the storage bucket name, SIEM repository index name, etc.","requirement":"recommended","caption":"Log Name","type_name":"String"}},"name":"metadata","description":"The Metadata object describes the metadata associated with the event.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:Metadata","url":"https://d3fend.mitre.org/dao/artifact/d3f:Metadata/"}],"profiles":["container","data_classification","datetime"],"caption":"Metadata"},"service_privilege_analysis":{"attributes":{"name":{"type":"string_t","description":"The service or namespace identifier. Examples: s3, ec2 (AWS); Microsoft.Storage (Azure); storage (GCP).","requirement":"required","caption":"Name","type_name":"String"},"all_privileges_unused":{"type":"boolean_t","description":"Indicates whether all privileges within this service are unused.","requirement":"optional","caption":"All Privileges Unused","type_name":"Boolean"},"analyzed_privileges_count":{"type":"integer_t","description":"The total count of privileges analyzed within this service.","requirement":"optional","caption":"Analyzed Privileges Count","type_name":"Integer"},"execute_count":{"type":"integer_t","description":"The count of execute-type privileges within this service.","requirement":"optional","caption":"Execute Privilege Count","type_name":"Integer"},"last_used_time":{"type":"timestamp_t","description":"The most recent time any privilege in this service was used.","requirement":"optional","caption":"Last Used Time","type_name":"Timestamp"},"privilege_attack_info_list":{"type":"object_t","description":"The list of privilege-to-attack mappings for this service.","is_array":true,"requirement":"optional","object_type":"privilege_attack_info","caption":"Privilege Attack Info List","object_name":"Privilege Attack Info"},"read_count":{"type":"integer_t","description":"The count of read-type privileges within this service.","requirement":"optional","caption":"Read Privilege Count","type_name":"Integer"},"unused_privileges_count":{"type":"integer_t","description":"The count of unused privileges within this service.","requirement":"optional","caption":"Unused Privileges Count","type_name":"Integer"},"write_count":{"type":"integer_t","description":"The count of write-type privileges within this service.","requirement":"optional","caption":"Write Privilege Count","type_name":"Integer"},"last_used_time_dt":{"type":"datetime_t","description":"The most recent time any privilege in this service was used.","requirement":"optional","profiles":["datetime"],"caption":"Last Used Time","type_name":"Datetime"}},"name":"service_privilege_analysis","description":"The Service Privilege Analysis object describes privilege analysis results for a single cloud service or resource namespace. It provides metrics on privilege usage, counts by type, and mappings to potential attack techniques.","extends":"object","profiles":["datetime"],"caption":"Service Privilege Analysis"},"reporter":{"attributes":{"name":{"type":"string_t","description":"The name of the entity from which the event or finding was reported.","requirement":"recommended","caption":"Name","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address of the entity from which the event or finding was reported.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"hostname":{"type":"hostname_t","description":"The hostname of the entity from which the event or finding was reported.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"uid":{"type":"string_t","description":"The unique identifier of the entity from which the event or finding was reported.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"org":{"type":"object_t","description":"The organization properties of the entity that reported the event or finding.","requirement":"optional","object_type":"organization","caption":"Organization","object_name":"Organization"}},"name":"reporter","description":"The entity from which an event or finding was reported.","extends":"_entity","constraints":{"at_least_one":["hostname","ip","name","uid"]},"caption":"Reporter"},"classifier_details":{"attributes":{"name":{"type":"string_t","description":"The name of the classifier.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the classifier.","requirement":"required","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the classifier.","requirement":"recommended","caption":"Unique ID","type_name":"String"}},"name":"classifier_details","description":"The Classifier Details object describes details about the classifier used for data classification.","extends":"object","caption":"Classifier Details"},"anomaly":{"attributes":{"observation_parameter":{"type":"string_t","description":"The specific parameter, metric or property where the anomaly was observed. Examples include: CPU usage percentage, API response time in milliseconds, HTTP error rate, memory utilization, network latency, transaction volume, etc. This helps identify the exact aspect of the system exhibiting anomalous behavior.","requirement":"required","caption":"Observation Parameter","type_name":"String"},"observation_type":{"type":"string_t","description":"The type of analysis methodology used to detect the anomaly. This indicates how the anomaly was identified through different analytical approaches. Common types include: Frequency Analysis, Time Pattern Analysis, Volume Analysis, Sequence Analysis, Distribution Analysis, etc.","requirement":"recommended","caption":"Observation Type","type_name":"String"},"observations":{"type":"object_t","description":"Details about the observed anomaly or observations that were flagged as anomalous compared to expected baseline behavior.","is_array":true,"requirement":"required","object_type":"observation","caption":"Observations","object_name":"Observation"},"observed_pattern":{"type":"string_t","description":"The specific pattern identified within the observation type. For Frequency Analysis, this could be 'FREQUENT', 'INFREQUENT', 'RARE', or 'UNSEEN'. For Time Pattern Analysis, this could be 'BUSINESS_HOURS', 'OFF_HOURS', or 'UNUSUAL_TIME'. For Volume Analysis, this could be 'NORMAL_VOLUME', 'HIGH_VOLUME', or 'SURGE'. The pattern values are specific to each observation type and indicate how the observed behavior relates to the baseline.","requirement":"recommended","caption":"Observed Pattern","type_name":"String"}},"name":"anomaly","description":"Describes an anomaly or deviation detected in a system. Anomalies are unexpected activity patterns that could indicate potential issues needing attention.","extends":"object","caption":"Anomaly"},"authentication_token":{"attributes":{"name":{"type":"string_t","description":"The human-friendly name of a token or key, if available, such as the name from the Okta API Token API.","requirement":"optional","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the authentication token.","requirement":"recommended","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The unique ID of a token or key, if available, such as the Secret ID of Entra ID Application Registration Client Secrets.","requirement":"optional","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"Identity (ID) Token for OIDC.","caption":"Identity Token"},"6":{"description":"Client Token issued by an Identity Provider (IdP) for application authentication. Use this value for IdP-issued tokens used for service-to-service authentication. Examples: Microsoft Entra ID Application Registration client secrets, Okta API tokens, Auth0 Machine-to-Machine tokens. Key characteristic: These tokens are issued by Identity Providers, not by individual services.","caption":"Client Token"},"0":{"description":"The Authentication token type is unknown.","caption":"Unknown"},"1":{"description":"Ticket Granting Ticket (TGT) for Kerberos.","caption":"Ticket Granting Ticket"},"2":{"description":"Service Ticket (ST) for Kerberos.","caption":"Service Ticket"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Refresh Token for OIDC.","caption":"Refresh Token"},"5":{"description":"Authentication Assertion for SAML.","caption":"SAML Assertion"},"7":{"description":"A generic API token or API key used for authenticating API requests. Use this value for service-specific API authentication tokens that are NOT issued by Identity Providers. Examples: REST API keys, GraphQL API keys, Stripe API keys, Twilio API keys, AWS API keys. Key characteristic: These tokens are issued by individual services/platforms, not by Identity Providers.","caption":"API Token"}},"description":"The normalized authentication token type identifier. This attribute restricts the base token.type_id enum to only protocol-specific authentication token types (values 0, 1-5, 99). API tokens and client tokens (values 6-7) are not valid for authentication_token - use the base token object for those types.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time that the authentication token was created or issued. This corresponds to the token issuance time, such as the iat (issued at) claim in OIDC tokens, the issue instant in SAML assertions, or the ticket start time in Kerberos tickets.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"encryption_details":{"type":"object_t","description":"The encryption details of the authentication token.","requirement":"recommended","object_type":"encryption_details","caption":"Encryption Details","object_name":"Encryption Details"},"expiration_time":{"type":"timestamp_t","description":"The expiration time of the authentication token.","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"is_renewable":{"type":"boolean_t","description":"Indicates whether the authentication token is renewable.","requirement":"optional","caption":"Renewable","type_name":"Boolean"},"kerberos_flags":{"type":"string_t","description":"A bitmask, either in hexadecimal or decimal form, which encodes various attributes or permissions associated with a Kerberos ticket. These flags delineate specific characteristics of the ticket, such as its renewability or forwardability.","references":[{"description":"RFC 4120: 5.2.8. KerberosFlags","url":"https://www.rfc-editor.org/rfc/rfc4120#section-5.2.8"},{"description":"Microsoft Windows Security 4769 (see 'Ticket Options')","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769"}],"requirement":"recommended","caption":"Kerberos Flags","type_name":"String"},"modified_time":{"type":"timestamp_t","description":"The last time the token was updated.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"tenant_uid":{"type":"string_t","description":"The unique identifier of the tenant or organization that owns the token or key, or the tenant context in which the token is authorized for use. This is particularly relevant in multi-tenant Identity Provider scenarios where tokens are scoped to specific tenants.","requirement":"optional","caption":"Tenant UID","type_name":"String"},"zone":{"type":"string_t","description":"The network zone or geographic region that the token or key is authorized to be used from. This may represent network-based access restrictions, geographic limitations, or other zone-based authorization policies. Examples include Okta's network zone restrictions or cloud provider region restrictions.","requirement":"optional","caption":"Network Zone","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time that the authentication token was created or issued. This corresponds to the token issuance time, such as the iat (issued at) claim in OIDC tokens, the issue instant in SAML assertions, or the ticket start time in Kerberos tickets.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration time of the authentication token.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The last time the token was updated.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"authentication_token","description":"The Authentication Token object extends the base token object and represents standardized authentication tokens, tickets, or assertions that conform to established authentication protocols such as Kerberos, OIDC, and SAML. This object inherits all attributes from token and adds protocol-specific attributes (e.g., kerberos_flags, encryption_details) for authentication events. Use this object in authentication events to represent protocol-specific tokens: Kerberos Ticket Granting Tickets (TGT) and Service Tickets (ST), OIDC Identity Tokens and Refresh Tokens, and SAML Assertions. These tokens are issued by authentication servers and identity providers and carry protocol-specific metadata, lifecycle information, and security attributes defined by their respective specifications. When to use this object: Use authentication_token when representing protocol-specific authentication tokens (type_id values 1-5: Kerberos TGT/ST, OIDC ID/Refresh tokens, SAML assertions) in authentication events. When NOT to use this object: Do NOT use authentication_token for API tokens or client tokens (type_id values 6-7) used in API activity events - use the base token object instead. Do NOT use authentication_token for generic API keys - use the base token object instead.","extends":"token","profiles":["datetime"],"caption":"Authentication Token"},"analysis_target":{"attributes":{"name":{"type":"string_t","description":"The specific name or identifier of the analysis target, such as the username of a User Account, the name of a Kubernetes Cluster, the identifier of a Network Namespace, or the name of an Application Component.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The category of the analysis target, such as User Account, Kubernetes Cluster, Network Namespace, or Application Component.","requirement":"optional","caption":"Type","type_name":"String"}},"name":"analysis_target","description":"The analysis target defines the scope of monitored activities, specifying what entity, system or process is analyzed for activity patterns.","caption":"Analysis Target"},"token":{"attributes":{"name":{"type":"string_t","description":"The human-friendly name of a token or key, if available, such as the name from the Okta API Token API.","requirement":"optional","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the token, normalized to the caption of the type_id value. This indicates whether the token is a Client Token, API Token, or one of the protocol-specific token types.","requirement":"recommended","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The unique ID of a token or key, if available, such as the Secret ID of Entra ID Application Registration Client Secrets.","requirement":"optional","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"Identity (ID) Token for OIDC.","caption":"Identity Token"},"6":{"description":"Client Token issued by an Identity Provider (IdP) for application authentication. Use this value for IdP-issued tokens used for service-to-service authentication. Examples: Microsoft Entra ID Application Registration client secrets, Okta API tokens, Auth0 Machine-to-Machine tokens. Key characteristic: These tokens are issued by Identity Providers, not by individual services.","caption":"Client Token"},"0":{"description":"The token type is unknown.","caption":"Unknown"},"1":{"description":"Ticket Granting Ticket (TGT) for Kerberos.","caption":"Ticket Granting Ticket"},"2":{"description":"Service Ticket (ST) for Kerberos.","caption":"Service Ticket"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Refresh Token for OIDC.","caption":"Refresh Token"},"5":{"description":"Authentication Assertion for SAML.","caption":"SAML Assertion"},"7":{"description":"A generic API token or API key used for authenticating API requests. Use this value for service-specific API authentication tokens that are NOT issued by Identity Providers. Examples: REST API keys, GraphQL API keys, Stripe API keys, Twilio API keys, AWS API keys. Key characteristic: These tokens are issued by individual services/platforms, not by Identity Providers.","caption":"API Token"}},"description":"The normalized token type identifier. Valid values: 0 (Unknown), 1 (Ticket Granting Ticket - Kerberos), 2 (Service Ticket - Kerberos), 3 (Identity Token - OIDC), 4 (Refresh Token - OIDC), 5 (SAML Assertion), 6 (Client Token - IdP-issued), 7 (API Token - generic API keys), 99 (Other).","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time that the token was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"expiration_time":{"type":"timestamp_t","description":"The expiration time of the token.","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"is_renewable":{"type":"boolean_t","description":"Indicates whether the token is renewable.","requirement":"optional","caption":"Renewable","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The last time the token was updated.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"tenant_uid":{"type":"string_t","description":"The unique identifier of the tenant or organization that owns the token or key, or the tenant context in which the token is authorized for use. This is particularly relevant in multi-tenant Identity Provider scenarios where tokens are scoped to specific tenants.","requirement":"optional","caption":"Tenant UID","type_name":"String"},"zone":{"type":"string_t","description":"The network zone or geographic region that the token or key is authorized to be used from. This may represent network-based access restrictions, geographic limitations, or other zone-based authorization policies. Examples include Okta's network zone restrictions or cloud provider region restrictions.","requirement":"optional","caption":"Network Zone","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time that the token was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration time of the token.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The last time the token was updated.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"token","description":"The Token object is the base object for representing tokens, API keys, and authentication credentials used across different contexts. This object provides common attributes for all token types, including protocol-specific authentication tokens (Kerberos, OIDC, SAML) and API/client tokens used for service authentication. When to use this object: Use the base token object directly in API activity events to represent API tokens, client tokens, or API keys used to authenticate API requests. Examples include: Okta API tokens, Microsoft Entra ID Application Registration client secrets, Stripe API keys, AWS API keys. When NOT to use this object: Do NOT use the base token object for protocol-specific authentication tokens in authentication events - use authentication_token instead (which extends this object). Do NOT use token for tracking credential lifecycle and usage patterns - use programmatic_credential instead.","extends":"object","profiles":["datetime"],"caption":"Token"},"load_balancer":{"attributes":{"code":{"type":"integer_t","description":"The numeric response status code detailing the connection from the load balancer to the destination target.","requirement":"recommended","caption":"Response Code","type_name":"Integer"},"message":{"type":"string_t","description":"The load balancer message.","requirement":"optional","caption":"Message","type_name":"String"},"name":{"type":"string_t","description":"The name of the load balancer.","requirement":"recommended","caption":"Name","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address of the load balancer node that handled the client request. Note: the load balancer may have other IP addresses, and this is not an IP address of the target/distribution endpoint - see dst_endpoint.","requirement":"optional","caption":"IP Address","type_name":"IP Address"},"uid":{"type":"string_t","description":"The unique identifier for the load balancer.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"metrics":{"type":"object_t","description":"General purpose metrics associated with the load balancer.","is_array":true,"requirement":"optional","object_type":"metric","caption":"Metrics","object_name":"Metric"},"classification":{"type":"string_t","description":"The request classification as defined by the load balancer.","requirement":"optional","caption":"Classification","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The destination to which the load balancer is distributing traffic.","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"endpoint_connections":{"type":"object_t","description":"An object detailing the load balancer connection attempts and responses.","is_array":true,"requirement":"recommended","object_type":"endpoint_connection","caption":"Endpoint Connections","object_name":"Endpoint Connection"},"error_message":{"type":"string_t","description":"The load balancer error message.","requirement":"optional","caption":"Error Message","type_name":"String"},"status_detail":{"type":"string_t","description":"The status detail contains additional status information about the load balancer distribution event.","requirement":"optional","caption":"Status Detail","type_name":"String"}},"name":"load_balancer","description":"The load balancer object describes the load balancer entity and contains additional information regarding the distribution of traffic across a network.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["container"],"caption":"Load Balancer"},"url":{"attributes":{"port":{"type":"port_t","description":"The URL port. For example: 80.","requirement":"recommended","caption":"Port","type_name":"Port"},"scheme":{"type":"string_t","description":"The scheme portion of the URL. For example: http, https, ftp, or sftp.","requirement":"recommended","caption":"Scheme","type_name":"String"},"path":{"type":"string_t","description":"The URL path as extracted from the URL. For example: /download/trouble from www.example.com/download/trouble.","requirement":"recommended","caption":"Path","type_name":"String"},"domain":{"type":"string_t","description":"The domain portion of the URL. For example: example.com in https://sub.example.com.","requirement":"optional","caption":"Domain","type_name":"String"},"hostname":{"type":"hostname_t","description":"The URL host as extracted from the URL. For example: www.example.com from www.example.com/download/trouble.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"query_string":{"type":"string_t","description":"The query portion of the URL. For example: the query portion of the URL http://www.example.com/search?q=bad&sort=date is q=bad&sort=date.","requirement":"recommended","caption":"HTTP Query String","type_name":"String"},"categories":{"type":"string_t","description":"The Website categorization names, as defined by category_ids enum values.","is_array":true,"requirement":"optional","caption":"Website Categorization","type_name":"String"},"category_ids":{"type":"integer_t","enum":{"30":{"caption":"Art/Culture"},"97":{"caption":"Content Servers"},"57":{"caption":"Remote Access Tools"},"38":{"caption":"Technology/Internet"},"63":{"caption":"Personal Sites"},"29":{"caption":"Charitable Organizations"},"83":{"caption":"Peer-to-Peer (P2P)"},"45":{"caption":"Job Search/Careers"},"40":{"caption":"Search Engines/Portals"},"112":{"caption":"Media Sharing"},"22":{"caption":"Alternative Spirituality/Belief"},"56":{"caption":"File Storage/Sharing"},"51":{"caption":"Chat (IM)/SMS"},"61":{"caption":"Society/Daily Living"},"101":{"caption":"Spam"},"47":{"caption":"Personals/Dating"},"96":{"caption":"Non-Viewable/Infrastructure"},"33":{"caption":"Games"},"59":{"caption":"Auctions"},"53":{"caption":"Newsgroups/Forums"},"1":{"caption":"Adult/Mature Content"},"99":{"description":"The Domain/URL category is not mapped. See the categories attribute, which contains a data source specific value.","caption":"Other"},"68":{"caption":"Humor/Jokes"},"92":{"caption":"Suspicious"},"20":{"caption":"Entertainment"},"54":{"caption":"Religion"},"107":{"caption":"Informational"},"3":{"caption":"Pornography"},"15":{"caption":"Weapons"},"34":{"caption":"Government/Legal"},"103":{"caption":"Dynamic DNS Host"},"50":{"caption":"Mixed Content/Potentially Adult"},"110":{"caption":"Internet Telephony"},"106":{"caption":"E-Card/Invitations"},"93":{"caption":"Sexual Expression"},"64":{"caption":"Restaurants/Dining/Food"},"25":{"caption":"Controlled Substances"},"86":{"caption":"Proxy Avoidance"},"87":{"caption":"For Kids"},"71":{"caption":"Software Downloads"},"49":{"caption":"Reference"},"37":{"caption":"Health"},"114":{"caption":"TV/Video Streams"},"121":{"caption":"Marijuana"},"118":{"caption":"Piracy/Copyright Concerns"},"98":{"caption":"Placeholders"},"16":{"caption":"Abortion"},"27":{"caption":"Education"},"7":{"caption":"Extreme"},"23":{"caption":"Alcohol"},"32":{"caption":"Brokerage/Trading"},"18":{"caption":"Phishing"},"36":{"caption":"Political/Social Advocacy"},"113":{"caption":"Radio/Audio Streams"},"90":{"caption":"Uncategorized"},"84":{"caption":"Audio/Video Clips"},"17":{"caption":"Hacking"},"26":{"caption":"Child Pornography"},"35":{"caption":"Military"},"4":{"caption":"Sex Education"},"65":{"caption":"Sports/Recreation"},"95":{"caption":"Translation"},"43":{"caption":"Malicious Sources/Malnets"},"21":{"caption":"Business/Economy"},"67":{"caption":"Vehicles"},"52":{"caption":"Email"},"14":{"caption":"Violence/Hate/Racism"},"85":{"caption":"Office/Business Applications"},"55":{"caption":"Social Networking"},"6":{"caption":"Nudity"},"0":{"description":"The Domain/URL category is unknown.","caption":"Unknown"},"44":{"caption":"Malicious Outbound Data/Botnets"},"11":{"caption":"Gambling"},"109":{"caption":"Internet Connected Devices"},"88":{"caption":"Web Ads/Analytics"},"9":{"caption":"Scam/Questionable/Illegal"},"5":{"caption":"Intimate Apparel/Swimsuit"},"31":{"caption":"Financial Services"},"60":{"caption":"Real Estate"},"89":{"caption":"Web Hosting"},"24":{"caption":"Tobacco"},"66":{"caption":"Travel"},"111":{"caption":"Online Meetings"},"102":{"caption":"Potentially Unwanted Software"},"46":{"caption":"News/Media"},"108":{"caption":"Computer/Information Security"},"58":{"caption":"Shopping"}},"description":"The Website categorization identifiers.","is_array":true,"requirement":"recommended","caption":"Website Categorization IDs","sibling":"categories","type_name":"Integer"},"resource_type":{"type":"string_t","description":"The context in which a resource was retrieved in a web request.","requirement":"optional","caption":"Resource Type","type_name":"String"},"subdomain":{"type":"string_t","description":"The subdomain portion of the URL. For example: sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com.","requirement":"optional","caption":"Subdomain","type_name":"String"},"url_string":{"type":"url_t","description":"The URL string. See RFC 1738. For example: http://www.example.com/download/trouble.exe. Note: The URL path should not populate the URL string.","requirement":"recommended","caption":"URL String","type_name":"URL String"}},"name":"url","description":"The Uniform Resource Locator (URL) object describes the characteristics of a URL.","extends":"object","constraints":{"at_least_one":["url_string","path"]},"references":[{"description":"Defined in RFC 1738","url":"https://datatracker.ietf.org/doc/html/rfc1738"},{"description":"D3FEND™ Ontology d3f:URL","url":"https://d3fend.mitre.org/dao/artifact/d3f:URL/"}],"caption":"Uniform Resource Locator","observable":23},"cis_csc":{"attributes":{"control":{"type":"string_t","description":"A Control is prescriptive, prioritized, and simplified set of best practices that one can use to strengthen their cybersecurity posture. e.g. AWS SecurityHub Controls, CIS Controls.","requirement":"required","caption":"Security Control","type_name":"String"},"version":{"type":"string_t","description":"The CIS critical security control version.","requirement":"recommended","caption":"Version","type_name":"String"}},"name":"cis_csc","description":"The CIS Critical Security Control (CSC) contains information as defined by the Center for Internet Security Critical Security Control (CIS CSC). Prioritized set of actions to protect your organization and data from cyber-attack vectors.","extends":"object","caption":"CIS CSC","@deprecated":{"message":"Use the cis_control object instead.","since":"1.5.0"}},"win/win_resource":{"attributes":{"data":{"type":"json_t","description":"Additional data describing the resource.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the resource object.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the Windows resource object.","requirement":"optional","caption":"Type","type_name":"String"},"uid":{"type":"resource_uid_t","description":"The Windows provided handle identifier for the resource object","requirement":"recommended","caption":"Unique ID","type_name":"Resource UID"},"labels":{"type":"string_t","description":"The list of labels associated to the resource.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"details":{"type":"string_t","description":"The string detailing the attributes of the resource object.","requirement":"optional","caption":"Details","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the resource.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"type_id":{"type":"integer_t","enum":{"30":{"caption":"Port"},"38":{"references":[{"description":"Atom Types","url":"https://learn.microsoft.com/en-us/windows/win32/dataxchg/about-atom-tables#atom-types"}],"caption":"Atom"},"29":{"references":[{"description":"Job objects and CreateJobObject Function","url":"https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects"}],"caption":"Job"},"40":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Callout"},"22":{"references":[{"description":"Desktop objects","url":"https://learn.microsoft.com/en-us/windows/win32/winstation/desktops"}],"caption":"Desktop"},"19":{"references":[{"description":"WMI Class Qualifiers","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/wmi-class-qualifiers"}],"caption":"WmiGuid"},"8":{"references":[{"description":"Access Tokens and Token objects","url":"https://learn.microsoft.com/en-us/windows/win32/secauthz/access-tokens"}],"caption":"Token"},"13":{"caption":"FilterCommunicationPort"},"33":{"references":[{"description":"Security Account Manager (SAM) objects","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sam"}],"caption":"SAM_ALIAS"},"10":{"references":[{"description":"Section object","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/section-objects-and-views"}],"caption":"Section"},"1":{"references":[{"description":"Object Manager Directory Objects","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/object-directories"}],"caption":"Directory"},"99":{"description":"The resource object type is not mapped. See the type attribute, which may contain a data source specific value.","caption":"Other"},"20":{"references":[{"description":"Process objects and CreateProcess Function","url":"https://learn.microsoft.com/en-us/windows/win32/procthread/creating-processes"}],"caption":"Process"},"3":{"references":[{"description":"Timer Objects and CreateWaitableTimer Function","url":"https://learn.microsoft.com/en-us/windows/win32/sync/waitable-timer-objects"}],"caption":"Timer"},"15":{"references":[{"description":"Driver objects","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/introduction-to-driver-objects"}],"caption":"Driver"},"34":{"references":[{"description":"Security Account Manager (SAM) objects","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sam"}],"caption":"SAM_GROUP"},"42":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Sub-layer"},"2":{"references":[{"description":"Event Objects and CreateEvent Function","url":"https://learn.microsoft.com/en-us/windows/win32/sync/event-objects"}],"caption":"Event"},"25":{"caption":"Key"},"37":{"references":[{"description":"Security Account Manager (SAM) Server","url":"https://learn.microsoft.com/en-us/windows/win32/adschema/c-samserver"}],"caption":"SAM_SERVER"},"16":{"references":[{"description":"I/O Completion Ports","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/i-o-completion-ports"}],"caption":"IoCompletion"},"39":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Filter"},"27":{"references":[{"description":"Callback objects","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/callback-objects"}],"caption":"Callback"},"7":{"references":[{"description":"File objects","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/file-objects"}],"caption":"File"},"23":{"references":[{"description":"NTAPI Keyed Events","url":"http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FKeyedEvent%2FNtCreateKeyedEvent.html"}],"caption":"KeyedEvent"},"32":{"references":[{"description":"Advanced Local Procedure Call (ALPC) Class","url":"https://learn.microsoft.com/en-us/windows/win32/etw/alpc"}],"caption":"ALPC Port"},"18":{"references":[{"description":"mklink function","url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mklink"}],"caption":"SymbolicLink"},"36":{"references":[{"description":"Security Account Manager (SAM) Domain","url":"https://learn.microsoft.com/en-us/windows/win32/adschema/c-samdomain"}],"caption":"SAM_DOMAIN"},"17":{"references":[{"description":"Controller objects","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/introduction-to-controller-objects"}],"caption":"Controller"},"26":{"caption":"WaitablePort"},"35":{"references":[{"description":"Security Account Manager (SAM) objects","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sam"}],"caption":"SAM_USER"},"4":{"references":[{"description":"Device Objects and I/O Manager","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/device-objects-and-device-stacks"}],"caption":"Device"},"43":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Provider"},"21":{"references":[{"description":"User Profile objects","url":"https://learn.microsoft.com/en-us/windows/win32/shell/user-profiles"}],"caption":"Profile"},"41":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Layer"},"14":{"caption":"EventPair"},"28":{"references":[{"description":"Semaphore objects and CreateSemaphore Function","url":"https://learn.microsoft.com/en-us/windows/win32/sync/semaphore-objects"}],"caption":"Semaphore"},"6":{"caption":"Type"},"0":{"description":"The resource object type is unknown.","caption":"Unknown"},"44":{"references":[{"description":"Windows Filtering Platform (WFP) Object Model","url":"https://learn.microsoft.com/en-us/windows/win32/fwp/object-model"}],"caption":"WFP Provider Context"},"11":{"references":[{"description":"Window Station objects","url":"https://learn.microsoft.com/en-us/windows/win32/winstation/window-stations"}],"caption":"WindowStation"},"9":{"references":[{"description":"Thread Objects and CreateThread Function","url":"https://learn.microsoft.com/en-us/windows/win32/procthread/creating-threads"}],"caption":"Thread"},"5":{"references":[{"description":"Mutex Objects and CreateMutex Function","url":"https://learn.microsoft.com/en-us/windows/win32/sync/mutex-objects"}],"caption":"Mutant"},"12":{"caption":"DebugObject"},"31":{"caption":"FilterConnectionPort"},"24":{"references":[{"description":"Adapter objects","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/adapter-objects-and-dma"}],"caption":"Adapter"}},"description":"The normalized type identifier of the Windows resource object accessed.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time when the resource was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"modified_time":{"type":"timestamp_t","description":"The time when the resource was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"svc_name":{"type":"string_t","description":"The Windows service acting as the object server for the resource object, such as Security or Security Account Manager.","requirement":"optional","caption":"Service Name","type_name":"String"},"uid_alt":{"type":"resource_uid_t","description":"The alternative unique identifier of the resource.","requirement":"optional","caption":"Alternate ID","type_name":"Resource UID"},"created_time_dt":{"type":"datetime_t","description":"The time when the resource was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the resource was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"win_resource","description":"The Windows resource object describes a resource object managed by Windows, such as mutant or timer.","extension":"win","extends":"_resource","constraints":{"at_least_one":["name","uid"]},"extension_id":2,"profiles":["data_classification","datetime"],"caption":"Windows Resource"},"service":{"attributes":{"name":{"type":"string_t","description":"The name of the service.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The version of the service.","requirement":"recommended","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the service.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"labels":{"type":"string_t","description":"The list of labels associated with the service.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the service.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"}},"name":"service","description":"The Service object describes characteristics of a service, e.g. AWS EC2. ","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:ServiceApplication.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ServiceApplication/"}],"caption":"Service"},"response":{"attributes":{"error":{"type":"string_t","description":"Error Code","requirement":"recommended","caption":"Error Code","type_name":"String"},"code":{"type":"integer_t","description":"The numeric response sent to a request.","requirement":"recommended","caption":"Response Code","type_name":"Integer"},"data":{"type":"json_t","description":"The additional data that is associated with the api response.","requirement":"optional","caption":"Data","type_name":"JSON"},"flags":{"type":"string_t","description":"The communication flags that are associated with the api response.","is_array":true,"requirement":"optional","caption":"Flags","type_name":"String"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","requirement":"recommended","caption":"Message","type_name":"String"},"containers":{"type":"object_t","description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application.","is_array":true,"requirement":"optional","object_type":"container","caption":"Containers","object_name":"Container"},"error_message":{"type":"string_t","description":"Error Message","requirement":"recommended","caption":"Error Message","type_name":"String"}},"name":"response","description":"The Response Elements object describes characteristics of an API response.","extends":"object","caption":"Response Elements"},"assessment":{"attributes":{"name":{"type":"string_t","description":"The name of the configuration or signal being assessed. For example: Kernel Mode Code Integrity (KMCI) or publicAccessibilityState.","requirement":"recommended","caption":"Name","type_name":"String"},"desc":{"type":"string_t","description":"The description of the assessment criteria, or a description of the specific configuration or signal the assessment is targeting.","requirement":"recommended","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the configuration or signal being assessed. For example: the signal_id.","requirement":"optional","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The category that the assessment is part of. For example: Prevention or Windows 10.","requirement":"optional","caption":"Category","type_name":"String"},"meets_criteria":{"type":"boolean_t","description":"Determines whether the assessment against the specific configuration or signal meets the assessments criteria. For example, if the assessment checks if a Datastore is encrypted or not, having encryption would be evaluated as true.","requirement":"required","caption":"Meets Criteria","type_name":"Boolean"},"policy":{"type":"object_t","description":"The details of any policy associated with an assessment.","requirement":"optional","object_type":"policy","caption":"Assessment Policy","object_name":"Policy"}},"name":"assessment","description":"The Assessment object describes a point-in-time assessment, check, or evaluation of a specific configuration or signal against an asset, entity, person, or otherwise. For example, this can encapsulate os_signals from CrowdStrike Falcon Zero Trust Assessments, or account for Datastore configurations from Cyera, or capture details of Microsoft Intune configuration policies.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Assessment"},"environment_variable":{"attributes":{"name":{"type":"string_t","description":"The name of the environment variable.","requirement":"required","caption":"Name","type_name":"String"},"value":{"type":"string_t","description":"The value of the environment variable.","requirement":"required","caption":"Value","type_name":"String"}},"name":"environment_variable","description":"An environment variable.","extends":"object","caption":"Environment Variable"},"database":{"attributes":{"name":{"type":"string_t","description":"The database name, ordinarily as assigned by a database administrator.","requirement":"recommended","caption":"Name","type_name":"String"},"size":{"type":"long_t","description":"The size of the database in bytes.","requirement":"optional","caption":"Size","type_name":"Long"},"type":{"type":"string_t","description":"The database type.","requirement":"recommended","caption":"Type","type_name":"String"},"desc":{"type":"string_t","description":"The description of the database.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the database.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"groups":{"type":"object_t","description":"The group names to which the database belongs.","is_array":true,"requirement":"optional","object_type":"group","caption":"Groups","object_name":"Group"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Object Oriented"},"6":{"caption":"NoSQL"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Relational"},"2":{"caption":"Network"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Centralized"},"5":{"caption":"Operational"},"7":{"caption":"Vector"},"8":{"caption":"Knowledge Graph"}},"description":"The normalized identifier of the database type.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time when the database was known to have been created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"embedding_model":{"type":"string_t","description":"Model used for creating embeddings (if applicable). For example: text-embedding-ada-002 or all-MiniLM-L6-v2.","requirement":"optional","caption":"Embedding Model","type_name":"String"},"modified_time":{"type":"timestamp_t","description":"The most recent time when any changes, updates, or modifications were made within the database.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"created_time_dt":{"type":"datetime_t","description":"The time when the database was known to have been created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The most recent time when any changes, updates, or modifications were made within the database.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"database","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:Database.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Database/"}],"profiles":["data_classification","datetime"],"caption":"Database"},"device":{"attributes":{"is_backed_up":{"type":"boolean_t","description":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the cloudBackupEnabled value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service.","requirement":"optional","caption":"Back Ups Configured","type_name":"Boolean"},"udid":{"type":"string_t","description":"The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS, tvOS, watchOS and visionOS devices, this is the UDID. For macOS devices, it is the Provisioning UDID. For example: 00008020-008D4548007B4F26","references":[{"description":"Apple Wiki","url":"https://theapplewiki.com/wiki/UDID"}],"requirement":"optional","caption":"Unique Device Identifier","type_name":"String"},"modified_time":{"type":"timestamp_t","description":"The time when the device was last known to have been modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"is_shared":{"type":"boolean_t","description":"The event occurred on a shared device.","requirement":"optional","caption":"Shared Device","type_name":"Boolean"},"boot_time":{"type":"timestamp_t","description":"The time the system was booted.","requirement":"optional","caption":"Boot Time","type_name":"Timestamp"},"zone":{"type":"string_t","description":"The network zone or LAN segment.","requirement":"optional","caption":"Network Zone","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":47},"os":{"type":"object_t","description":"The endpoint operating system.","requirement":"optional","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"vpc_uid":{"type":"string_t","description":"The unique identifier of the Virtual Private Cloud (VPC).","requirement":"optional","caption":"VPC UID","type_name":"String"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the endpoint or was last logged into it.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"subnet":{"type":"subnet_t","description":"The subnet mask.","requirement":"optional","caption":"Subnet","type_name":"Subnet"},"type":{"type":"string_t","description":"The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.","requirement":"recommended","caption":"Type","type_name":"String"},"is_compliant":{"type":"boolean_t","description":"The event occurred on a compliant device.","requirement":"optional","caption":"Compliant Device","type_name":"Boolean"},"imei":{"type":"string_t","description":"The International Mobile Equipment Identity that is associated with the device.","requirement":"optional","caption":"IMEI","type_name":"String","@deprecated":{"message":"Use the imei_list attribute instead.","since":"1.4.0"}},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","group":"context","requirement":"recommended","profiles":["container"],"object_type":"container","caption":"Container","object_name":"Container"},"imei_list":{"type":"string_t","description":"The International Mobile Equipment Identity values that are associated with the device.","is_array":true,"requirement":"optional","caption":"IMEI List","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A laptop computer.","caption":"Laptop"},"6":{"description":"A virtual machine.","caption":"Virtual"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A server.","caption":"Server"},"2":{"description":"A desktop computer.","caption":"Desktop"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A tablet computer.","caption":"Tablet"},"5":{"description":"A mobile phone.","caption":"Mobile"},"7":{"description":"An IOT (Internet of Things) device.","caption":"IOT"},"8":{"description":"A web browser.","caption":"Browser"},"9":{"description":"A networking firewall.","caption":"Firewall"},"10":{"description":"A networking switch.","caption":"Switch"},"11":{"description":"A networking hub.","caption":"Hub"},"12":{"description":"A networking router.","caption":"Router"},"14":{"description":"An intrusion prevention system.","caption":"IPS"},"15":{"description":"A Load Balancer device.","caption":"Load Balancer"},"13":{"description":"An intrusion detection system.","caption":"IDS"}},"description":"The device type ID.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"domain":{"type":"string_t","description":"The network domain where the device resides. For example: work.example.com.","requirement":"optional","caption":"Domain","type_name":"String"},"is_mobile_account_active":{"type":"boolean_t","description":"Indicates whether the device has an active mobile account. For example, this is indicated by the itunesStoreAccountActive value within JAMF Pro mobile devices.","requirement":"optional","caption":"Mobile Account Active","type_name":"Boolean"},"pool":{"type":"object_t","description":"The pool of desktops or virtual machines to which the endpoint belongs.","requirement":"optional","object_type":"group","caption":"Pool","object_name":"Group"},"interface_name":{"type":"string_t","description":"The name of the network interface (e.g. eth2).","requirement":"recommended","caption":"Network Interface Name","type_name":"String"},"modified_time_dt":{"type":"datetime_t","description":"The time when the device was last known to have been modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"is_managed":{"type":"boolean_t","description":"The event occurred on a managed device.","requirement":"optional","caption":"Managed Device","type_name":"Boolean"},"hypervisor":{"type":"string_t","description":"The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.","requirement":"optional","caption":"Hypervisor","type_name":"String"},"image":{"type":"object_t","description":"The image used as a template to run the virtual machine.","requirement":"optional","object_type":"image","caption":"Image","object_name":"Image"},"eid":{"type":"string_t","description":"An Embedded Identity Document, is a unique serial number that identifies an eSIM-enabled device.","requirement":"optional","caption":"EID","type_name":"String"},"last_seen_time":{"type":"timestamp_t","description":"The most recent discovery time of the device.","requirement":"optional","caption":"Last Seen","type_name":"Timestamp"},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","group":"context","requirement":"recommended","profiles":["container"],"caption":"Namespace PID","type_name":"Integer"},"model":{"type":"string_t","description":"The model of the device. For example ThinkPad X1 Carbon.","requirement":"optional","caption":"Model","type_name":"String"},"mac_vendor":{"type":"string_t","description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address.","references":[{"description":"IEEE Registration Authority","url":"https://standards.ieee.org/products-programs/regauth/"}],"requirement":"optional","caption":"MAC Vendor","type_name":"String"},"name":{"type":"string_t","description":"The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

","requirement":"optional","caption":"Name","type_name":"String"},"mac":{"type":"mac_t","description":"The Media Access Control (MAC) address of the endpoint.","requirement":"optional","caption":"MAC Address","type_name":"MAC Address"},"instance_uid":{"type":"string_t","description":"The unique identifier of a VM instance.","requirement":"recommended","caption":"Instance ID","type_name":"String"},"subnet_uid":{"type":"string_t","description":"The unique identifier of a virtual subnet.","requirement":"optional","caption":"Subnet UID","type_name":"String"},"is_trusted":{"type":"boolean_t","description":"The event occurred on a trusted device.","requirement":"optional","caption":"Trusted Device","type_name":"Boolean"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","requirement":"optional","caption":"Risk Level","type_name":"String"},"os_machine_uuid":{"type":"uuid_t","description":"The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid. In Linux, this is stored in the file: /etc/machine-id.","requirement":"optional","caption":"OS Machine UUID","type_name":"UUID"},"desc":{"type":"string_t","description":"The description of the device, ordinarily as reported by the operating system.","requirement":"optional","caption":"Description","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the device was known to have been created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"vlan_uid":{"type":"string_t","description":"The Virtual LAN identifier.","requirement":"optional","caption":"VLAN","type_name":"String"},"hostname":{"type":"hostname_t","description":"The device hostname.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"meid":{"type":"string_t","description":"The Mobile Equipment Identifier. It's a unique number that identifies a Code Division Multiple Access (CDMA) mobile device.","requirement":"optional","caption":"MEID","type_name":"String"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","requirement":"optional","caption":"Risk Score","type_name":"Integer"},"is_personal":{"type":"boolean_t","description":"The event occurred on a personal device.","requirement":"optional","caption":"Personal Device","type_name":"Boolean"},"first_seen_time":{"type":"timestamp_t","description":"The initial discovery time of the device.","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"boot_uid":{"type":"string_t","description":"A unique identifier of the device that changes after every reboot. For example, the value of /proc/sys/kernel/random/boot_id from Linux's procfs.","references":[{"description":"Linux kernel's documentation","url":"https://docs.kernel.org/admin-guide/sysctl/kernel.html#random"}],"requirement":"optional","caption":"Boot UID","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time when the device was known to have been created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"uid_alt":{"type":"string_t","description":"An alternate unique identifier of the device if any. For example the ActiveDirectory DN.","requirement":"optional","caption":"Alternate ID","type_name":"String"},"boot_time_dt":{"type":"datetime_t","description":"The time the system was booted.","requirement":"optional","profiles":["datetime"],"caption":"Boot Time","type_name":"Datetime"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","requirement":"optional","caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"is_supervised":{"type":"boolean_t","description":"The event occurred on a supervised device. Devices that are supervised are typically mobile devices managed by a Mobile Device Management solution and are restricted from specific behaviors such as Apple AirDrop.","requirement":"optional","caption":"Supervised Device","type_name":"Boolean"},"interface_uid":{"type":"string_t","description":"The unique identifier of the network interface.","requirement":"recommended","caption":"Network Interface ID","type_name":"String"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","requirement":"optional","object_type":"device_hw_info","caption":"Hardware Info","object_name":"Device Hardware Info"},"groups":{"type":"object_t","description":"The group names to which the device belongs. For example: [\"Windows Laptops\", \"Engineering\"].","is_array":true,"requirement":"optional","object_type":"group","caption":"Groups","object_name":"Group"},"last_seen_time_dt":{"type":"datetime_t","description":"The most recent discovery time of the device.","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"},"iccid":{"type":"string_t","description":"The Integrated Circuit Card Identification of a mobile device. Typically it is a unique 18 to 22 digit number that identifies a SIM card.","requirement":"optional","caption":"ICCID","type_name":"String"},"org":{"type":"object_t","description":"Organization and org unit related to the device.","requirement":"optional","object_type":"organization","caption":"Organization","object_name":"Organization"},"ip":{"type":"ip_t","description":"The device IP address, in either IPv4 or IPv6 format.","requirement":"optional","caption":"IP Address","type_name":"IP Address"},"network_interfaces":{"type":"object_t","description":"The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

","is_array":true,"requirement":"optional","object_type":"network_interface","caption":"Network Interfaces","object_name":"Network Interface"},"region":{"type":"string_t","description":"The region where the virtual machine is located. For example, an AWS Region.","requirement":"recommended","caption":"Region","type_name":"String"},"vendor_name":{"type":"string_t","description":"The vendor for the device. For example Dell or Lenovo.","requirement":"recommended","caption":"Vendor Name","type_name":"String"},"location":{"type":"object_t","description":"The geographical location of the device.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"first_seen_time_dt":{"type":"datetime_t","description":"The initial discovery time of the device.","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"autoscale_uid":{"type":"string_t","description":"The unique identifier of the cloud autoscale configuration.","requirement":"optional","caption":"Autoscale UID","type_name":"String"}},"name":"device","description":"The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.","extends":"endpoint","constraints":{"at_least_one":["ip","uid","name","hostname","instance_uid","interface_uid","interface_name"]},"references":[{"description":"D3FEND™ Ontology d3f:Host.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Host/"}],"profiles":["container","datetime"],"caption":"Device","observable":20},"d3f_technique":{"attributes":{"name":{"type":"string_t","description":"The name of the defensive technique. For example: IO Port Restriction.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the defensive technique. For example: D3-IOPR.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"src_url":{"type":"url_t","description":"The versioned permalink of the defensive technique. For example: https://d3fend.mitre.org/technique/d3f:IOPortRestriction/.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"d3f_technique","description":"The MITRE D3FEND™ Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Matrix","url":"href='https://d3fend.mitre.org"}],"caption":"MITRE D3FEND™ Technique"},"cis_control":{"attributes":{"name":{"type":"string_t","description":"The CIS Control name. For example: 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software.","requirement":"required","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The CIS Control version. For example: v8.","requirement":"recommended","caption":"Version","type_name":"String"},"desc":{"type":"string_t","description":"The CIS Control description. For example: Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.","requirement":"optional","caption":"Description","type_name":"String"}},"name":"cis_control","description":"The CIS Control (aka Critical Security Control) object describes a prioritized set of actions to protect your organization and data from cyber-attack vectors. The CIS Controls are defined by the Center for Internet Security.","extends":"object","caption":"CIS Control"},"cve":{"attributes":{"type":{"type":"string_t","description":"

The vulnerability type as selected from a large dropdown menu during CVE refinement.

Most frequently used vulnerability types are: DoS, Code Execution, Overflow, Memory Corruption, Sql Injection, XSS, Directory Traversal, Http Response Splitting, Bypass something, Gain Information, Gain Privileges, CSRF, File Inclusion. For more information see Vulnerabilities By Type distributions.","requirement":"recommended","caption":"Vulnerability Type","type_name":"String"},"title":{"type":"string_t","description":"A title or a brief phrase summarizing the CVE record.","requirement":"recommended","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"The product where the vulnerability was discovered.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"desc":{"type":"string_t","description":"A brief description of the CVE Record.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: CVE-2021-12345.","requirement":"required","caption":"CVE ID","type_name":"String","observable":18},"references":{"type":"string_t","description":"A list of reference URLs with additional information about the CVE Record.","is_array":true,"requirement":"recommended","caption":"References","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"cvss":{"type":"object_t","description":"The CVSS object details Common Vulnerability Scoring System (CVSS) scores from the advisory that are related to the vulnerability.","is_array":true,"requirement":"recommended","object_type":"cvss","caption":"CVSS Score","object_name":"CVSS Score"},"cwe":{"type":"object_t","description":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the Common Weakness Enumeration (CWE) catalog.","requirement":"optional","object_type":"cwe","caption":"CWE","@deprecated":{"message":"Use related_cwes attribute instead.","since":"1.4.0"},"object_name":"CWE"},"cwe_uid":{"type":"string_t","description":"The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.","requirement":"optional","caption":"CWE UID","type_name":"String","@deprecated":{"message":"Use the related_cwes object attributes instead.","since":"1.1.0"}},"cwe_url":{"type":"url_t","description":"Common Weakness Enumeration (CWE) definition URL. For example: https://cwe.mitre.org/data/definitions/787.html.","requirement":"optional","caption":"CWE URL","type_name":"URL String","@deprecated":{"message":"Use the related_cwes object attributes instead.","since":"1.1.0"}},"epss":{"type":"object_t","description":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. (EPSS).","requirement":"optional","object_type":"epss","caption":"EPSS","object_name":"EPSS"},"modified_time":{"type":"timestamp_t","description":"The Record Modified Date identifies when the CVE record was last updated.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"related_cwes":{"type":"object_t","description":"Describes the Common Weakness Enumeration (CWE) details related to the CVE Record.","is_array":true,"requirement":"optional","object_type":"cwe","caption":"Related CWEs","object_name":"CWE"},"created_time_dt":{"type":"datetime_t","description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The Record Modified Date identifies when the CVE record was last updated.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"cve","description":"The Common Vulnerabilities and Exposures (CVE) object represents publicly disclosed cybersecurity vulnerabilities defined in CVE Program catalog (CVE). There is one CVE Record for each vulnerability in the catalog.","extends":"object","profiles":["data_classification","datetime"],"caption":"CVE"},"osint":{"attributes":{"modified_time":{"type":"timestamp_t","description":"The timestamp of the last modification or update to the indicator.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"vulnerabilities":{"type":"object_t","description":"Any vulnerabilities related to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","object_type":"vulnerability","caption":"Related Vulnerabilities","object_name":"Vulnerability Details"},"uid":{"type":"string_t","description":"The unique identifier for the OSINT object.","requirement":"optional","caption":"Unique ID","type_name":"String"},"threat_actor":{"type":"object_t","description":"A threat actor is an individual or group that conducts malicious cyber activities, often with financial, political, or ideological motives.","references":[{"description":"STIX Threat Actor definition","url":"https://stixproject.github.io/data-model/1.2/ta/ThreatActorType/"}],"requirement":"optional","object_type":"threat_actor","caption":"Threat Actor","object_name":"Threat Actor"},"expiration_time":{"type":"timestamp_t","description":"The expiration date of the indicator, after which it is no longer considered reliable.","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"category":{"type":"string_t","description":"Categorizes the threat indicator based on its functional or operational role.","requirement":"optional","caption":"Category","type_name":"String"},"email":{"type":"object_t","description":"Any email information pertinent to an indicator or OSINT analysis.","requirement":"optional","object_type":"email","caption":"Related Email","object_name":"Email"},"kill_chain":{"type":"object_t","description":"Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","object_type":"kill_chain_phase","caption":"Kill Chain","object_name":"Kill Chain Phase"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","is_array":true,"requirement":"optional","object_type":"malware","caption":"Malware","object_name":"Malware"},"script":{"type":"object_t","description":"Any pertinent script information related to an indicator or OSINT analysis.","requirement":"optional","object_type":"script","caption":"Related Script Data","object_name":"Script"},"subnet":{"type":"subnet_t","description":"A CIDR or network block related to an indicator or OSINT analysis.","requirement":"optional","caption":"Related Subnet","type_name":"Subnet"},"type":{"type":"string_t","description":"The OSINT indicator type.","requirement":"optional","caption":"Type","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A hostname or computer name.","caption":"Hostname"},"6":{"description":"A User Agent typically seen in HTTP request headers.","caption":"User Agent"},"0":{"description":"The indicator type is ambiguous or there is not a related indicator for the OSINT object.","caption":"Unknown"},"1":{"description":"An IPv4 or IPv6 address.","caption":"IP Address"},"2":{"description":"A full-qualified domain name (FQDN), subdomain, or partial domain.","caption":"Domain"},"99":{"description":"The indicator type is not directly listed.","caption":"Other"},"4":{"description":"Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP, VHASH, etc. generated from a file, malware sample, request header, or otherwise used to identify a pertinent artifact.","caption":"Hash"},"5":{"description":"A Uniform Resource Locator (URL) or Uniform Resource Indicator (URI).","caption":"URL"},"7":{"description":"The serial number, fingerprint, or full content of an X.509 digital certificate.","caption":"Digital Certificate"},"8":{"description":"The contents of an email or any related information to an email object.","caption":"Email"},"9":{"description":"An email address.","caption":"Email Address"},"10":{"description":"A CVE ID, CWE ID, or other identifier for a weakness, exploit, bug, or misconfiguration.","caption":"Vulnerability"},"11":{"description":"A file or metadata about a file.","caption":"File"},"12":{"description":"A Windows Registry Key.","caption":"Registry Key"},"14":{"description":"A partial or full Command Line used to invoke scripts or other remote commands.","caption":"Command Line"},"13":{"description":"A Windows Registry Value.","caption":"Registry Value"}},"description":"The OSINT indicator type ID.","requirement":"required","caption":"Indicator Type ID","sibling":"type","type_name":"Integer"},"detection_pattern_type":{"type":"string_t","description":"The detection pattern type, normalized to the caption of the detection_pattern_type_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Detection Pattern","type_name":"String"},"modified_time_dt":{"type":"datetime_t","description":"The timestamp of the last modification or update to the indicator.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"labels":{"type":"string_t","description":"Tags or keywords associated with the indicator to enhance searchability.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"detection_pattern":{"type":"string_t","description":"The specific detection pattern or signature associated with the indicator.","requirement":"optional","caption":"Detection Pattern","type_name":"String"},"signatures":{"type":"object_t","description":"Any digital signatures or hashes related to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","object_type":"digital_signature","caption":"Related Digital Signatures","object_name":"Digital Signature"},"name":{"type":"string_t","description":"The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name.","requirement":"optional","caption":"Name","type_name":"String"},"intrusion_sets":{"type":"string_t","description":"A grouping of adversarial behaviors and resources believed to be associated with specific threat actors or campaigns. Intrusion sets often encompass multiple campaigns and are used to organize related activities under a common label.","is_array":true,"requirement":"optional","caption":"Intrusion Sets","type_name":"String"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious.","requirement":"recommended","caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"attacks":{"type":"object_t","description":"MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis.","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"uploaded_time_dt":{"type":"datetime_t","description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository.","requirement":"optional","profiles":["datetime"],"caption":"Uploaded Time","type_name":"Datetime"},"references":{"type":"string_t","description":"Provides a reference to an external source of information related to the CTI being represented. This may include a URL, a document, or some other type of reference that provides additional context or information about the CTI.","is_array":true,"requirement":"optional","caption":"References","type_name":"String"},"answers":{"type":"object_t","description":"Any pertinent DNS answers information related to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","object_type":"dns_answer","caption":"Related DNS Answers","object_name":"DNS Answer"},"desc":{"type":"string_t","description":"A detailed explanation of the indicator, including its context, purpose, and relevance.","requirement":"optional","caption":"Description","type_name":"String"},"src_url":{"type":"url_t","description":"The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"created_time":{"type":"timestamp_t","description":"The timestamp when the indicator was initially created or identified.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"campaign":{"type":"object_t","description":"The campaign object describes details about the campaign that was the source of the activity.","requirement":"optional","object_type":"campaign","caption":"Campaign","object_name":"Campaign"},"risk_score":{"type":"integer_t","description":"A numerical representation of the threat indicator’s risk level.","requirement":"optional","caption":"Risk Score","type_name":"Integer"},"created_time_dt":{"type":"datetime_t","description":"The timestamp when the indicator was initially created or identified.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"autonomous_system":{"type":"object_t","description":"Any pertinent autonomous system information related to an indicator or OSINT analysis.","requirement":"optional","object_type":"autonomous_system","caption":"Autonomous System","object_name":"Autonomous System"},"uploaded_time":{"type":"timestamp_t","description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository.","requirement":"optional","caption":"Uploaded Time","type_name":"Timestamp"},"subdomains":{"type":"string_t","description":"Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","caption":"Related Subdomains","type_name":"String"},"whois":{"type":"object_t","description":"Any pertinent WHOIS information related to an indicator or OSINT analysis.","requirement":"optional","object_type":"whois","caption":"WHOIS","object_name":"WHOIS"},"reputation":{"type":"object_t","description":"Related reputational analysis from third-party engines and analysts for a given indicator or OSINT analysis.","requirement":"optional","object_type":"reputation","caption":"Reputation Scores","object_name":"Reputation"},"value":{"type":"string_t","description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name.","requirement":"required","caption":"Indicator","type_name":"String"},"detection_pattern_type_id":{"type":"integer_t","enum":{"3":{"caption":"SIGMA"},"6":{"caption":"YARA"},"0":{"description":"The type is not mapped.","caption":"Unknown"},"1":{"caption":"STIX"},"2":{"caption":"PCRE"},"99":{"description":"The detection pattern type is not mapped. See the detection_pattern_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Snort"},"5":{"caption":"Suricata"}},"description":"Specifies the type of detection pattern used to identify the associated threat indicator.","requirement":"optional","caption":"Detection Pattern Type ID","sibling":"detection_pattern_type","type_name":"Integer"},"creator":{"type":"object_t","description":"The identifier of the user, system, or organization that contributed the indicator.","requirement":"optional","object_type":"user","caption":"Creator","object_name":"User"},"tlp":{"type":"string_t","enum":{"AMBER":{"description":"TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT.","caption":"TLP:AMBER"},"AMBER STRICT":{"description":"TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT.","caption":"TLP:AMBER+STRICT"},"CLEAR":{"description":"TLP:CLEAR denotes that recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction.","caption":"TLP:CLEAR"},"GREEN":{"description":"TLP:GREEN is for limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: when “community” is not defined, assume the cybersecurity/defense community.","caption":"TLP:GREEN"},"RED":{"description":"TLP:RED is for the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting.","caption":"TLP:RED"},"WHITE":{"description":"TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is the most up to date (as of TLP 2.0) usage.","caption":"TLP:WHITE"}},"description":"The Traffic Light Protocol was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared.","requirement":"recommended","caption":"Traffic Light Protocol","type_name":"String"},"email_auth":{"type":"object_t","description":"Any email authentication information pertinent to an indicator or OSINT analysis.","requirement":"optional","object_type":"email_auth","caption":"Related Email Authentication","object_name":"Email Authentication"},"confidence":{"type":"string_t","description":"The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst.","requirement":"optional","caption":"Confidence","type_name":"String"},"comment":{"type":"string_t","description":"Analyst commentary or source commentary about an indicator or OSINT analysis.","requirement":"optional","caption":"Analyst Comments","type_name":"String"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration date of the indicator, after which it is no longer considered reliable.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"},"related_analytics":{"type":"object_t","description":"Any analytics related to an indicator or OSINT analysis.","is_array":true,"requirement":"optional","object_type":"analytic","caption":"Related Analytics","object_name":"Analytic"},"external_uid":{"type":"string_t","description":"A unique identifier assigned by an external system for cross-referencing.","requirement":"optional","caption":"External ID","type_name":"String"},"vendor_name":{"type":"string_t","description":"The vendor name of a tool which generates intelligence or provides indicators.","requirement":"optional","caption":"Vendor Name","type_name":"String"},"location":{"type":"object_t","description":"Any pertinent geolocation information related to an indicator or OSINT analysis.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"file":{"type":"object_t","description":"Any pertinent file information related to an indicator or OSINT analysis.","requirement":"optional","object_type":"file","caption":"Related File","object_name":"File"},"severity":{"type":"string_t","description":"Represents the severity level of the threat indicator, typically reflecting its potential impact or damage.","requirement":"optional","caption":"Severity","type_name":"String"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"The normalized severity level of the threat indicator, typically reflecting its potential impact or damage.","requirement":"optional","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"osint","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","extends":"object","profiles":["data_classification","datetime"],"caption":"OSINT"},"tls":{"attributes":{"version":{"type":"string_t","description":"The TLS protocol version.","requirement":"required","caption":"Version","type_name":"String"},"alert":{"type":"integer_t","description":"The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246.","requirement":"optional","caption":"Client TLS Alert","type_name":"Integer"},"key_length":{"type":"integer_t","description":"The length of the encryption key.","requirement":"optional","caption":"Key Length","type_name":"Integer"},"certificate":{"type":"object_t","description":"The certificate object containing information about the digital certificate.","requirement":"recommended","object_type":"certificate","caption":"Certificate","object_name":"Digital Certificate"},"cipher":{"type":"string_t","description":"The negotiated cipher suite.","requirement":"recommended","caption":"Cipher Suite","type_name":"String"},"sni":{"type":"string_t","description":" The Server Name Indication (SNI) extension sent by the client.","requirement":"recommended","caption":"Server Name Indication","type_name":"String"},"certificate_chain":{"type":"string_t","description":"The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer.","is_array":true,"requirement":"recommended","caption":"Certificate Chain","type_name":"String"},"client_ciphers":{"type":"string_t","description":"The client cipher suites that were exchanged during the TLS handshake negotiation.","is_array":true,"requirement":"recommended","caption":"Client Cipher Suites","type_name":"String"},"extension_list":{"type":"object_t","description":"The list of TLS extensions.","is_array":true,"requirement":"optional","object_type":"tls_extension","caption":"Extension List","@deprecated":{"message":"Use the tls_extension_list attribute instead.","since":"1.1.0"},"object_name":"TLS Extension"},"handshake_dur":{"type":"integer_t","description":"The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds.","requirement":"optional","caption":"Handshake Duration","type_name":"Integer"},"ja3_hash":{"type":"object_t","description":"The MD5 hash of a JA3 string.","requirement":"recommended","object_type":"fingerprint","caption":"JA3 Hash","object_name":"Fingerprint"},"ja3s_hash":{"type":"object_t","description":"The MD5 hash of a JA3S string.","requirement":"recommended","object_type":"fingerprint","caption":"JA3S Hash","object_name":"Fingerprint"},"sans":{"type":"object_t","description":"The list of subject alternative names that are secured by a specific certificate.","is_array":true,"requirement":"optional","object_type":"san","caption":"Subject Alternative Names","@deprecated":{"message":"Use tls.certificate.sans attribute instead.","since":"1.4.0"},"object_name":"Subject Alternative Name"},"server_ciphers":{"type":"string_t","description":"The server cipher suites that were exchanged during the TLS handshake negotiation.","is_array":true,"requirement":"optional","caption":"Server Cipher Suites","type_name":"String"},"tls_extension_list":{"type":"object_t","description":"The list of TLS extensions.","is_array":true,"requirement":"optional","object_type":"tls_extension","caption":"TLS Extension List","object_name":"TLS Extension"}},"name":"tls","description":"The Transport Layer Security (TLS) object describes the negotiated TLS protocol used for secure communications over an establish network connection.","extends":"object","caption":"Transport Layer Security (TLS)"},"actor":{"attributes":{"process":{"type":"object_t","description":"The process that initiated the activity.","requirement":"recommended","object_type":"process","caption":"Process","object_name":"Process"},"session":{"type":"object_t","description":"The user session from which the activity was initiated.","requirement":"optional","object_type":"session","caption":"Session","object_name":"Session"},"user":{"type":"object_t","description":"The user that initiated the activity or the user context from which the activity was initiated.","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"app_name":{"type":"string_t","description":"The client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process if present.","requirement":"optional","caption":"Application Name","type_name":"String"},"app_uid":{"type":"string_t","description":"The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process.pid or process.uid if present.","requirement":"optional","caption":"Application ID","type_name":"String"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","is_array":true,"requirement":"optional","object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"idp":{"type":"object_t","description":"This object describes details about the Identity Provider used.","requirement":"optional","object_type":"idp","caption":"Identity Provider","object_name":"Identity Provider"},"invoked_by":{"type":"string_t","description":"The name of the service that invoked the activity as described in the event.","requirement":"optional","caption":"Invoked by","type_name":"String","@deprecated":{"message":"Use app_name, app_uid attributes instead.","since":"1.2.0"}}},"name":"actor","description":"The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.","extends":"object","constraints":{"at_least_one":["process","user","invoked_by","session","app_name","app_uid"]},"references":[{"description":"D3FEND™ Ontology d3f:Agent.","url":"https://next.d3fend.mitre.org/agent/d3f:Agent/"}],"profiles":["container","data_classification","linux/linux_users","macos/macos_users"],"caption":"Actor"},"cis_benchmark_result":{"attributes":{"name":{"type":"string_t","description":"The CIS benchmark name.","requirement":"required","caption":"Name","type_name":"String"},"desc":{"type":"string_t","description":"The CIS benchmark description.","requirement":"optional","caption":"Description","type_name":"String"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"rule":{"type":"object_t","description":"The CIS benchmark rule.","requirement":"optional","object_type":"rule","caption":"Rule","object_name":"Rule"}},"name":"cis_benchmark_result","description":"The CIS Benchmark Result object contains information as defined by the Center for Internet Security (CIS) benchmark result. CIS Benchmarks are a collection of best practices for securely configuring IT systems, software, networks, and cloud infrastructure.","extends":"object","profiles":["data_classification"],"caption":"CIS Benchmark Result","@deprecated":{"message":"Use the Compliance object with Checks object instead.","since":"1.5.0"}},"transformation_info":{"attributes":{"name":{"type":"string_t","description":"The name of the transformation or mapping.","requirement":"recommended","caption":"Name","type_name":"String"},"time":{"type":"timestamp_t","description":"Time of the transformation.","requirement":"recommended","caption":"Event Time","type_name":"Timestamp"},"product":{"type":"object_t","description":"The product or instance used to make the transformation","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"uid":{"type":"string_t","description":"The unique identifier of the mapping or transformation.","requirement":"optional","caption":"Unique ID","type_name":"String"},"lang":{"type":"string_t","description":"The transformation language used to transform the data.","requirement":"optional","caption":"Language","type_name":"String"},"url_string":{"type":"url_t","description":"The Uniform Resource Locator String where the mapping or transformation exists.","requirement":"recommended","caption":"URL String","type_name":"URL String"},"time_dt":{"type":"datetime_t","description":"Time of the transformation.","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"}},"name":"transformation_info","description":"The transformation_info object represents the mapping or transformation used.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["data_classification","datetime"],"caption":"Transformation Info"},"domain_contact":{"attributes":{"name":{"type":"string_t","description":"The individual or organization name for the contact.","requirement":"optional","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The Domain Contact type, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source","requirement":"optional","caption":"Domain Contact Type","type_name":"String"},"location":{"type":"object_t","description":"Location details for the contract such as the city, state/province, country, etc.","requirement":"recommended","object_type":"location","caption":"Contact Location Information","object_name":"Geo Location"},"uid":{"type":"string_t","description":"The unique identifier of the contact information, typically provided in WHOIS information.","requirement":"optional","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"The contact information provided is for the domain technical lead.","caption":"Technical"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The contact information provided is for the domain registrant.","caption":"Registrant"},"2":{"description":"The contact information provided is for the domain administrator.","caption":"Administrative"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The contact information provided is for the domain billing lead.","caption":"Billing"},"5":{"description":"The contact information provided is for the domain abuse contact.","caption":"Abuse"}},"description":"The normalized domain contact type ID.","requirement":"required","caption":"Domain Contact Type ID","sibling":"type","type_name":"Integer"},"email_addr":{"type":"email_t","description":"The user's primary email address.","requirement":"recommended","caption":"Contact Email","type_name":"Email Address"},"phone_number":{"type":"string_t","description":"The number associated with the phone.","requirement":"optional","caption":"Phone Number","type_name":"String"}},"name":"domain_contact","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","extends":"object","caption":"Domain Contact"},"programmatic_credential":{"attributes":{"type":{"type":"string_t","description":"The type or category of programmatic credential, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source. Examples include 'API Key', 'Service Account Key', 'Access Token', 'Client Certificate', 'OAuth Token', 'Personal Access Token', etc.","requirement":"recommended","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the programmatic credential. This could be an API key ID, service account key ID, access token identifier, certificate serial number, or other unique identifier that distinguishes this credential from others. Examples: AWS Access Key ID, GCP Service Account Key ID, Azure Application ID, or OAuth2 token identifier.","requirement":"required","caption":"Unique ID","type_name":"String"},"last_used_time":{"type":"timestamp_t","description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential.","requirement":"optional","caption":"Last Used Time","type_name":"Timestamp"},"last_used_time_dt":{"type":"datetime_t","description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential.","requirement":"optional","profiles":["datetime"],"caption":"Last Used Time","type_name":"Datetime"}},"name":"programmatic_credential","description":"The Programmatic Credential object describes service-specific credentials used for direct API access and system integration. These credentials are typically issued by individual services or platforms for accessing their APIs and resources, focusing on credential lifecycle management and usage tracking. Examples include API keys, service account keys, client certificates, and vendor-specific access tokens.","extends":"object","profiles":["datetime"],"caption":"Programmatic Credential"},"dns_answer":{"attributes":{"flags":{"type":"string_t","description":"The list of DNS answer header flags.","is_array":true,"requirement":"optional","caption":"DNS Header Flags","type_name":"String"},"type":{"type":"string_t","description":"The type of data contained in this resource record. See RFC1035. For example: CNAME.","requirement":"recommended","caption":"Resource Record Type","type_name":"String"},"ttl":{"type":"integer_t","description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached.","requirement":"recommended","caption":"TTL","type_name":"Integer"},"class":{"type":"string_t","description":"The class of DNS data contained in this resource record. See RFC1035. For example: IN.","requirement":"recommended","caption":"Resource Record Class","type_name":"String"},"flag_ids":{"type":"integer_t","enum":{"3":{"caption":"Recursion Desired"},"6":{"caption":"Checking Disabled"},"0":{"description":"The flag is unknown.","caption":"Unknown"},"1":{"caption":"Authoritative Answer"},"2":{"caption":"Truncated Response"},"99":{"description":"The flag is not mapped. See the flags attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Recursion Available"},"5":{"caption":"Authentic Data"}},"description":"The list of DNS answer header flag IDs.","is_array":true,"requirement":"recommended","caption":"DNS Header Flags","sibling":"flags","type_name":"Integer"},"packet_uid":{"type":"integer_t","description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.","requirement":"recommended","caption":"Packet UID","type_name":"Integer"},"rdata":{"type":"string_t","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record.","requirement":"required","caption":"DNS RData","type_name":"String"}},"name":"dns_answer","description":"The DNS Answer object represents a specific response provided by the Domain Name System (DNS) when querying for information about a domain or performing a DNS operation. It encapsulates the relevant details and data returned by the DNS server in response to a query.","extends":"_dns","references":[{"description":"D3FEND™ Ontology d3f:InboundInternetDNSResponseTraffic.","url":"https://d3fend.mitre.org/dao/artifact/d3f:InboundInternetDNSResponseTraffic/"}],"caption":"DNS Answer"},"metric":{"attributes":{"name":{"type":"string_t","description":"The name of the metric.","requirement":"required","caption":"Name","type_name":"String"},"value":{"type":"string_t","description":"The value of the metric.","requirement":"required","caption":"Value","type_name":"String"}},"name":"metric","description":"The Metric object defines a simple name/value pair entity for a metric.","extends":"object","caption":"Metric"},"data_classification":{"attributes":{"size":{"type":"long_t","description":"Size of the data classified.","requirement":"optional","caption":"Size","type_name":"Long"},"status":{"type":"string_t","description":"The resultant status of the classification job normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","requirement":"recommended","caption":"Status","type_name":"String"},"total":{"type":"integer_t","description":"The total count of discovered entities, by the classification job.","requirement":"optional","caption":"Total","type_name":"Integer"},"uid":{"type":"string_t","description":"The unique identifier of the classification job.","requirement":"optional","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The name of the data classification category that data matched into, e.g. Financial, Personal, Governmental, etc.","requirement":"optional","caption":"Category","type_name":"String"},"category_id":{"type":"integer_t","enum":{"3":{"description":"Any financially-related sensitive information or Cardholder Data (CHD). E.g., banking account numbers, credit card numbers, International Banking Account Numbers (IBAN), SWIFT codes, etc.","caption":"Financial"},"6":{"description":"Any sensitive security-related data such as passwords, passkeys, IP addresses, API keys, credentials and similar secrets. E.g., AWS Access Secret Key, SaaS API Keys, user passwords, database credentials, etc.","caption":"Security"},"0":{"description":"The type is not mapped. See the data_type attribute, which contains a data source specific value.","caption":"Unknown"},"1":{"description":"Any Personally Identifiable Information (PII), Electronic Personal Health Information (ePHI), or similarly personal information. E.g., full name, home address, date of birth, etc.","caption":"Personal"},"2":{"description":"Any sensitive government identification number related to a person or other classified material. E.g., Passport numbers, driver license numbers, business identification, taxation identifiers, etc.","caption":"Governmental"},"99":{"description":"Any other type of data classification or a multi-variate classification made up of several other classification categories.","caption":"Other"},"4":{"description":"Any business-specific sensitive data such as intellectual property, trademarks, copyrights, human resource data, Board of Directors meeting minutes, and similar.","caption":"Business"},"5":{"description":"Any mission-specific sensitive data for military, law enforcement, or other government agencies such as specifically classified data, weapon systems information, or other planning data.","caption":"Military and Law Enforcement"}},"description":"The normalized identifier of the data classification category.","requirement":"recommended","caption":"Category ID","sibling":"category","type_name":"Integer"},"classifier_details":{"type":"object_t","description":"Describes details about the classifier used for data classification.","requirement":"recommended","object_type":"classifier_details","caption":"Classifier Details","object_name":"Classifier Details"},"confidentiality":{"type":"string_t","description":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Confidentiality","type_name":"String"},"confidentiality_id":{"type":"integer_t","enum":{"3":{"caption":"Secret"},"6":{"caption":"Restricted"},"0":{"description":"The confidentiality is unknown.","caption":"Unknown"},"1":{"caption":"Not Confidential"},"2":{"caption":"Confidential"},"99":{"description":"The confidentiality is not mapped. See the confidentiality attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Top Secret"},"5":{"caption":"Private"}},"description":"The normalized identifier of the file content confidentiality indicator.","requirement":"recommended","caption":"Confidentiality ID","sibling":"confidentiality","type_name":"Integer"},"discovery_details":{"type":"object_t","description":"Details about the data discovered by classification job.","is_array":true,"requirement":"optional","object_type":"discovery_details","caption":"Discovery Details","object_name":"Discovery Details"},"policy":{"type":"object_t","description":"Details about the data policy that governs data handling and security measures related to classification.","requirement":"optional","object_type":"policy","caption":"Policy","object_name":"Policy"},"src_url":{"type":"url_t","description":"The source URL pointing towards the full classification job details.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"status_details":{"type":"string_t","description":"The contextual description of the status, status_id value.","is_array":true,"requirement":"optional","caption":"Status Details","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The classification job failed for the evaluated resource.","caption":"Fail"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The classification job completed for the evaluated resource.","caption":"Complete"},"2":{"description":"The classification job partially completed for the evaluated resource.","caption":"Partial"},"99":{"description":"The classification job type id is not mapped.","caption":"Other"}},"description":"The normalized status identifier of the classification job.","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"}},"name":"data_classification","description":"The Data Classification object includes information about data classification levels and data category types.","extends":"object","constraints":{"at_least_one":["category_id","confidentiality_id"]},"caption":"Data Classification"},"related_event":{"attributes":{"count":{"type":"integer_t","description":"The number of times that activity in the same logical group occurred, as reported by the related Finding.","requirement":"optional","caption":"Count","type_name":"Integer"},"status":{"type":"string_t","description":"The related event status. Should correspond to the label of the status_id (or 'Other' status value for status_id = 99) of the related event.","requirement":"optional","caption":"Status","type_name":"String"},"type":{"type":"string_t","description":"

The type of the related event/finding.

Populate if the related event/finding is NOT in OCSF. If it is in OCSF, then utilize type_name, type_uid instead.","requirement":"optional","caption":"Type","type_name":"String"},"title":{"type":"string_t","description":"A title or a brief phrase summarizing the related event/finding.","requirement":"optional","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"Details about the product that reported the related event/finding.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"desc":{"type":"string_t","description":"A description of the related event/finding.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"

The unique identifier of the related event/finding.

If the related event/finding is in OCSF, then this value must be equal to metadata.uid in the corresponding event.","requirement":"required","caption":"Unique ID","type_name":"String"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Severity","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated with the related event/finding.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"type_uid":{"type":"long_t","description":"The unique identifier of the related OCSF event type.

For example: 100701.

Populate if the related event/finding is in OCSF.","requirement":"recommended","caption":"Type ID","sibling":"type_name","type_name":"Long"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"type_name":{"type":"string_t","description":"The type of the related OCSF event, as defined by type_uid.

For example: Process Activity: Launch.

Populate if the related event/finding is in OCSF.","requirement":"optional","caption":"Type Name","type_name":"String"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"optional","object_type":"observable","caption":"Observables","object_name":"Observable"},"created_time":{"type":"timestamp_t","description":"

The time when the related event/finding was created.

If the related event/finding is in OCSF and is a Finding, then this value should be equal to finding_info.created_time in the corresponding Finding. If the related event/finding is in OCSF and is not a Finding, then this value should be equal to time in the corresponding event.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"first_seen_time":{"type":"timestamp_t","description":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed.
It can differ from the created_time timestamp, which reflects the time this finding was created.","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"kill_chain":{"type":"object_t","description":"The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.","is_array":true,"requirement":"optional","object_type":"kill_chain_phase","caption":"Kill Chain","object_name":"Kill Chain Phase"},"last_seen_time":{"type":"timestamp_t","description":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.
It can differ from the modified_time timestamp, which reflects the time this finding was last modified.","requirement":"optional","caption":"Last Seen","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The time when the related event/finding was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"product_uid":{"type":"string_t","description":"The unique identifier of the product that reported the related event.","requirement":"optional","caption":"Product Identifier","type_name":"String","@deprecated":{"message":"Use the uid attribute in the product object instead. See specific usage.","since":"1.4.0"}},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","requirement":"recommended","caption":"Severity ID","sibling":"severity","type_name":"Integer"},"traits":{"type":"object_t","description":"The list of key traits or characteristics extracted from the related event/finding that influenced or contributed to the overall finding's outcome.","is_array":true,"requirement":"optional","object_type":"trait","caption":"Traits","object_name":"Trait"},"created_time_dt":{"type":"datetime_t","description":"

The time when the related event/finding was created.

If the related event/finding is in OCSF and is a Finding, then this value should be equal to finding_info.created_time in the corresponding Finding. If the related event/finding is in OCSF and is not a Finding, then this value should be equal to time in the corresponding event.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"first_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed.
It can differ from the created_time timestamp, which reflects the time this finding was created.","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.
It can differ from the modified_time timestamp, which reflects the time this finding was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the related event/finding was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"related_event","description":"The Related Event object describes an event or another finding related to a finding. It may or may not be an OCSF event.","extends":"object","profiles":["data_classification","datetime"],"caption":"Related Event/Finding"},"win/win_service":{"attributes":{"name":{"type":"string_t","description":"The unique name of the service.","requirement":"required","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The version of the service.","requirement":"recommended","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the service.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"labels":{"type":"string_t","description":"The list of labels associated with the service.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the service.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"cmd_line":{"type":"string_t","description":"The full command line used to launch the service.","requirement":"recommended","caption":"Command Line","type_name":"String","observable":13},"hosting_process":{"type":"object_t","description":"The process that is hosting this service.","extension":"win","requirement":"optional","extension_id":2,"object_type":"process_entity","caption":"Hosting Process","object_name":"Process Entity"},"load_order_group":{"type":"string_t","description":"The name of the load ordering group of which this service is a member.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Load Order Group","type_name":"String"},"service_category":{"type":"string_t","description":"The service category, normalized to the caption of the service_category_id value. In the case of 'Other', it is defined by the event source.","extension":"win","requirement":"optional","extension_id":2,"caption":"Service Category","type_name":"String"},"service_category_id":{"type":"integer_t","enum":{"0":{"description":"The service category is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver.","caption":"Kernel Mode"},"2":{"description":"A user mode service.","caption":"User Mode"},"99":{"description":"The service category is not mapped. See the service_category attribute, which contains an event source specific value.","caption":"Other"}},"description":"The normalized identifier of the service category.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Service Category ID","sibling":"service_category","type_name":"Integer"},"service_dependencies":{"type":"string_t","description":"The names of other services upon which this service has a dependency.","extension":"win","is_array":true,"requirement":"recommended","extension_id":2,"caption":"Service Dependencies","type_name":"String"},"service_dll_file":{"type":"object_t","description":"For a shared user mode service (service_type_id is 4) this is the DLL that gets loaded by the generic service host process (e.g. svchost.exe) to implement the service.","extension":"win","requirement":"optional","extension_id":2,"object_type":"file","caption":"Service DLL","object_name":"File"},"service_error_control":{"type":"string_t","description":"The service error control, normalized to the caption of the service_error_control_id value. In the case of 'Other', it is defined by the event source.","extension":"win","requirement":"optional","extension_id":2,"caption":"Service Error Control","type_name":"String"},"service_error_control_id":{"type":"integer_t","enum":{"3":{"description":"The startup program logs the error in the event log. If the last-known-good configuration is being started, the startup operation continues. Otherwise, the system is restarted with the last-known-good configuration.","caption":"Severe"},"0":{"description":"The service error control is unknown.","caption":"Unknown"},"1":{"description":"The startup program ignores the error and continues the startup operation.","caption":"Ignore"},"2":{"description":"The startup program logs the error in the event log but continues the startup operation.","caption":"Normal"},"99":{"description":"The service error control is not mapped. See the service_error_control attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"The startup program logs the error in the event log, if possible. If the last-known-good configuration is being started, the startup operation fails. Otherwise, the system is restarted with the last-known good configuration.","caption":"Critical"}},"description":"The normalized identifier of the service error control.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Service Error Control ID","sibling":"service_error_control","type_name":"Integer"},"service_file":{"type":"object_t","description":"For a user mode service (service_type_id 3 or 4) this is the executable program that the SCM launches as the service process.
For a kernel mode driver (service_type_id 1 or 2) this is the driver file loaded into the kernel at the request of the SCM. ","extension":"win","requirement":"recommended","extension_id":2,"object_type":"file","caption":"Service File","object_name":"File"},"service_start_name":{"type":"string_t","description":"For a user mode service, this attribute represents the name of the account under which the service is run. For a kernel mode driver, this attribute represents the object name used to load the driver.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Service Start Name","type_name":"String"},"service_start_type":{"type":"string_t","description":"The service start type, normalized to the caption of the service_start_type_id value. In the case of 'Other', it is defined by the event source.","extension":"win","requirement":"optional","extension_id":2,"caption":"Service Start Type","type_name":"String"},"service_start_type_id":{"type":"integer_t","enum":{"3":{"description":"A user mode service started automatically during system startup.","caption":"Auto"},"0":{"description":"The service start type is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver loaded at boot.","caption":"Boot"},"2":{"description":"A kernel mode driver loaded during system startup.","caption":"System"},"99":{"description":"The service start type is not mapped. See the service_start_type attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"A user mode service started on demand when a process calls StartService.","caption":"Demand"},"5":{"description":"A driver or service that cannot be started.","caption":"Disabled"}},"description":"The normalized identifier of the service start type.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Service Start Type ID","sibling":"service_start_type","type_name":"Integer"},"service_type":{"type":"string_t","description":"The service type, normalized to the caption of the service_type_id value. In the case of 'Other', it is defined by the event source.","extension":"win","requirement":"optional","extension_id":2,"caption":"Service Type","type_name":"String"},"service_type_id":{"type":"integer_t","enum":{"3":{"description":"A user mode service that runs in its own process.","caption":"Own Process"},"0":{"description":"The service type is unknown.","caption":"Unknown"},"1":{"description":"A kernel mode driver.","caption":"Kernel Driver"},"2":{"description":"A kernel mode file system minifilter.","caption":"File System Driver"},"99":{"description":"The service type is not mapped. See the service_type attribute, which contains an event source specific value.","caption":"Other"},"4":{"description":"A user mode service that shares a process with other services.","caption":"Share Process"}},"description":"The normalized identifier of the service type.","extension":"win","requirement":"recommended","extension_id":2,"caption":"Service Type ID","sibling":"service_type","type_name":"Integer"}},"name":"win_service","description":"The Windows Service object describes a Windows service.","extension":"win","extends":"service","constraints":{"at_least_one":["cmd_line","service_category_id","service_dependencies","service_error_control_id","service_start_name","service_start_type_id","service_type_id"]},"references":[{"description":"D3FEND™ Ontology d3f:ServiceApplication.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ServiceApplication/"}],"extension_id":2,"profiles":["data_classification"],"caption":"Windows Service"},"network_proxy":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).","requirement":"optional","object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"zone":{"type":"string_t","description":"The network zone or LAN segment.","requirement":"optional","caption":"Network Zone","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the endpoint.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":48},"os":{"type":"object_t","description":"The endpoint operating system.","requirement":"optional","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"vpc_uid":{"type":"string_t","description":"The unique identifier of the Virtual Private Cloud (VPC).","requirement":"optional","caption":"VPC UID","type_name":"String"},"port":{"type":"port_t","description":"The port used for communication within the network connection.","requirement":"recommended","caption":"Port","type_name":"Port"},"network_scope_id":{"type":"integer_t","enum":{"0":{"description":"Unknown whether this endpoint resides within the customer’s network.","caption":"Unknown"},"1":{"description":"The endpoint resides inside the customer’s network.","caption":"Internal"},"2":{"description":"The endpoint is on the Internet or otherwise external to the customer’s network.","caption":"External"},"99":{"description":"The network scope is not mapped. See the network_scope attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the endpoint’s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined.","requirement":"optional","caption":"Network Scope ID","sibling":"network_scope","type_name":"Integer"},"fingerprints":{"type":"object_t","description":"Fingerprints that identify the specific application implementation on this endpoint, such as Cisco NPF or HASSH.","is_array":true,"requirement":"optional","object_type":"fingerprint","caption":"Fingerprints","object_name":"Fingerprint"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the endpoint or was last logged into it.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The network endpoint type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.","requirement":"optional","caption":"Type","type_name":"String"},"network_scope":{"type":"string_t","description":"Indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined. The value is normalized to the caption of the network_scope_id.","requirement":"optional","caption":"Network Scope","type_name":"String"},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","group":"context","requirement":"recommended","profiles":["container"],"object_type":"container","caption":"Container","object_name":"Container"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A laptop computer.","caption":"Laptop"},"6":{"description":"A virtual machine.","caption":"Virtual"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A server.","caption":"Server"},"2":{"description":"A desktop computer.","caption":"Desktop"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A tablet computer.","caption":"Tablet"},"5":{"description":"A mobile phone.","caption":"Mobile"},"7":{"description":"An IOT (Internet of Things) device.","caption":"IOT"},"8":{"description":"A web browser.","caption":"Browser"},"9":{"description":"A networking firewall.","caption":"Firewall"},"10":{"description":"A networking switch.","caption":"Switch"},"11":{"description":"A networking hub.","caption":"Hub"},"12":{"description":"A networking router.","caption":"Router"},"14":{"description":"An intrusion prevention system.","caption":"IPS"},"15":{"description":"A Load Balancer device.","caption":"Load Balancer"},"13":{"description":"An intrusion detection system.","caption":"IDS"}},"description":"The network endpoint type ID.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"domain":{"type":"string_t","description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint.","requirement":"optional","caption":"Domain","type_name":"String"},"pool":{"type":"object_t","description":"The pool of desktops or virtual machines to which the endpoint belongs.","requirement":"optional","object_type":"group","caption":"Pool","object_name":"Group"},"interface_name":{"type":"string_t","description":"The name of the network interface (e.g. eth2).","requirement":"recommended","caption":"Network Interface Name","type_name":"String"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","requirement":"optional","caption":"ISP Name","type_name":"String"},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","group":"context","requirement":"recommended","profiles":["container"],"caption":"Namespace PID","type_name":"Integer"},"mac_vendor":{"type":"string_t","description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address.","references":[{"description":"IEEE Registration Authority","url":"https://standards.ieee.org/products-programs/regauth/"}],"requirement":"optional","caption":"MAC Vendor","type_name":"String"},"name":{"type":"string_t","description":"The short name of the endpoint.","requirement":"recommended","caption":"Name","type_name":"String"},"mac":{"type":"mac_t","description":"The Media Access Control (MAC) address of the endpoint.","requirement":"optional","caption":"MAC Address","type_name":"MAC Address"},"instance_uid":{"type":"string_t","description":"The unique identifier of a VM instance.","requirement":"recommended","caption":"Instance ID","type_name":"String"},"subnet_uid":{"type":"string_t","description":"The unique identifier of a virtual subnet.","requirement":"optional","caption":"Subnet UID","type_name":"String"},"vlan_uid":{"type":"string_t","description":"The Virtual LAN identifier.","requirement":"optional","caption":"VLAN","type_name":"String"},"svc_name":{"type":"string_t","description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service.","requirement":"recommended","caption":"Service Name","type_name":"String"},"hostname":{"type":"hostname_t","description":"The fully qualified name of the endpoint.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"autonomous_system":{"type":"object_t","description":"The Autonomous System details associated with an IP address.","requirement":"optional","object_type":"autonomous_system","caption":"Autonomous System","object_name":"Autonomous System"},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"interface_uid":{"type":"string_t","description":"The unique identifier of the network interface.","requirement":"recommended","caption":"Network Interface ID","type_name":"String"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","requirement":"optional","object_type":"device_hw_info","caption":"Hardware Info","object_name":"Device Hardware Info"},"ip":{"type":"ip_t","description":"The IP address of the endpoint, in either IPv4 or IPv6 format.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"isp_org":{"type":"string_t","description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.","requirement":"optional","caption":"ISP Org","type_name":"String"},"location":{"type":"object_t","description":"The geographical location of the endpoint.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"intermediate_ips":{"type":"ip_t","description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header.","is_array":true,"requirement":"optional","caption":"Intermediate IP Addresses","type_name":"IP Address"}},"name":"network_proxy","description":"The network proxy endpoint object describes a proxy server, which acts as an intermediary between a client requesting a resource and the server providing that resource.","extends":"network_endpoint","constraints":{"at_least_one":["ip","uid","name","hostname","svc_name","instance_uid","interface_uid","interface_name","domain"]},"references":[{"description":"D3FEND™ Ontology d3f:ProxyServer","url":"https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/"}],"profiles":["container"],"caption":"Network Proxy Endpoint","observable":20},"access_analysis_result":{"attributes":{"access_level":{"type":"string_t","description":"The generalized access level or permission scope granted to the identity through the analyzed policy configuration. Common examples include Read, Write, List, Delete, Admin, or custom permission levels.","requirement":"recommended","caption":"Access Level","type_name":"String"},"access_type":{"type":"string_t","description":"The type or category of access being granted to the identity. This describes the nature of the access relationship, such as cross-account access, public access, federated access, or third-party integration access. Examples include 'Cross-Account', 'Public', 'Federated', 'Service-to-Service', etc.","requirement":"optional","caption":"Access Type","type_name":"String"},"accessors":{"type":"object_t","description":"The identities that are granted access through the analyzed policy configuration. This identifies the specific entity that can exercise the permissions and helps assess the access relationship and potential security implications. Examples include user accounts, service principals, roles, account identifiers, or system identities.","is_array":true,"requirement":"required","object_type":"user","caption":"Accessors","object_name":"User"},"additional_restrictions":{"type":"object_t","description":"Details about supplementary restrictions and guardrails that may limit the granted access, applied through additional policy types such as Resource Control Policies (RCPs) and Service Control Policies (SCPs) in AWS, or other policy constraints.","is_array":true,"requirement":"optional","object_type":"additional_restriction","caption":"Additional Restrictions","object_name":"Additional Restriction"},"condition_keys":{"type":"object_t","description":"The condition keys and their values that constrain when and how the granted access can be exercised. These conditions define the circumstances under which the access relationship is valid and the privileges can be used. Examples: IP address restrictions like 'aws:SourceIp:192.0.2.0/24', time-based constraints like 'aws:RequestedRegion:us-east-1', MFA requirements like 'aws:MultiFactorAuthPresent:true', or custom conditions based on resource tags and request context.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Condition Keys","object_name":"Key:Value object"},"granted_privileges":{"type":"string_t","description":"The specific privileges, actions, or permissions that are granted through the analyzed access relationship. This includes the actual operations that the accessor can perform on the target resource. Examples: AWS actions like 'sts:AssumeRole', 's3:GetObject', 'ec2:DescribeInstances'; Azure actions like 'Microsoft.Storage/storageAccounts/read'; or GCP permissions like 'storage.objects.get'.","is_array":true,"requirement":"optional","caption":"Granted Privileges","type_name":"String"}},"name":"access_analysis_result","description":"The Access Analysis Result object describes access relationships and pathways between identities, resources, focusing on who can access what and through which mechanisms. This evaluates access levels (read/write/admin), access types (direct, cross-account, public, federated), and the conditions under which access is granted. Use this for resource-centric security assessments such as external access discovery, public exposure analysis, etc.","extends":"object","caption":"Access Analysis Result"},"trace":{"attributes":{"flags":{"type":"string_t","description":"The flags associated with the trace, used to indicate specific properties or behaviors, such as whether the trace is sampled or if it has special handling. Flags help control how traces are processed, logged, and analyzed, providing valuable context for tracing and observability tools in identifying trace characteristics or specific tracking requirements.","is_array":true,"requirement":"optional","caption":"Flags","type_name":"String"},"service":{"type":"object_t","description":"Identifies the service or component generating the trace, helping to track and correlate the flow of requests through various parts of a distributed system. This information is essential for understanding the role and performance of specific services within the broader context of system operations and for diagnosing issues across different components.","requirement":"optional","object_type":"service","caption":"Service","object_name":"Service"},"uid":{"type":"string_t","description":"The unique identifier of the trace used in distributed systems and microservices architecture to track and correlate requests across various components of an application.","requirement":"required","caption":"Unique ID","type_name":"String"},"span":{"type":"object_t","description":"Represents a single unit of work or operation within a distributed trace. A span typically tracks the execution of a request across a service, capturing important details such as the operation, timestamps, and status. Spans help break down the overall trace into smaller, manageable parts, enabling detailed analysis of the performance and behavior of specific operations within the system. They are crucial for understanding latency, dependencies, and bottlenecks in complex distributed systems.","requirement":"optional","object_type":"span","caption":"Span","object_name":"Span"},"start_time":{"type":"timestamp_t","description":"The start timestamp of the trace, essential for identifying latency and performance bottlenecks. Like the end time, this timestamp is normalized across the trace system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time enables accurate trace duration calculations and helps observability tools track performance across services, regardless of the individual system time settings.","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"duration":{"type":"long_t","description":"The total time, in milliseconds, that the trace covers, calculated as the difference between start_time and end_time. This duration helps assess the overall performance of a request as it travels across various services, and is essential for identifying latency and potential bottlenecks within the distributed system. The trace duration may differ from individual span durations due to the propagation and processing times of the trace as it spans multiple components.","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"end_time":{"type":"timestamp_t","description":"The end timestamp of the trace, essential for identifying latency and performance bottlenecks. Like the start time, this timestamp is normalized across the trace system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time allows for accurate trace duration calculations and helps observability tools track overall performance across services, regardless of the individual system time settings.","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The start timestamp of the trace, essential for identifying latency and performance bottlenecks. Like the end time, this timestamp is normalized across the trace system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time enables accurate trace duration calculations and helps observability tools track performance across services, regardless of the individual system time settings.","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The end timestamp of the trace, essential for identifying latency and performance bottlenecks. Like the start time, this timestamp is normalized across the trace system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time allows for accurate trace duration calculations and helps observability tools track overall performance across services, regardless of the individual system time settings.","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"}},"name":"trace","description":"The trace object contains information about a distributed trace, which is crucial for observability. Traces are made up of one or more spans, which are individual units of work in application activity. Traces track the journey of a request as it moves through various services in a system, capturing key details like timing, status, and dependencies at each step. Traces provide insights into system performance, helping to identify latency, bottlenecks, and issues in complex, distributed environments.","extends":"object","profiles":["datetime"],"caption":"Trace"},"campaign":{"attributes":{"name":{"type":"string_t","description":"The name of a specific campaign associated with a cyber threat.","requirement":"required","caption":"Name","type_name":"String"}},"name":"campaign","description":"Campaign represent organized efforts by threat actors to achieve malicious objectives over a period, often characterized by shared tactics, techniques, and procedures (TTPs).","extends":"object","caption":"Campaign"},"additional_restriction":{"attributes":{"status":{"type":"string_t","description":"The current status of the policy restriction, normalized to the caption of the status_id enum value.","requirement":"optional","caption":"Status","type_name":"String"},"policy":{"type":"object_t","description":"Detailed information about the policy document that defines this restriction, including policy metadata, type, scope, and the specific rules or conditions that implement the access control.","requirement":"required","object_type":"policy","caption":"Policy","object_name":"Policy"},"status_id":{"type":"integer_t","enum":{"3":{"description":"This restriction could not be properly evaluated due to an error.","caption":"Evaluation Error"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"This restriction is currently applicable and being enforced.","caption":"Applicable"},"2":{"description":"This restriction is not applicable.","caption":"Inapplicable"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized status identifier indicating the applicability of this policy restriction.","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"}},"name":"additional_restriction","description":"The Additional Restriction object describes supplementary access controls and guardrails that constrain or limit granted permissions beyond the primary policy. These restrictions are typically applied through hierarchical policy frameworks, organizational controls, or conditional access mechanisms. Examples include AWS Service Control Policies (SCPs), Resource Control Policies (RCPs), Azure Management Group policies, GCP Organization policies, conditional access policies, IP restrictions, time-based constraints, and MFA requirements.","extends":"object","caption":"Additional Restriction"},"finding":{"attributes":{"title":{"type":"string_t","description":"A title or a brief phrase summarizing the reported finding.","requirement":"required","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"Details about the product that reported the finding.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"desc":{"type":"string_t","description":"The description of the reported finding.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the reported finding.","requirement":"required","caption":"Unique ID","type_name":"String"},"types":{"type":"string_t","description":"One or more types of the reported finding.","is_array":true,"requirement":"optional","caption":"Types","type_name":"String"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"created_time":{"type":"timestamp_t","description":"The time when the finding was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"first_seen_time":{"type":"timestamp_t","description":"The time when the finding was first observed.","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"last_seen_time":{"type":"timestamp_t","description":"The time when the finding was most recently observed.","requirement":"optional","caption":"Last Seen","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The time when the finding was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"product_uid":{"type":"string_t","description":"The unique identifier of the product that reported the finding.","requirement":"optional","caption":"Product Identifier","type_name":"String","@deprecated":{"message":"Use the uid attribute in the product object instead. See specific usage.","since":"1.4.0"}},"related_events":{"type":"object_t","description":"Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF.","is_array":true,"requirement":"optional","object_type":"related_event","caption":"Related Events/Findings","object_name":"Related Event/Finding"},"src_url":{"type":"url_t","description":"The URL pointing to the source of the finding.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"supporting_data":{"type":"json_t","description":"Additional data supporting a finding as provided by security tool","requirement":"optional","caption":"Supporting Data","type_name":"JSON"},"created_time_dt":{"type":"datetime_t","description":"The time when the finding was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"first_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was first observed.","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was most recently observed.","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the finding was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"finding","description":"The Finding object describes metadata related to a security finding generated by a security tool or system.","extends":"object","profiles":["data_classification","datetime"],"caption":"Finding","@deprecated":{"message":"Use the new finding_info object.","since":"1.0.0"}},"job":{"attributes":{"name":{"type":"string_t","description":"The name of the job.","requirement":"required","caption":"Name","type_name":"String"},"file":{"type":"object_t","description":"The file that pertains to the job.","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"user":{"type":"object_t","description":"The user that created the job.","requirement":"optional","object_type":"user","caption":"User","object_name":"User"},"desc":{"type":"string_t","description":"The description of the job.","requirement":"recommended","caption":"Description","type_name":"String"},"cmd_line":{"type":"string_t","description":"The job command line.","requirement":"recommended","caption":"Command Line","type_name":"String","observable":13},"created_time":{"type":"timestamp_t","description":"The time when the job was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"last_run_time":{"type":"timestamp_t","description":"The time when the job was last run.","requirement":"recommended","caption":"Last Run","type_name":"Timestamp"},"next_run_time":{"type":"timestamp_t","description":"The time when the job will next be run.","requirement":"optional","caption":"Next Run","type_name":"Timestamp"},"run_state":{"type":"string_t","description":"The run state of the job.","requirement":"optional","caption":"Run State","type_name":"String"},"run_state_id":{"type":"integer_t","enum":{"3":{"caption":"Running"},"0":{"description":"The run state is unknown.","caption":"Unknown"},"1":{"caption":"Ready"},"2":{"caption":"Queued"},"99":{"description":"The run state is not mapped. See the run_state attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Stopped"}},"description":"The run state ID of the job.","requirement":"recommended","caption":"Run State ID","sibling":"run_state","type_name":"Integer"},"created_time_dt":{"type":"datetime_t","description":"The time when the job was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"last_run_time_dt":{"type":"datetime_t","description":"The time when the job was last run.","requirement":"optional","profiles":["datetime"],"caption":"Last Run","type_name":"Datetime"},"next_run_time_dt":{"type":"datetime_t","description":"The time when the job will next be run.","requirement":"optional","profiles":["datetime"],"caption":"Next Run","type_name":"Datetime"}},"name":"job","description":"The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:ScheduledJob.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ScheduledJob/"}],"profiles":["data_classification","datetime"],"caption":"Job"},"tls_extension":{"attributes":{"data":{"type":"json_t","description":"The data contains information specific to the particular extension type.","requirement":"recommended","caption":"Data","type_name":"JSON"},"type":{"type":"string_t","description":"The TLS extension type. For example: Server Name.","requirement":"optional","caption":"Type","type_name":"String"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The Server Name Indication extension.","caption":"server_name"},"1":{"description":"The Maximum Fragment Length Negotiation extension.","caption":"maximum_fragment_length"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"5":{"description":"The Certificate Status Request extension.","caption":"status_request"},"10":{"description":"The Supported Groups extension.","caption":"supported_groups"},"14":{"description":"The Use SRTP data protection extension.","caption":"use_srtp"},"15":{"description":"The Heartbeat extension.","caption":"heartbeat"},"16":{"description":"The Application-Layer Protocol Negotiation extension.","caption":"application_layer_protocol_negotiation"},"18":{"description":"The Signed Certificate Timestamp extension.","caption":"signed_certificate_timestamp"},"20":{"description":"The Server Certificate Type extension.","caption":"server_certificate_type"},"21":{"description":"The Padding extension.","caption":"padding"},"43":{"description":"The Supported Versions extension.","caption":"supported_versions"},"44":{"description":"The Cookie extension.","caption":"cookie"},"45":{"description":"The Pre-Shared Key Exchange Modes extension.","caption":"psk_key_exchange_modes"},"47":{"description":"The Certificate Authorities extension.","caption":"certificate_authorities"},"49":{"description":"The Post-Handshake Client Authentication extension.","caption":"post_handshake_auth"},"50":{"description":"The Signature Algorithms extension.","caption":"signature_algorithms_cert"},"51":{"description":"The Key Share extension.","caption":"key_share"},"13":{"description":"The Signature Algorithms extension.","caption":"signature_algorithms"},"19":{"description":"The Client Certificate Type extension.","caption":"client_certificate_type"},"48":{"description":"The OID Filters extension.","caption":"oid_filters"},"41":{"description":"The Pre Shared Key extension.","caption":"pre_shared_key"},"42":{"description":"The Early Data extension.","caption":"early_data"}},"description":"The TLS extension type identifier. See The Transport Layer Security (TLS) extension page.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"}},"name":"tls_extension","description":"The TLS Extension object describes additional attributes that extend the base Transport Layer Security (TLS) object.","extends":"object","caption":"TLS Extension"},"observation":{"attributes":{"count":{"type":"integer_t","description":"Integer representing the total number of times this specific value/event was observed across all occurrences. Helps establish prevalence and patterns.","requirement":"recommended","caption":"Count","type_name":"Integer"},"value":{"type":"string_t","description":"The specific value, event, indicator or data point that was observed and recorded. This is the core piece of information being tracked.","requirement":"required","caption":"Value","type_name":"String"},"timespan":{"type":"object_t","description":"The time window when the value or event was first observed. It is used to analyze activity patterns, detect trends, or correlate events within a specific timeframe.","requirement":"recommended","object_type":"timespan","caption":"Time Span","object_name":"Time Span"}},"name":"observation","description":"A record of an observed value or event that captures the timing and frequency of its occurrence. Used to track when values/events were first detected, last detected, and their total occurrence count.","extends":"object","caption":"Observation"},"tactic":{"attributes":{"name":{"type":"string_t","description":"The Tactic name that is associated with the attack technique. For example: Reconnaissance or ML Model Access.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The Tactic ID that is associated with the attack technique. For example: TA0043, or AML.TA0000.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"src_url":{"type":"url_t","description":"The versioned permalink of the Tactic. For example: https://attack.mitre.org/versions/v14/tactics/TA0043/.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"tactic","description":"The MITRE Tactic object describes the ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"caption":"MITRE Tactic"},"trait":{"attributes":{"name":{"type":"string_t","description":"The name of the trait.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the trait. For example, this can be used to indicate if the trait acts as a contributing factor (increases risk/severity) or a mitigating factor (decreases risk/severity), in the context of the related finding.","requirement":"optional","caption":"Type","type_name":"String"},"values":{"type":"string_t","description":"The values of the trait.","is_array":true,"requirement":"optional","caption":"Values","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the trait.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The high-level grouping or classification this trait belongs to.","requirement":"optional","caption":"Category","type_name":"String"}},"name":"trait","description":"Describes a characteristic or feature of an entity that was observed. For example, this object can be used to represent specific characteristics derived from events or findings that can be surfaced as distinguishing traits of the entity in question.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Trait"},"keyboard_info":{"attributes":{"function_keys":{"type":"integer_t","description":"The number of function keys on client keyboard.","requirement":"optional","caption":"Function Keys","type_name":"Integer"},"ime":{"type":"string_t","description":"The Input Method Editor (IME) file name.","requirement":"optional","caption":"IME","type_name":"String"},"keyboard_layout":{"type":"string_t","description":"The keyboard locale identifier name (e.g., en-US).","requirement":"optional","caption":"Keyboard Layout","type_name":"String"},"keyboard_subtype":{"type":"integer_t","description":"The keyboard numeric code.","requirement":"optional","caption":"Keyboard Subtype","type_name":"Integer"},"keyboard_type":{"type":"string_t","description":"The keyboard type (e.g., xt, ico).","requirement":"optional","caption":"Keyboard Type","type_name":"String"}},"name":"keyboard_info","description":"The Keyboard Information object contains details and attributes related to a computer or device keyboard. It encompasses information that describes the characteristics, capabilities, and configuration of the keyboard.","extends":"object","caption":"Keyboard Information"},"autonomous_system":{"attributes":{"name":{"type":"string_t","description":"Organization name for the Autonomous System.","group":"context","requirement":"recommended","caption":"Name","type_name":"String"},"number":{"type":"integer_t","description":"Unique number that the AS is identified by.","group":"context","requirement":"recommended","caption":"Number","type_name":"Integer"}},"name":"autonomous_system","description":"An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.","extends":"object","constraints":{"at_least_one":["number","name"]},"caption":"Autonomous System"},"affected_package":{"attributes":{"name":{"type":"string_t","description":"The software package name.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The software package version.","requirement":"required","caption":"Version","type_name":"String"},"path":{"type":"file_path_t","description":"The installation path of the affected package.","requirement":"optional","caption":"Path","type_name":"File Path"},"uid":{"type":"string_t","description":"A unique identifier for the package or library reported by the source tool. E.g., the libId within the sbom field of an OX Security Issue or the SPDX components.*.bom-ref.","requirement":"optional","caption":"Package UID","type_name":"String"},"hash":{"type":"object_t","description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library.","requirement":"optional","object_type":"fingerprint","caption":"Hash","object_name":"Fingerprint"},"release":{"type":"string_t","description":"Release is the number of times a version of the software has been packaged.","requirement":"optional","caption":"Software Release Details","type_name":"String"},"epoch":{"type":"integer_t","description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers.","requirement":"optional","caption":"Epoch","type_name":"Integer"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"An application software package.","caption":"Application"},"2":{"description":"An operating system software package.","caption":"Operating System"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The type of software package.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"license":{"type":"string_t","description":"The software license applied to this package.","requirement":"optional","caption":"Software License","type_name":"String"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"architecture":{"type":"string_t","description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on.","requirement":"recommended","caption":"Architecture","type_name":"String"},"cpe_name":{"type":"string_t","description":"The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.","requirement":"optional","caption":"The product CPE identifier","type_name":"String"},"fixed_in_version":{"type":"string_t","description":"The software package version in which a reported vulnerability was patched/fixed.","requirement":"optional","caption":"Fixed In Version","type_name":"String"},"license_url":{"type":"url_t","description":"The URL pointing to the license applied on package or software. This is typically a LICENSE.md file within a repository.","requirement":"optional","caption":"Software License URL","type_name":"URL String"},"package_manager":{"type":"string_t","description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc.","requirement":"optional","caption":"Package Manager","type_name":"String"},"package_manager_url":{"type":"url_t","description":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as AWS CodeArtifact or Artifactory.","requirement":"optional","caption":"Package Manager URL","type_name":"URL String"},"purl":{"type":"string_t","description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.","requirement":"optional","caption":"Package URL","type_name":"String"},"src_url":{"type":"url_t","description":"The link to the specific library or package such as within GitHub, this is different from the link to the package manager where the library or package is hosted.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"vendor_name":{"type":"string_t","description":"The name of the vendor who published the software package.","requirement":"optional","caption":"Vendor Name","type_name":"String"}},"name":"affected_package","description":"The Affected Package object describes details about a software package identified as affected by a vulnerability/vulnerabilities.","extends":"package","references":[{"description":"D3FEND™ Ontology d3f:SoftwarePackage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}],"profiles":["data_classification"],"caption":"Affected Software Package"},"unmanned_aerial_system":{"attributes":{"name":{"type":"string_t","description":"The name of the unmanned system as reported by tracking or sensing hardware.","requirement":"optional","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of the UAS. For example, Helicopter, Gyroplane, Rocket, etc.","requirement":"optional","caption":"Type","type_name":"String"},"speed":{"type":"string_t","description":"Ground speed of flight. This value is provided in meters per second with a minimum resolution of 0.25 m/s. Special Values: Invalid, No Value, or Unknown: 255 m/s.","requirement":"optional","caption":"Speed","type_name":"String"},"location":{"type":"object_t","description":"The detailed geographical location usually associated with an IP address.","requirement":"recommended","object_type":"location","caption":"UAS Position Location Information","object_name":"Geo Location"},"uid":{"type":"string_t","description":"The primary identification identifier for an unmanned system. This can be a Serial Number (in CTA-2063-A format, the Registration ID (provided by the CAA, a UTM, or a unique Session ID.","requirement":"recommended","caption":"UAS ID","type_name":"String"},"uuid":{"type":"uuid_t","description":"The Unmanned Aircraft System Traffic Management (UTM) provided universal unique ID (UUID) traceable to a non-obfuscated ID where this UTM UUID acts as a 'session id' to protect exposure of operationally sensitive information.","requirement":"recommended","caption":"UTM UUID","type_name":"UUID"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Gyroplane"},"6":{"caption":"Glider"},"0":{"description":"The UAS type is empty or not declared.","caption":"Unknown/Undeclared"},"1":{"caption":"Airplane"},"2":{"description":"Can also be a Multi-rotor Unmanned Aircraft (e.g., Quad-copter).","caption":"Helicopter"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Fixed wing aircraft that can take off vertically.","caption":"Hybrid Lift"},"5":{"caption":"Ornithopter"},"7":{"caption":"Kite"},"8":{"caption":"Free Balloon"},"9":{"caption":"Captive Balloon"},"10":{"description":"E.g., a blimp.","caption":"Airship"},"11":{"description":"Parachutes, or objects without any power or propulsion mechanism.","caption":"Free Fall/Parachute"},"12":{"caption":"Rocket"},"14":{"caption":"Ground Obstacle"},"13":{"caption":"Tethered Powered Aircraft"}},"description":"The UAS type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","requirement":"optional","object_type":"device_hw_info","caption":"UAS Hardware Information","object_name":"Device Hardware Info"},"model":{"type":"string_t","description":"The model name of the aircraft or unmanned system.","requirement":"optional","caption":"Model","type_name":"String"},"serial_number":{"type":"string_t","description":"The serial number of the unmanned system. This is expressed in CTA-2063-A format.","requirement":"recommended","caption":"Serial Number","type_name":"String","observable":37},"speed_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal ground speed. Measured in meters/second.","requirement":"optional","caption":"Speed Accuracy","type_name":"String"},"track_direction":{"type":"string_t","description":"Direction of flight expressed as a “True North-based” ground track angle. This value is provided in clockwise degrees with a minimum resolution of 1 degree. If aircraft is not moving horizontally, use the “Unknown” value","requirement":"optional","caption":"Track Direction","type_name":"String"},"uid_alt":{"type":"string_t","description":"A secondary identification identifier for an unmanned system. This can be a Serial Number (in CTA-2063-A format, the Registration ID (provided by the CAA, a UTM, or a unique Session ID.","requirement":"recommended","caption":"UAS Alternate ID","type_name":"String"},"vertical_speed":{"type":"string_t","description":"Vertical speed upward relative to the WGS-84 datum, measured in meters per second. Special Values: Invalid, No Value, or Unknown: 63 m/s.","requirement":"optional","caption":"Vertical Speed","type_name":"String"}},"name":"unmanned_aerial_system","description":"The Unmanned Aerial System object describes the characteristics, Position Location Information (PLI), and other metadata of Unmanned Aerial Systems (UAS) and other unmanned and drone systems used in Remote ID. Remote ID is defined in the Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a.","extends":"aircraft","constraints":{"at_least_one":["name","serial_number","uid","uid_alt"]},"caption":"Unmanned Aerial System"},"graph":{"attributes":{"name":{"type":"string_t","description":"The graph name - a human readable identifier for the graph.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The graph type. Typically useful to represent the specific type of graph that is used.","requirement":"optional","caption":"Type","type_name":"String"},"nodes":{"type":"object_t","description":"The nodes/vertices of the graph - contains the collection of node objects that make up the graph.","is_array":true,"requirement":"required","object_type":"node","caption":"Nodes","object_name":"Node"},"desc":{"type":"string_t","description":"The graph description - provides additional details about the graph's purpose and contents.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"Unique identifier of the graph - a unique ID to reference this specific graph.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"edges":{"type":"object_t","description":"The edges/connections between nodes in the graph - contains the collection of edge objects defining relationships between nodes.","is_array":true,"requirement":"optional","object_type":"edge","caption":"Edges","object_name":"Edge"},"is_directed":{"type":"boolean_t","description":"Indicates if the graph is directed (true) or undirected (false).","requirement":"optional","caption":"Directed","type_name":"Boolean"},"query_language":{"type":"string_t","description":"The graph query language, normalized to the caption of the query_language_id value.","requirement":"optional","caption":"Query Language","type_name":"String"},"query_language_id":{"type":"integer_t","enum":{"3":{"description":"A graph traversal language and virtual machine developed by Apache TinkerPop that enables graph computing across different graph databases.","caption":"Gremlin"},"6":{"description":"Property Graph Query Language developed by Oracle that provides SQL-like syntax for querying property graphs.","caption":"PGQL"},"0":{"description":"The Query Language is unknown.","caption":"Unknown"},"1":{"description":"A declarative graph query language developed by Neo4j that allows for expressive and efficient querying of graph databases.","caption":"Cypher"},"2":{"description":"A query language for APIs that enables declarative data fetching and provides a complete description of the data in the API.","caption":"GraphQL"},"99":{"description":"The Query Language is not mapped. See the query_language attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"An ISO standard graph query language designed to provide a unified way to query graph databases.","caption":"GQL"},"5":{"description":"A graph query language that combines features from existing languages while adding support for paths as first-class citizens.","caption":"G-CORE"},"7":{"description":"A semantic query language for databases that enables querying and manipulating data stored in RDF format.","caption":"SPARQL"}},"description":"The normalized identifier of a graph query language that can be used to interact with the graph.","requirement":"recommended","caption":"Query Language ID","sibling":"query_language","type_name":"Integer"}},"name":"graph","description":"A graph data structure representation with nodes and edges.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"JSON graph specification.","url":"https://github.com/jsongraph/json-graph-specification/"}],"caption":"Graph"},"technique":{"attributes":{"name":{"type":"string_t","description":"The name of the attack technique. For example: Active Scanning or AI Model Inference API Access.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the attack technique. For example: T1595 or AML.T0040.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"src_url":{"type":"url_t","description":"The versioned permalink of the attack technique. For example: https://attack.mitre.org/versions/v14/techniques/T1595/.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"technique","description":"The MITRE Technique object describes the ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"caption":"MITRE Technique"},"agent":{"attributes":{"name":{"type":"string_t","description":"The name of the agent or sensor. For example: AWS SSM Agent.","requirement":"recommended","caption":"Agent Name","type_name":"String"},"type":{"type":"string_t","description":"The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.","requirement":"optional","caption":"Agent Type","type_name":"String"},"version":{"type":"string_t","description":"The semantic version of the agent or sensor, e.g., 7.101.50.0.","requirement":"optional","caption":"Agent Version","type_name":"String"},"uid":{"type":"string_t","description":"The UID of the agent or sensor, sometimes known as a Sensor ID or aid.","requirement":"recommended","caption":"Agent ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent.","caption":"Backup & Recovery"},"6":{"description":"Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent.","caption":"Log Forwarding"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh.","caption":"Endpoint Detection and Response"},"2":{"description":"Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP.","caption":"Data Loss Prevention"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent.","caption":"Performance Monitoring & Observability"},"5":{"description":"Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent.","caption":"Vulnerability Management"},"7":{"description":"Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.","caption":"Mobile Device Management"},"8":{"description":"Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server.","caption":"Configuration Management"},"9":{"description":"Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent.","caption":"Remote Access"}},"description":"The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"policies":{"type":"object_t","description":"Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc.","is_array":true,"requirement":"optional","object_type":"policy","caption":"Agent Policies","object_name":"Policy"},"uid_alt":{"type":"string_t","description":"An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID.","requirement":"optional","caption":"Alternate Agent ID","type_name":"String"},"vendor_name":{"type":"string_t","description":"The company or author who created the agent or sensor. For example: Crowdstrike.","requirement":"optional","caption":"Vendor Name","type_name":"String"}},"name":"agent","description":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software.","extends":"object","constraints":{"at_least_one":["uid","name"]},"references":[{"description":"D3FEND™ Ontology d3f:Sensor.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Sensor/"}],"caption":"Agent"},"digital_signature":{"attributes":{"state":{"type":"string_t","description":"The digital signature state defines the signature state, normalized to the caption of 'state_id'. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"State","type_name":"String"},"digest":{"type":"object_t","description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information.","requirement":"optional","object_type":"fingerprint","caption":"Message Digest","object_name":"Fingerprint"},"certificate":{"type":"object_t","description":"The certificate object containing information about the digital certificate.","requirement":"recommended","object_type":"certificate","caption":"Certificate","object_name":"Digital Certificate"},"algorithm":{"type":"string_t","description":"The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Algorithm","type_name":"String"},"algorithm_id":{"type":"integer_t","enum":{"3":{"description":"Elliptic Curve Digital Signature Algorithm.","caption":"ECDSA"},"0":{"description":"The algorithm is unknown.","caption":"Unknown"},"1":{"description":"Digital Signature Algorithm (DSA).","caption":"DSA"},"2":{"description":"Rivest-Shamir-Adleman (RSA) Algorithm.","caption":"RSA"},"99":{"description":"The algorithm is not mapped. See the algorithm attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Microsoft Authenticode Digital Signature Algorithm.","caption":"Authenticode"}},"description":"The identifier of the normalized digital signature algorithm.","requirement":"required","caption":"Algorithm ID","sibling":"algorithm","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"The time when the digital signature was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"developer_uid":{"type":"string_t","description":"The developer ID on the certificate that signed the file.","requirement":"optional","caption":"Developer UID","type_name":"String"},"state_id":{"type":"integer_t","enum":{"3":{"description":"The digital signature is invalid due to certificate revocation.","caption":"Revoked"},"6":{"description":"The digital signature is invalid because the certificate is rooted in an untrusted CA or is an untrusted self-signed certificate.","caption":"Untrusted"},"0":{"description":"The state is unknown.","caption":"Unknown"},"1":{"description":"The digital signature is valid.","caption":"Valid"},"2":{"description":"The digital signature is invalid because its timestamp does not fall within the certificate's validity period.","caption":"Expired"},"99":{"description":"The state is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The digital signature is invalid due to certificate suspension.","caption":"Suspended"},"5":{"description":"The digital signature state is pending.","caption":"Pending"},"7":{"description":"The digital signature is invalid because the certificate is explicitly distrusted. Note that whereas revocation is global, distrust reflects local IT/security policy.","caption":"Distrusted"},"8":{"description":"The digital signature is invalid because the certificate is not intended for code signing purposes.","caption":"WrongUsage"},"9":{"description":"The digital signature is cryptographically invalid, e.g. a mismatched digest. This indicates possible tampering.","caption":"Bad"},"10":{"description":"The digital signature is malformed and could not be processed.","caption":"Broken"}},"description":"The normalized identifier of the signature state.","requirement":"optional","caption":"State ID","sibling":"state","type_name":"Integer"},"created_time_dt":{"type":"datetime_t","description":"The time when the digital signature was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"digital_signature","description":"The Digital Signature object contains information about the cryptographic mechanism used to verify the authenticity, integrity, and origin of the file or application.","extends":"object","profiles":["datetime"],"caption":"Digital Signature"},"table":{"attributes":{"name":{"type":"string_t","description":"The table name, ordinarily as assigned by a database administrator.","requirement":"recommended","caption":"Name","type_name":"String"},"size":{"type":"long_t","description":"The size of the data table in bytes.","requirement":"optional","caption":"Size","type_name":"Long"},"desc":{"type":"string_t","description":"The description of the table.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the table.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"groups":{"type":"object_t","description":"The group names to which the table belongs.","is_array":true,"requirement":"optional","object_type":"group","caption":"Groups","object_name":"Group"},"created_time":{"type":"timestamp_t","description":"The time when the table was known to have been created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The most recent time when any changes, updates, or modifications were made within the table.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"created_time_dt":{"type":"datetime_t","description":"The time when the table was known to have been created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The most recent time when any changes, updates, or modifications were made within the table.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"table","description":"The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["datetime"],"caption":"Table"},"device_hw_info":{"attributes":{"uuid":{"type":"uuid_t","description":"The device manufacturer assigned universally unique hardware identifier. For SMBIOS compatible devices such as those running Linux and Windows, it is the UUID member of the System Information structure in the SMBIOS information. For macOS devices, it is the Hardware UUID (also known as IOPlatformUUID in the I/O Registry).","references":[{"description":"SMBIOS Specification","url":"https://www.dmtf.org/standards/smbios"},{"description":"Linux DMI Table Decoder documentation","url":"https://linux.die.net/man/8/dmidecode"},{"description":"Windows Win32_ComputerSystemProduct documentation","url":"https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-computersystemproduct"},{"description":"Apple Wiki (Mac Hardware UUID)","url":"https://theapplewiki.com/wiki/UDID#Mac"},{"description":"macOS I/O Registry source code reference to IOPlatformUUID","url":"https://github.com/apple-oss-distributions/xnu/blob/8d741a5de7ff4191bf97d57b9f54c2f6d4a15585/iokit/IOKit/IOKitKeys.h#L264-L265"}],"requirement":"optional","caption":"UUID","type_name":"UUID"},"bios_date":{"type":"string_t","description":"The BIOS date. For example: 03/31/16.","requirement":"optional","caption":"BIOS Date","type_name":"String"},"bios_manufacturer":{"type":"string_t","description":"The BIOS manufacturer. For example: LENOVO.","requirement":"optional","caption":"BIOS Manufacturer","type_name":"String"},"bios_ver":{"type":"string_t","description":"The BIOS version. For example: LENOVO G5ETA2WW (2.62).","requirement":"optional","caption":"BIOS Version","type_name":"String"},"chassis":{"type":"string_t","description":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows Windows Chassis Types","requirement":"optional","caption":"Chassis","type_name":"String"},"cpu_architecture":{"type":"string_t","description":"The CPU architecture, normalized to the caption of the cpu_architecture_id value. In the case of Other, it is defined by the source.","requirement":"optional","caption":"CPU Architecture","type_name":"String"},"cpu_architecture_id":{"type":"integer_t","enum":{"3":{"description":"CPU uses the RISC-V ISA. For bitness, refer to cpu_bits.","caption":"RISC-V"},"0":{"description":"The CPU architecture is unknown.","caption":"Unknown"},"1":{"description":"CPU uses the x86 ISA. For bitness, refer to cpu_bits.","caption":"x86"},"2":{"description":"CPU uses the ARM ISA. For bitness, refer to cpu_bits.","caption":"ARM"},"99":{"description":"The CPU architecture is not mapped. See the cpu_architecture attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the CPU architecture.","requirement":"optional","caption":"CPU Architecture ID","sibling":"cpu_architecture","type_name":"Integer"},"cpu_bits":{"type":"integer_t","description":"The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.","requirement":"optional","caption":"CPU Bits","type_name":"Integer"},"cpu_cores":{"type":"integer_t","description":"The number of processor cores in all installed processors. For Example: 42.","requirement":"optional","caption":"CPU Cores","type_name":"Integer"},"cpu_count":{"type":"integer_t","description":"The number of physical processors on a system. For example: 1.","requirement":"optional","caption":"CPU Count","type_name":"Integer"},"cpu_speed":{"type":"integer_t","description":"The speed of the processor in Mhz. For Example: 4200.","requirement":"optional","caption":"Processor Speed","type_name":"Integer"},"cpu_type":{"type":"string_t","description":"The processor type. For example: x86 Family 6 Model 37 Stepping 5.","requirement":"optional","caption":"Processor Type","type_name":"String"},"desktop_display":{"type":"object_t","description":"The desktop display affiliated with the event","requirement":"optional","object_type":"display","caption":"Desktop Display","object_name":"Display"},"gpu_count":{"type":"integer_t","description":"The number of GPU's on a system. For example: 1.","requirement":"optional","caption":"GPU Count","type_name":"Integer"},"gpu_info_list":{"type":"object_t","description":"A list of GPU objects describing the hardware properties of each graphics processor installed on the device.","is_array":true,"requirement":"optional","object_type":"gpu_info","caption":"GPU information","object_name":"GPU Information"},"keyboard_info":{"type":"object_t","description":"The keyboard detailed information.","requirement":"optional","object_type":"keyboard_info","caption":"Keyboard Information","object_name":"Keyboard Information"},"ram_size":{"type":"integer_t","description":"The total amount of installed RAM, in Megabytes. For example: 2048.","requirement":"optional","caption":"RAM Size","type_name":"Integer"},"serial_number":{"type":"string_t","description":"The device manufacturer serial number.","requirement":"optional","caption":"Serial Number","type_name":"String","observable":37},"vendor_name":{"type":"string_t","description":"The device manufacturer.","requirement":"optional","caption":"Vendor Name","type_name":"String"}},"name":"device_hw_info","description":"The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.","extends":"object","caption":"Device Hardware Info"},"scim":{"attributes":{"name":{"type":"string_t","description":"The name of the SCIM resource.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"SCIM protocol version supported e.g., SCIM 2.0.","requirement":"recommended","caption":"SCIM Version","type_name":"String"},"state":{"type":"string_t","description":"The provisioning state of the SCIM resource, normalized to the caption of the state_id value. In the case of Other, it is defined by the event source.","requirement":"optional","caption":"State","type_name":"String"},"uid":{"type":"string_t","description":"A unique identifier for a SCIM resource as defined by the service provider.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"protocol_name":{"type":"string_t","description":"The supported protocol for the SCIM resource. E.g., SAML, OIDC, or OAuth2.","requirement":"optional","caption":"Supported Protocol","type_name":"String"},"auth_protocol":{"type":"string_t","description":"The authorization protocol as defined by the caption of auth_protocol_id. In the case of Other, it is defined by the event source.","requirement":"optional","caption":"Auth Protocol","type_name":"String"},"auth_protocol_id":{"type":"integer_t","enum":{"3":{"caption":"Digest"},"6":{"caption":"OAUTH 2.0"},"0":{"description":"The authentication protocol is unknown.","caption":"Unknown"},"1":{"caption":"NTLM"},"2":{"caption":"Kerberos"},"99":{"description":"The authentication protocol is not mapped. See the auth_protocol attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"OpenID"},"5":{"caption":"SAML"},"7":{"caption":"PAP"},"8":{"caption":"CHAP"},"9":{"caption":"EAP"},"10":{"caption":"RADIUS"},"11":{"caption":"Basic Authentication"},"12":{"caption":"LDAP"}},"description":"The normalized identifier of the authorization protocol used by the SCIM resource.","requirement":"optional","caption":"Auth Protocol ID","sibling":"auth_protocol","type_name":"Integer"},"created_time":{"type":"timestamp_t","description":"When the SCIM resource was added to the service provider.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"error_message":{"type":"string_t","description":"Message or code associated with the last encountered error.","requirement":"optional","caption":"Last Error Message","type_name":"String"},"is_group_provisioning_enabled":{"type":"boolean_t","description":"Indicates whether the SCIM resource is configured to provision groups, automatically or otherwise.","requirement":"optional","caption":"SCIM Group Provisioning Enabled","type_name":"Boolean"},"is_user_provisioning_enabled":{"type":"boolean_t","description":"Indicates whether the SCIM resource is configured to provision users, automatically or otherwise.","requirement":"optional","caption":"SCIM User Provisioning Enabled","type_name":"Boolean"},"last_run_time":{"type":"timestamp_t","description":"Timestamp of the most recent successful synchronization.","requirement":"optional","caption":"Last Sync Time","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The most recent time when the SCIM resource was updated at the service provider.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"rate_limit":{"type":"integer_t","description":"Maximum number of requests allowed by the SCIM resource within a specified time frame to avoid throttling.","requirement":"optional","caption":"Rate Limit","type_name":"Integer"},"scim_group_schema":{"type":"json_t","description":"SCIM provides a schema for representing groups, identified using the following schema URI: urn:ietf:params:scim:schemas:core:2.0:Group as defined in RFC-7634. This attribute will capture key-value pairs for the scheme implemented in a SCIM resource.","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC spec.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"requirement":"recommended","caption":"SCIM Group Schema","type_name":"JSON"},"scim_user_schema":{"type":"json_t","description":"SCIM provides a resource type for user resources. The core schema for user is identified using the following schema URI: urn:ietf:params:scim:schemas:core:2.0:User as defined in RFC-7634. his attribute will capture key-value pairs for the scheme implemented in a SCIM resource. This object is inclusive of both the basic and Enterprise User Schema Extension.","references":[{"description":"System for Cross-domain Identity Management (SCIM) RFC spec.","url":"https://datatracker.ietf.org/doc/html/rfc7643"}],"requirement":"recommended","caption":"SCIM User Schema","type_name":"JSON"},"state_id":{"type":"integer_t","enum":{"3":{"description":"The SCIM resource is in a Failed state.","caption":"Failed"},"0":{"description":"The provisioning state of the SCIM resource is unknown.","caption":"Unknown"},"1":{"description":"The SCIM resource is Pending activation or creation.","caption":"Pending"},"2":{"description":"The SCIM resource is in an Active state, or otherwise enabled.","caption":"Active"},"99":{"description":"The provisioning state of the SCIM resource is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The SCIM resource is in a Deleted state, or otherwise disabled.","caption":"Deleted"}},"description":"The normalized state ID of the SCIM resource to reflect its activation status.","requirement":"optional","caption":"State ID","sibling":"state","type_name":"Integer"},"uid_alt":{"type":"string_t","description":"A String that is an identifier for the resource as defined by the provisioning client. The externalId may simplify identification of a resource between the provisioning client and the service provider by allowing the client to use a filter to locate the resource with an identifier from the provisioning domain, obviating the need to store a local mapping between the provisioning domain's identifier of the resource and the identifier used by the service provider.","requirement":"optional","caption":"External ID","type_name":"String"},"url_string":{"type":"url_t","description":"The primary URL for SCIM API requests.","requirement":"optional","caption":"SCIM Endpoint URL","type_name":"URL String"},"vendor_name":{"type":"string_t","description":"Name of the vendor or service provider implementing SCIM. E.g., Okta, Auth0, Microsoft.","requirement":"optional","caption":"Service Provider","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"When the SCIM resource was added to the service provider.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"last_run_time_dt":{"type":"datetime_t","description":"Timestamp of the most recent successful synchronization.","requirement":"optional","profiles":["datetime"],"caption":"Last Sync Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The most recent time when the SCIM resource was updated at the service provider.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"scim","description":"The System for Cross-domain Identity Management (SCIM) Configuration object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in RFC-7634","extends":"object","profiles":["datetime"],"caption":"SCIM"},"endpoint":{"attributes":{"name":{"type":"string_t","description":"The short name of the endpoint.","requirement":"recommended","caption":"Name","type_name":"String"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the endpoint or was last logged into it.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The endpoint type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.","requirement":"optional","caption":"Type","type_name":"String"},"os":{"type":"object_t","description":"The endpoint operating system.","requirement":"optional","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"domain":{"type":"string_t","description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint.","requirement":"optional","caption":"Domain","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address of the endpoint, in either IPv4 or IPv6 format.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"pool":{"type":"object_t","description":"The pool of desktops or virtual machines to which the endpoint belongs.","requirement":"optional","object_type":"group","caption":"Pool","object_name":"Group"},"location":{"type":"object_t","description":"The geographical location of the endpoint.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"hostname":{"type":"hostname_t","description":"The fully qualified name of the endpoint.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"uid":{"type":"string_t","description":"The unique identifier of the endpoint.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"mac":{"type":"mac_t","description":"The Media Access Control (MAC) address of the endpoint.","requirement":"optional","caption":"MAC Address","type_name":"MAC Address"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A laptop computer.","caption":"Laptop"},"6":{"description":"A virtual machine.","caption":"Virtual"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A server.","caption":"Server"},"2":{"description":"A desktop computer.","caption":"Desktop"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A tablet computer.","caption":"Tablet"},"5":{"description":"A mobile phone.","caption":"Mobile"},"7":{"description":"An IOT (Internet of Things) device.","caption":"IOT"},"8":{"description":"A web browser.","caption":"Browser"},"9":{"description":"A networking firewall.","caption":"Firewall"},"10":{"description":"A networking switch.","caption":"Switch"},"11":{"description":"A networking hub.","caption":"Hub"},"12":{"description":"A networking router.","caption":"Router"},"14":{"description":"An intrusion prevention system.","caption":"IPS"},"15":{"description":"A Load Balancer device.","caption":"Load Balancer"},"13":{"description":"An intrusion detection system.","caption":"IDS"}},"description":"The endpoint type ID.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","group":"context","requirement":"recommended","profiles":["container"],"object_type":"container","caption":"Container","object_name":"Container"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","requirement":"optional","object_type":"device_hw_info","caption":"Hardware Info","object_name":"Device Hardware Info"},"instance_uid":{"type":"string_t","description":"The unique identifier of a VM instance.","requirement":"recommended","caption":"Instance ID","type_name":"String"},"interface_name":{"type":"string_t","description":"The name of the network interface (e.g. eth2).","requirement":"recommended","caption":"Network Interface Name","type_name":"String"},"interface_uid":{"type":"string_t","description":"The unique identifier of the network interface.","requirement":"recommended","caption":"Network Interface ID","type_name":"String"},"mac_vendor":{"type":"string_t","description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address.","references":[{"description":"IEEE Registration Authority","url":"https://standards.ieee.org/products-programs/regauth/"}],"requirement":"optional","caption":"MAC Vendor","type_name":"String"},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","group":"context","requirement":"recommended","profiles":["container"],"caption":"Namespace PID","type_name":"Integer"},"subnet_uid":{"type":"string_t","description":"The unique identifier of a virtual subnet.","requirement":"optional","caption":"Subnet UID","type_name":"String"},"vlan_uid":{"type":"string_t","description":"The Virtual LAN identifier.","requirement":"optional","caption":"VLAN","type_name":"String"},"vpc_uid":{"type":"string_t","description":"The unique identifier of the Virtual Private Cloud (VPC).","requirement":"optional","caption":"VPC UID","type_name":"String"},"zone":{"type":"string_t","description":"The network zone or LAN segment.","requirement":"optional","caption":"Network Zone","type_name":"String"}},"name":"endpoint","description":"The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints.","extends":"_entity","constraints":{"at_least_one":["ip","uid","name","hostname","instance_uid","interface_uid","interface_name"]},"references":[{"description":"D3FEND™ Ontology d3f:Host.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ComputerNetworkNode/"}],"profiles":["container"],"caption":"Endpoint","observable":20},"web_resource":{"attributes":{"data":{"type":"json_t","description":"Details of the web resource, e.g, file details, search results or application-defined resource.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the web resource.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The web resource type as defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"desc":{"type":"string_t","description":"Description of the web resource.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"resource_uid_t","description":"The unique identifier of the web resource.","requirement":"recommended","caption":"Unique ID","type_name":"Resource UID"},"labels":{"type":"string_t","description":"The list of labels associated to the resource.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the resource.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"created_time":{"type":"timestamp_t","description":"The time when the resource was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"modified_time":{"type":"timestamp_t","description":"The time when the resource was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"uid_alt":{"type":"resource_uid_t","description":"The alternative unique identifier of the resource.","requirement":"optional","caption":"Alternate ID","type_name":"Resource UID"},"url_string":{"type":"url_t","description":"The URL pointing towards the source of the web resource.","requirement":"recommended","caption":"URL String","type_name":"URL String"},"created_time_dt":{"type":"datetime_t","description":"The time when the resource was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the resource was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"web_resource","description":"The Web Resource object describes characteristics of a web resource that was affected by the activity/event.","extends":"_resource","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:WebResource.","url":"https://d3fend.mitre.org/dao/artifact/d3f:WebResource/"}],"profiles":["data_classification","datetime"],"caption":"Web Resource"},"network_connection_info":{"attributes":{"session":{"type":"object_t","description":"The authenticated user or service session.","requirement":"optional","object_type":"session","caption":"Session","object_name":"Session"},"uid":{"type":"string_t","description":"The unique identifier of the connection.","requirement":"recommended","caption":"Connection UID","type_name":"String"},"boundary":{"type":"string_t","description":"The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source.

For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

","requirement":"optional","caption":"Boundary","type_name":"String"},"protocol_name":{"type":"string_t","description":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: tcp or udp.","references":[{"description":"IANA Protocol Numbers","url":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}],"requirement":"recommended","caption":"Protocol Name","type_name":"String"},"direction":{"type":"string_t","description":"The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Direction","type_name":"String"},"boundary_id":{"type":"integer_t","enum":{"3":{"description":"External network traffic between two endpoints on the Internet or outside the network.","caption":"External"},"6":{"description":"Through a virtual private gateway","caption":"Virtual Private Gateway"},"0":{"description":"The connection boundary is unknown.","caption":"Unknown"},"1":{"description":"Local network traffic on the same endpoint.","caption":"Localhost"},"2":{"description":"Internal network traffic between two endpoints inside network.","caption":"Internal"},"99":{"description":"The boundary is not mapped. See the boundary attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Through another resource in the same VPC","caption":"Same VPC"},"5":{"description":"Through an Internet gateway or a gateway VPC endpoint","caption":"Internet/VPC Gateway"},"7":{"description":"Through an intra-region VPC peering connection","caption":"Intra-region VPC"},"8":{"description":"Through an inter-region VPC peering connection","caption":"Inter-region VPC"},"9":{"description":"Through a local gateway","caption":"Local Gateway"},"10":{"description":"Through a gateway VPC endpoint (Nitro-based instances only)","caption":"Gateway VPC"},"11":{"description":"Through an Internet gateway (Nitro-based instances only)","caption":"Internet Gateway"}},"description":"

The normalized identifier of the boundary of the connection.

For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

","requirement":"recommended","caption":"Boundary ID","sibling":"boundary","type_name":"Integer"},"community_uid":{"type":"string_t","description":"The Community ID of the network connection.","source":"community_id","references":[{"description":"Community ID definition.","url":"https://github.com/corelight/community-id-spec"}],"requirement":"optional","caption":"Community ID","type_name":"String"},"direction_id":{"type":"integer_t","enum":{"3":{"description":"Lateral network connection. The connection originated from inside the network, destined for services on the inside network.","caption":"Lateral"},"0":{"description":"The connection direction is unknown.","caption":"Unknown"},"1":{"description":"Inbound network connection. The connection originated from the Internet or outside network, destined for services on the inside network.","caption":"Inbound"},"2":{"description":"Outbound network connection. The connection originated from inside the network, destined for services on the Internet or outside network.","caption":"Outbound"},"99":{"description":"The direction is not mapped. See the direction attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Local network connection (localhost). The connection is intra-device, originating from and destined for services running on the same device.","caption":"Local"}},"description":"The normalized identifier of the direction of the initiated connection, traffic, or email.","requirement":"required","caption":"Direction ID","sibling":"direction","type_name":"Integer"},"flag_history":{"type":"string_t","description":"The Connection Flag History summarizes events in a network connection. For example flags ShAD representing SYN, SYN/ACK, ACK and Data exchange.","references":[{"description":"Zeek History","url":"https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is"}],"requirement":"optional","caption":"Connection Flag History","type_name":"String"},"protocol_num":{"type":"integer_t","description":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: 6 for TCP and 17 for UDP.","references":[{"description":"IANA Protocol Numbers","url":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}],"requirement":"recommended","caption":"Protocol Number","type_name":"Integer"},"protocol_ver":{"type":"string_t","description":"The Internet Protocol version.","requirement":"optional","caption":"IP Version","type_name":"String"},"protocol_ver_id":{"type":"integer_t","enum":{"6":{"caption":"Internet Protocol version 6 (IPv6)"},"0":{"description":"The protocol version is unknown.","caption":"Unknown"},"99":{"description":"The protocol version is not mapped. See the protocol_ver attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Internet Protocol version 4 (IPv4)"}},"description":"The Internet Protocol version identifier.","requirement":"recommended","caption":"IP Version ID","sibling":"protocol_ver","type_name":"Integer"},"tcp_flags":{"type":"integer_t","description":"The network connection TCP header flags (i.e., control bits).","requirement":"optional","caption":"TCP Flags","type_name":"Integer"}},"name":"network_connection_info","description":"The Network Connection Information object describes characteristics of an OSI Transport Layer communication, including TCP and UDP.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:NetworkSession","url":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/"}],"caption":"Network Connection Information"},"cwe":{"attributes":{"uid":{"type":"string_t","description":"The Common Weakness Enumeration unique number assigned to a specific weakness. A CWE Identifier begins \"CWE\" followed by a sequence of digits that acts as a unique identifier. For example: CWE-123.","requirement":"required","caption":"CWE ID","type_name":"String","observable":17},"caption":{"type":"string_t","description":"The caption assigned to the Common Weakness Enumeration unique identifier.","requirement":"optional","caption":"Caption","type_name":"String"},"src_url":{"type":"url_t","description":"URL pointing to the CWE Specification. For more information see CWE.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"cwe","description":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the Common Weakness Enumeration (CWE) catalog.","extends":"object","caption":"CWE"},"whois":{"attributes":{"status":{"type":"string_t","description":"The status of a domain and its ability to be transferred, e.g., clientTransferProhibited.","requirement":"recommended","caption":"Domain Status","type_name":"String"},"domain":{"type":"string_t","description":"The domain name corresponding to the WHOIS record.","requirement":"recommended","caption":"Domain","type_name":"String"},"registrar":{"type":"string_t","description":"The domain registrar.","requirement":"recommended","caption":"Domain Registrar","type_name":"String"},"subdomains":{"type":"string_t","description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs).","is_array":true,"requirement":"optional","caption":"Subdomains","type_name":"String"},"subnet":{"type":"subnet_t","description":"The IP address block (CIDR) associated with a domain.","requirement":"optional","caption":"Subnet Block","type_name":"Subnet"},"autonomous_system":{"type":"object_t","description":"The autonomous system information associated with a domain.","requirement":"optional","object_type":"autonomous_system","caption":"Autonomous System","object_name":"Autonomous System"},"created_time":{"type":"timestamp_t","description":"When the domain was registered or WHOIS entry was created.","requirement":"recommended","caption":"Registered At","type_name":"Timestamp"},"dnssec_status":{"type":"string_t","description":"The normalized value of dnssec_status_id.","requirement":"optional","caption":"DNSSEC Status","type_name":"String"},"dnssec_status_id":{"type":"integer_t","enum":{"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"The related domain enables the signing of DNS records using DNSSEC.","caption":"Signed"},"2":{"description":"The related domain does not enable the signing of DNS records using DNSSEC.","caption":"Unsigned"},"99":{"description":"The DNSSEC status is not mapped. See the dnssec_status attribute, which contains a data source specific value.","caption":"Other"}},"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain.","requirement":"recommended","caption":"DNSSEC Status ID","sibling":"dnssec_status","type_name":"Integer"},"domain_contacts":{"type":"object_t","description":"An array of Domain Contact objects.","is_array":true,"requirement":"recommended","object_type":"domain_contact","caption":"Domain Contacts","object_name":"Domain Contact"},"email_addr":{"type":"email_t","description":"The email address for the registrar's abuse contact","requirement":"optional","caption":"Registrar Abuse Email Address","type_name":"Email Address"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","requirement":"optional","caption":"ISP Name","type_name":"String"},"isp_org":{"type":"string_t","description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.","requirement":"optional","caption":"ISP Org","type_name":"String"},"last_seen_time":{"type":"timestamp_t","description":"When the WHOIS record was last updated or seen at.","requirement":"recommended","caption":"Last Updated At","type_name":"Timestamp"},"name_servers":{"type":"string_t","description":"A collection of name servers related to a domain registration or other record.","is_array":true,"requirement":"recommended","caption":"Name Servers","type_name":"String"},"phone_number":{"type":"string_t","description":"The phone number for the registrar's abuse contact","requirement":"optional","caption":"Registrar Abuse Phone Number","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"When the domain was registered or WHOIS entry was created.","requirement":"optional","profiles":["datetime"],"caption":"Registered At","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"When the WHOIS record was last updated or seen at.","requirement":"optional","profiles":["datetime"],"caption":"Last Updated At","type_name":"Datetime"}},"name":"whois","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","extends":"object","profiles":["datetime"],"caption":"WHOIS"},"reputation":{"attributes":{"base_score":{"type":"float_t","description":"The reputation score as reported by the event source.","requirement":"required","caption":"Reputation Score","type_name":"Float"},"provider":{"type":"string_t","description":"The provider of the reputation information.","requirement":"recommended","caption":"Provider","type_name":"String"},"score":{"type":"string_t","description":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Reputation Score","type_name":"String"},"score_id":{"type":"integer_t","enum":{"3":{"description":"Reasonable history of good behavior.","caption":"Probably Safe"},"6":{"description":"Starting to establish a history of suspicious or risky behavior.","caption":"Exercise Caution"},"0":{"description":"The reputation score is unknown.","caption":"Unknown"},"1":{"description":"Long history of good behavior.","caption":"Very Safe"},"2":{"description":"Consistently good behavior.","caption":"Safe"},"99":{"description":"The reputation score is not mapped. See the rep_score attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Starting to establish a history of normal behavior.","caption":"Leans Safe"},"5":{"description":"No established history of normal behavior.","caption":"May not be Safe"},"7":{"description":"A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious).","caption":"Suspicious/Risky"},"8":{"description":"Strong possibility of maliciousness.","caption":"Possibly Malicious"},"9":{"description":"Indicators of maliciousness.","caption":"Probably Malicious"},"10":{"description":"Proven evidence of maliciousness.","caption":"Malicious"}},"description":"The normalized reputation score identifier.","requirement":"required","caption":"Reputation Score ID","sibling":"score","type_name":"Integer"}},"name":"reputation","description":"The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).","extends":"object","caption":"Reputation"},"network_interface":{"attributes":{"name":{"type":"string_t","description":"The name of the network interface.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of network interface.","requirement":"optional","caption":"Type","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address associated with the network interface.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"hostname":{"type":"hostname_t","description":"The hostname associated with the network interface.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"uid":{"type":"string_t","description":"The unique identifier for the network interface.","requirement":"optional","caption":"Unique ID","type_name":"String"},"mac":{"type":"mac_t","description":"The MAC address of the network interface.","requirement":"recommended","caption":"MAC Address","type_name":"MAC Address"},"namespace":{"type":"string_t","description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate.","requirement":"optional","caption":"Namespace","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Mobile"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Wired"},"2":{"caption":"Wireless"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Tunnel"}},"description":"The network interface type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"open_ports":{"type":"object_t","description":"The list of open ports on a network interface, including port numbers and associated protocol information.","is_array":true,"requirement":"optional","object_type":"port_info","caption":"Open Ports","object_name":"Port Information"},"subnet_prefix":{"type":"integer_t","description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet.","requirement":"optional","caption":"Subnet Prefix Length","type_name":"Integer"}},"name":"network_interface","description":"The Network Interface object describes the type and associated attributes of a physical or virtual network interface.","extends":"_entity","constraints":{"at_least_one":["ip","mac","name","hostname","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:NetworkInterfaceCard.","url":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkInterfaceCard/"}],"caption":"Network Interface"},"observable":{"attributes":{"name":{"type":"string_t","description":"The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The observable value type name.","requirement":"optional","caption":"Type","type_name":"String"},"value":{"type":"string_t","description":"The value associated with the observable attribute. The meaning of the value depends on the observable type.
If the name refers to a scalar attribute, then the value is the value of the attribute.
If the name refers to an object attribute, then the value is not populated.","requirement":"optional","caption":"Value","type_name":"String"},"type_uid":{"type":"long_t","description":"The OCSF event type UID (type_uid) of the source event that this observable was extracted from. This field enables filtering and categorizing observables by their originating event type. For example: 300101 for Network Activity (class_uid 3001) with activity_id 1.","requirement":"optional","caption":"Type ID","sibling":"type_name","type_name":"Long"},"type_id":{"type":"integer_t","enum":{"30":{"description":"Observable by Object.
The Fingerprint object provides detailed information about a fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key, file content, or application implementation. It contains the algorithm or scheme and value of the fingerprint, enabling efficient and reliable identification of the associated data.","caption":"Fingerprint"},"38":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"name\" for the Resource Details Object.","caption":"Resource Details Object: name"},"29":{"description":"Observable by Object.
The registry value object describes a Windows registry value.","caption":"Registry Value"},"45":{"description":"Observable by Dictionary Type.
The full path to the file. For example: For example:
c:\\windows\\system32\\svchost.exe.","caption":"File Path"},"40":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"subject\" for the Email Object.","caption":"Email Object: subject"},"22":{"description":"Observable by Object.
The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.","caption":"Email"},"19":{"description":"Observable by Dictionary Attribute.
The unique identifier of the user's credential. For example, AWS Access Key ID.","caption":"User Credential ID"},"8":{"description":"Observable by Dictionary Type.
Fingerprint. A value, in any format, that maps an arbitrarily large data item to a much shorter string that uniquely identifies the original data. Examples include cryptographic hashing of a file, code signing, and Network Protocol Fingerprinting (NPF).

Note about name. The type name file_hast_t and the caption "Hash" are used for legacy reasons. This type has been generalized from a file hash to a general fingerprint. The existing type name and caption were retained for backwards compatibility.","caption":"Hash"},"47":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Device Object.","caption":"Device Object: uid"},"13":{"description":"Observable by Dictionary Attribute.
The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used.","caption":"Command Line"},"33":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Group Object.","caption":"Group Object: uid"},"10":{"description":"Observable by Dictionary Type.
Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID.","caption":"Resource UID"},"1":{"description":"Observable by Dictionary Type.
Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:
r2-d2.example.com.,
mx.example.com","caption":"Hostname"},"99":{"description":"The observable data type is not mapped. See the type attribute, which may contain data source specific value.","caption":"Other"},"20":{"description":"Observable by Object.
The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints.","caption":"Endpoint"},"3":{"description":"Observable by Dictionary Type.
Media Access Control (MAC) address. For example:
18:36:F3:98:4F:9A.","caption":"MAC Address"},"15":{"description":"Observable by Dictionary Attribute.
The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.","caption":"Process ID"},"34":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"name\" for the Account Object.","caption":"Account Object: name"},"42":{"description":"Observable by Dictionary Attribute.
The email header Message-ID value, as defined by RFC 5322.","caption":"Message UID"},"2":{"description":"Observable by Dictionary Type.
Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:
192.168.200.24,
2001:0db8:85a3:0000:0000:8a2e:0370:7334.","caption":"IP Address"},"25":{"description":"Observable by Object.
The Process object describes a running instance of a launched program.","caption":"Process"},"37":{"description":"Observable by Dictionary Attribute.
The serial number that pertains to the object. See specific usage.","caption":"Serial Number"},"16":{"description":"Observable by Dictionary Attribute.
The request header that identifies the operating system and web browser.","caption":"HTTP User-Agent"},"39":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Process Entity Object.","caption":"Process Entity Object: uid"},"27":{"description":"Observable by Object.
The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","caption":"Container"},"7":{"description":"Observable by Dictionary Type.
File name. For example:
text-file.txt.","caption":"File Name"},"23":{"description":"Observable by Object.
The Uniform Resource Locator (URL) object describes the characteristics of a URL.","caption":"Uniform Resource Locator"},"32":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"name\" for the Group Object.","caption":"Group Object: name"},"18":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the CVE Object.","caption":"CVE Object: uid"},"36":{"description":"Observable by Dictionary Attribute.
The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated.","caption":"Script Content"},"48":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Network Endpoint Object.","caption":"Network Endpoint Object: uid"},"17":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the CWE Object.","caption":"CWE Object: uid"},"26":{"description":"Observable by Object.
The Geo Location object describes a geographical location, usually associated with an IP address.","caption":"Geo Location"},"35":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Account Object.","caption":"Account Object: uid"},"4":{"description":"Observable by Dictionary Type.
User name. For example:
john_doe.","caption":"User Name"},"43":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"name\" for the Registry Value Object.","caption":"Registry Value Object: name"},"21":{"description":"Observable by Object.
The User object describes the characteristics of a user/person or a security principal.","caption":"User"},"41":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Email Object.","caption":"Email Object: uid"},"14":{"description":"Observable by Dictionary Attribute.
The ISO 3166-1 Alpha-2 country code.

Note: The two letter country code should be capitalized. For example: US or CA.

","caption":"Country"},"28":{"description":"Observable by Object.
The registry key object describes a Windows registry key.","caption":"Registry Key"},"6":{"description":"Observable by Dictionary Type.
Uniform Resource Locator (URL) string. For example:
http://www.example.com/download/trouble.exe.","caption":"URL String"},"0":{"description":"Unknown observable data type.","caption":"Unknown"},"44":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the Advisory Object.","caption":"Advisory Object: uid"},"11":{"description":"Observable by Dictionary Type.
The TCP/UDP port number. For example:
80,
22.","caption":"Port"},"9":{"description":"Observable by Dictionary Type.
Process name. For example:
Notepad.","caption":"Process Name"},"5":{"description":"Observable by Dictionary Type.
Email address. For example:
john_doe@example.com.","caption":"Email Address"},"12":{"description":"Observable by Dictionary Type.
The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:
192.168.1.0/24,
2001:0db8:85a3:0000::/64","caption":"Subnet"},"31":{"description":"Observable by Object-Specific Attribute.
Object-specific attribute \"uid\" for the User Object.","caption":"User Object: uid"},"24":{"description":"Observable by Object.
The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.","caption":"File"},"46":{"description":"Observable by Dictionary Type.
Full path of registry key.","caption":"Registry Key Path"}},"description":"The observable value type identifier.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"event_uid":{"type":"string_t","description":"The unique identifier (metadata.uid) of the source OCSF event from which this observable was extracted. This field enables linking observables back to their originating event data when observables are stored in a separate location or system.","requirement":"optional","caption":"Event UID","type_name":"String"},"reputation":{"type":"object_t","description":"Contains the original and normalized reputation scores.","requirement":"optional","object_type":"reputation","caption":"Reputation Scores","object_name":"Reputation"}},"name":"observable","description":"The observable object is a pivot element that contains related information found in many places in the event.","extends":"object","references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/Articles/Defining and Using Observables.md"}],"caption":"Observable"},"ticket":{"attributes":{"status":{"type":"string_t","description":"The status of the ticket normalized to the caption of the status_id value. In the case of 99, this value should as defined by the source.","requirement":"optional","caption":"Ticket Status","type_name":"String"},"type":{"type":"string_t","description":"The linked ticket type determines whether the ticket is internal or in an external ticketing system.","requirement":"optional","caption":"Ticket Type","type_name":"String"},"title":{"type":"string_t","description":"The title of the ticket.","requirement":"optional","caption":"Title","type_name":"String"},"uid":{"type":"string_t","description":"Unique identifier of the ticket.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Internal"},"2":{"caption":"External"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier for the ticket type.","requirement":"optional","caption":"Ticket Type ID","sibling":"type","type_name":"Integer"},"src_url":{"type":"url_t","description":"The url of a ticket in the ticket system.","requirement":"recommended","caption":"Source URL","type_name":"URL String"},"status_details":{"type":"string_t","description":"A list of contextual descriptions of the status, status_id values.","is_array":true,"requirement":"optional","caption":"Status Details","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"Relevant parties have been notified about the ticket.","caption":"Notified"},"6":{"description":"The ticket has been completed and closed.","caption":"Closed"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The ticket is new and yet to be reviewed.","caption":"New"},"2":{"description":"The ticket is actively being worked on.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Work on the ticket is temporarily suspended.","caption":"On Hold"},"5":{"description":"The ticket is resolved and a solution is implemented, pending confirmation or verification from the requestor.","caption":"Resolved"},"7":{"description":"The ticket has been canceled and will not be processed.","caption":"Canceled"},"8":{"description":"The ticket was previously closed, but has been reopened.","caption":"Reopened"}},"description":"The normalized identifier for the ticket status.","requirement":"optional","caption":"Ticket Status ID","sibling":"status","type_name":"Integer"}},"name":"ticket","description":"The Ticket object represents ticket in the customer's IT Service Management (ITSM) systems like ServiceNow, Jira, etc.","extends":"object","constraints":{"at_least_one":["src_url","uid"]},"caption":"Ticket"},"feature":{"attributes":{"name":{"type":"string_t","description":"The name of the feature.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The version of the feature.","requirement":"recommended","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the feature.","requirement":"recommended","caption":"Unique ID","type_name":"String"}},"name":"feature","description":"The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Feature"},"affected_code":{"attributes":{"owner":{"type":"object_t","description":"Details about the user that owns the affected file.","requirement":"optional","object_type":"user","caption":"Owner","object_name":"User"},"file":{"type":"object_t","description":"Details about the file that contains the affected code block.","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"end_line":{"type":"integer_t","description":"The line number of the last line of code block identified as vulnerable.","requirement":"recommended","caption":"End Line","type_name":"Integer"},"end_column":{"type":"integer_t","description":"The column number of the last part of the assessed code identified as vulnerable.","requirement":"recommended","caption":"End Column","type_name":"Integer"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"rule":{"type":"object_t","description":"Details about the specific rule, e.g., those defined as part of a larger policy, that triggered the finding.","requirement":"recommended","object_type":"rule","caption":"Related Rule","object_name":"Rule"},"start_column":{"type":"integer_t","description":"The column number of the first part of the assessed code identified as vulnerable.","requirement":"recommended","caption":"Start Column","type_name":"Integer"},"start_line":{"type":"integer_t","description":"The line number of the first line of code block identified as vulnerable.","requirement":"recommended","caption":"Start Line","type_name":"Integer"}},"name":"affected_code","description":"The Affected Code object describes details about a code block identified as vulnerable.","extends":"object","profiles":["data_classification"],"caption":"Affected Code"},"finding_info":{"attributes":{"title":{"type":"string_t","description":"A title or a brief phrase summarizing the reported finding.","requirement":"recommended","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"Details about the product that reported the finding.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"desc":{"type":"string_t","description":"The description of the reported finding.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the reported finding.","requirement":"required","caption":"Unique ID","type_name":"String"},"types":{"type":"string_t","description":"One or more types of the reported finding.","is_array":true,"requirement":"optional","caption":"Types","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated with the finding.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"attacks":{"type":"object_t","description":"The MITRE ATT&CK® technique and associated tactics related to the finding.","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"analytic":{"type":"object_t","description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion.","requirement":"recommended","object_type":"analytic","caption":"Analytic","object_name":"Analytic"},"attack_graph":{"type":"object_t","description":"An Attack Graph describes possible routes an attacker could take through an environment. It describes relationships between resources and their findings, such as malware detections, vulnerabilities, misconfigurations, and other security actions.","group":"context","references":[{"description":"MS Defender description of Attack Path","url":"https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path"},{"description":"SentinelOne Attack Path documentation","url":"https://www.sentinelone.com/cybersecurity-101/cybersecurity/attack-path-analysis/"}],"requirement":"optional","object_type":"graph","caption":"Attack Graph","object_name":"Graph"},"created_time":{"type":"timestamp_t","description":"The time when the finding was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"data_sources":{"type":"string_t","description":"A list of data sources utilized in generation of the finding.","is_array":true,"requirement":"optional","caption":"Data Sources","type_name":"String"},"first_seen_time":{"type":"timestamp_t","description":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed.

It can differ from the created_time timestamp, which reflects the time this finding was created.

","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"kill_chain":{"type":"object_t","description":"The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.","is_array":true,"requirement":"optional","object_type":"kill_chain_phase","caption":"Kill Chain","object_name":"Kill Chain Phase"},"last_seen_time":{"type":"timestamp_t","description":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.

It can differ from the modified_time timestamp, which reflects the time this finding was last modified.

","requirement":"optional","caption":"Last Seen","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The time when the finding was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"product_uid":{"type":"string_t","description":"The unique identifier of the product that reported the finding.","requirement":"optional","caption":"Product Identifier","type_name":"String","@deprecated":{"message":"Use the uid attribute in the product object instead. See specific usage.","since":"1.4.0"}},"related_analytics":{"type":"object_t","description":"Other analytics related to this finding.","is_array":true,"requirement":"optional","object_type":"analytic","caption":"Related Analytics","object_name":"Analytic"},"related_events":{"type":"object_t","description":"Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF.","is_array":true,"requirement":"optional","object_type":"related_event","caption":"Related Events/Findings","object_name":"Related Event/Finding"},"related_events_count":{"type":"integer_t","description":"Number of related events or findings.","requirement":"optional","caption":"Related Events/Findings Count","type_name":"Integer"},"src_url":{"type":"url_t","description":"The URL pointing to the source of the finding.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"traits":{"type":"object_t","description":"The list of key traits or characteristics extracted from the finding.","is_array":true,"requirement":"optional","object_type":"trait","caption":"Traits","object_name":"Trait"},"uid_alt":{"type":"string_t","description":"The alternative unique identifier of the reported finding.","requirement":"optional","caption":"Alternate ID","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time when the finding was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"first_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed.

It can differ from the created_time timestamp, which reflects the time this finding was created.

","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.

It can differ from the modified_time timestamp, which reflects the time this finding was last modified.

","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the finding was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"finding_info","description":"The Finding Information object describes metadata related to a security finding generated by a security tool or system.","extends":"object","profiles":["data_classification","datetime"],"caption":"Finding Information"},"edge":{"attributes":{"data":{"type":"json_t","description":"Additional data about the edge such as weight, distance, or custom properties.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The human-readable name or label for the edge.","requirement":"recommended","caption":"Name","type_name":"String"},"relation":{"type":"string_t","description":"The type of relationship between nodes (e.g. is-attached-to , depends-on, etc).","requirement":"recommended","caption":"Relation","type_name":"String"},"uid":{"type":"string_t","description":"Unique identifier of the edge.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"source":{"type":"string_t","description":"The unique identifier of the node where the edge originates.","requirement":"required","caption":"Source","type_name":"String"},"target":{"type":"string_t","description":"The unique identifier of the node where the edge terminates.","requirement":"required","caption":"Target","type_name":"String"},"is_directed":{"type":"boolean_t","description":"Indicates whether the edge is (true) or undirected (false).","requirement":"optional","caption":"Directed","type_name":"Boolean"}},"name":"edge","description":"Represents a connection or relationship between two nodes in a graph.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"JSON graph specification.","url":"https://github.com/jsongraph/json-graph-specification/"}],"caption":"Edge"},"resource_details":{"attributes":{"data":{"type":"json_t","description":"Additional data describing the resource.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the resource.","requirement":"recommended","caption":"Name","type_name":"String","observable":38},"owner":{"type":"object_t","description":"The details of the entity that owns the resource. This object includes properties such as the owner's name, unique identifier, type, domain, and other relevant attributes that help identify the resource owner within the environment.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The resource type as defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The version of the resource. For example 1.2.3.","requirement":"optional","caption":"Version","type_name":"String"},"ip":{"type":"ip_t","description":"The IP address of the resource, in either IPv4 or IPv6 format.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"group":{"type":"object_t","description":"The name of the related resource group.","requirement":"optional","object_type":"group","caption":"Group","object_name":"Group"},"hostname":{"type":"hostname_t","description":"The fully qualified name of the resource.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"uid":{"type":"resource_uid_t","description":"The unique identifier of the resource.","requirement":"recommended","caption":"Unique ID","type_name":"Resource UID"},"labels":{"type":"string_t","description":"The list of labels associated to the resource.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"namespace":{"type":"string_t","description":"The namespace is useful when similar entities exist that you need to keep separate.","requirement":"optional","caption":"Namespace","type_name":"String"},"role":{"type":"string_t","description":"The role of the resource in the context of the event or finding, normalized to the caption of the role_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Role","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the resource.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"cloud_partition":{"type":"string_t","description":"The logical grouping or isolated segment within a cloud provider's infrastructure where the resource is located. Examples include AWS partitions (aws, aws-cn, aws-us-gov), Azure cloud environments (AzureCloud, AzureUSGovernment, AzureChinaCloud), or similar logical divisions in other cloud providers.","requirement":"optional","profiles":["cloud"],"caption":"Cloud Partition","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the resource was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"criticality":{"type":"string_t","description":"The criticality of the resource as defined by the event source.","requirement":"optional","caption":"Criticality","type_name":"String"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"is_backed_up":{"type":"boolean_t","description":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the cloudBackupEnabled value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service.","requirement":"optional","caption":"Back Ups Configured","type_name":"Boolean"},"modified_time":{"type":"timestamp_t","description":"The time when the resource was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"provider":{"type":"string_t","description":"The cloud service provider that hosts or manages the resource. This field is typically used when the resource is managed by a different provider than the one generating the event or finding. Examples include AWS, Azure, GCP (Google Cloud Platform), Oracle Cloud, IBM Cloud, Alibaba Cloud, or other public, private, or hybrid cloud providers.","requirement":"optional","profiles":["cloud"],"caption":"Cloud Provider","type_name":"String"},"region":{"type":"string_t","description":"The cloud region where the resource is hosted, as defined by the cloud provider. This represents the physical or logical geographic area containing the infrastructure supporting the resource. Examples include AWS regions (us-east-1, eu-west-1), Azure regions (East US, West Europe), GCP regions (us-central1, europe-west1), or Oracle Cloud regions (us-ashburn-1, uk-london-1).","requirement":"optional","profiles":["cloud"],"caption":"Region","type_name":"String"},"resource_relationship":{"type":"object_t","description":"A graph representation showing how this resource relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections.","requirement":"optional","object_type":"graph","caption":"Resource Relationship","object_name":"Graph"},"role_id":{"type":"integer_t","enum":{"3":{"description":"The resource was impacted or affected by the event/finding.","caption":"Affected"},"0":{"description":"The role is unknown.","caption":"Unknown"},"1":{"description":"The resource is the primary target or subject of the event/finding.","caption":"Target"},"2":{"description":"The resource is acting as the initiator or performer in the context of the event/finding.","caption":"Actor"},"99":{"description":"The role is not mapped. See the role attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The resource is related to or associated with the event/finding.","caption":"Related"}},"description":"The normalized identifier of the resource's role in the context of the event or finding.","requirement":"recommended","caption":"Role ID","sibling":"role","type_name":"Integer"},"uid_alt":{"type":"resource_uid_t","description":"The alternative unique identifier of the resource.","requirement":"optional","caption":"Alternate ID","type_name":"Resource UID"},"zone":{"type":"string_t","description":"The availability zone within a cloud region where the resource is located. Examples include AWS availability zones (us-east-1a, us-east-1b), Azure availability zones (1, 2, 3 within a region), GCP zones (us-central1-a, us-central1-b), or Oracle Cloud availability domains (AD-1, AD-2, AD-3).","requirement":"optional","profiles":["cloud"],"caption":"Cloud Availability Zone","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time when the resource was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The time when the resource was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"resource_details","description":"The Resource Details object describes details about resources that were affected by the activity/event.","extends":"_resource","constraints":{"at_least_one":["name","uid"]},"profiles":["cloud","data_classification","datetime"],"caption":"Resource Details"},"gpu_info":{"attributes":{"bus_type":{"type":"string_t","description":"The attachment bus or interface standard, normalized to the caption of the bus_type_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Bus Type","type_name":"String"},"bus_type_id":{"type":"integer_t","enum":{"3":{"description":"Peripheral Component Interconnect Express slot with 8 lanes; common for high‑performance NICs, storage controllers, and accelerators.","caption":"PCIe x8"},"6":{"description":"M.2 (NGFF) internal module form factor/connector exposing PCIe (and/or SATA/USB) for SSDs and add‑in modules.","caption":"M.2"},"0":{"description":"The bus type is unknown or not reported.","caption":"Unknown"},"1":{"description":"The device is attached directly on the motherboard or SoC (often referred to as 'integrated' or 'onboard').","caption":"Onboard"},"2":{"description":"Peripheral Component Interconnect Express slot with 16 lanes, typically used for high‑bandwidth add‑in devices.","caption":"PCIe x16"},"99":{"description":"A bus or interface standard not covered by the defined values; the exact value is reported by the event source.","caption":"Other"},"4":{"description":"Mobile PCI Express Module (MXM) Type A form factor (compact laptop/embedded GPU module).","caption":"MXM Type A"},"5":{"description":"Mobile PCI Express Module (MXM) Type B form factor (larger laptop/embedded GPU module).","caption":"MXM Type B"},"7":{"description":"Compute Express Link (CXL), an open cache‑coherent interconnect for processors, memory expansion, and accelerators built on the PCIe physical layer.","caption":"CXL"}},"description":"The normalized identifier of the attachment bus or interface standard.","requirement":"optional","caption":"Bus Type ID","sibling":"bus_type","type_name":"Integer"},"cores":{"type":"integer_t","description":"The number of processing cores or compute units for the component.","requirement":"optional","caption":"Cores","type_name":"Integer"},"model":{"type":"string_t","description":"The model name of the GPU. For example: GeForce RTX A6000, Radeon PRO W7900, or Intel Data Center GPU Max 1550.","requirement":"recommended","caption":"Model","type_name":"String"},"vendor_name":{"type":"string_t","description":"The name of the vendor of the GPU. For example: NVIDIA, AMD, or Intel.","requirement":"recommended","caption":"Vendor Name","type_name":"String"},"vram_mode":{"type":"string_t","description":"The video memory attachment mode, indicating how the VRAM hardware is integrated with the system (e.g., shared or dedicated), normalized to the caption of the vram_mode_id value. For 'Other', the exact attachment mode is defined by the event source.","requirement":"recommended","caption":"VRAM Mode","type_name":"String"},"vram_mode_id":{"type":"integer_t","enum":{"0":{"description":"The VRAM mode is unknown or not reported.","caption":"Unknown"},"1":{"description":"Video memory is allocated from system memory.","caption":"Shared"},"2":{"description":"Video memory is physically separate from system memory.","caption":"Dedicated"},"99":{"description":"A VRAM mode not covered by the defined values; the exact value is reported by the event source.","caption":"Other"}},"description":"The normalized identifier of the video memory attachment mode.","requirement":"recommended","caption":"VRAM Mode ID","sibling":"vram_mode","type_name":"Integer"},"vram_size":{"type":"integer_t","description":"The total amount of installed video RAM.","requirement":"recommended","caption":"VRAM Size","type_name":"Integer"}},"name":"gpu_info","description":"The GPU information object contains attributes describing graphical processing hardware.","extends":"object","caption":"GPU Information"},"check":{"attributes":{"name":{"type":"string_t","description":"The name or title of the compliance check. For example, CIS: Ensure mounting of cramfs filesystems is disabled or DISA STIG: The Ubuntu operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions.","references":[{"description":"CIS Benchmark Rules","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIG Requirements","url":"https://public.cyber.mil/stigs/downloads"}],"requirement":"recommended","caption":"Name","type_name":"String"},"status":{"type":"string_t","description":"The resultant status of the compliance check normalized to the caption of the status_id value. For example, CIS Benchmark: Pass when all requirements are met, Fail when requirements are not met, or DISA STIG: NotAFinding (maps to status_id 1/Pass), Open (maps to status_id 3/Fail).","references":[{"description":"CIS Benchmark Compliance Status","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIG Status Types","url":"https://public.cyber.mil/stigs/srg-stig-tools/"}],"requirement":"recommended","caption":"Status","type_name":"String"},"version":{"type":"string_t","description":"The check version. For example, CIS Benchmark: 1.1.0 for Amazon Linux 2 or DISA STIG: V2R1 for Windows 10.","references":[{"description":"CIS Benchmark Versioning","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIG Version Numbering","url":"https://public.cyber.mil/stigs/downloads"}],"requirement":"optional","caption":"Version","type_name":"String"},"desc":{"type":"string_t","description":"The detailed description of the compliance check, explaining the security requirement, vulnerability, or configuration being assessed. For example, CIS: The cramfs filesystem type is a compressed read-only Linux filesystem. Removing support for unneeded filesystem types reduces the local attack surface. or DISA STIG: Unauthorized access to the information system by foreign entities may result in loss or compromise of data.","references":[{"description":"CIS Benchmark Rationales","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIG Vulnerability Discussions","url":"https://public.cyber.mil/stigs/downloads"}],"requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the compliance check within its standard or framework. For example, CIS Benchmark identifier 1.1.1.1, DISA STIG identifier V-230234, or NIST control identifier AC-17(2).","references":[{"description":"CIS Benchmark ID Format","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIG ID Format","url":"https://public.cyber.mil/stigs/downloads"},{"description":"NIST SP 800-53 Control IDs","url":"https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final"}],"requirement":"recommended","caption":"Unique ID","type_name":"String"},"resource":{"type":"object_t","description":"Describes details about the resource that this check evaluated.","requirement":"optional","object_type":"resource_details","caption":"Resource","object_name":"Resource Details"},"severity":{"type":"string_t","description":"The severity level as defined in the source document. For example CIS Benchmarks, valid values are: Level 1 (security-forward, essential settings), Level 2 (security-focused environment, more restrictive), or Scored/Not Scored (whether compliance can be automatically checked). For DISA STIG, valid values are: CAT I (maps to severity_id 5/Critical), CAT II (maps to severity_id 4/High), or CAT III (maps to severity_id 3/Medium).","references":[{"description":"CIS Benchmarks Levels","url":"https://www.cisecurity.org/cis-benchmarks"},{"description":"DISA STIGs Category Guide","url":"https://public.cyber.mil/stigs"}],"requirement":"optional","caption":"Severity","type_name":"String"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Maps to CIS Benchmark Level 1 - Essential security settings recommended for all systems, or DISA STIG CAT III - Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Maps to CIS Benchmark Level 2 - More restrictive and security-focused settings for sensitive environments, or DISA STIG CAT II - Action is required immediately.","caption":"High"},"5":{"description":"Maps to DISA STIG CAT I - Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"The normalized severity identifier that maps severity levels to standard severity levels. For example CIS Benchmark: Level 2 maps to 4 (High), Level 1 maps to 3 (Medium). For DISA STIG: CAT I maps to 5 (Critical), CAT II maps to 4 (High), and CAT III maps to 3 (Medium).","requirement":"optional","caption":"Severity ID","sibling":"severity","type_name":"Integer"},"standards":{"type":"string_t","description":"The regulatory or industry standard this check is associated with. E.g., PCI DSS 3.2.1, HIPAA Security Rule, NIST SP 800-53 Rev. 5, or ISO/IEC 27001:2013.","is_array":true,"references":[{"description":"PCI DSS 3.2.1","url":"https://www.pcisecuritystandards.org/document_library"},{"description":"HIPAA Security Rule","url":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"},{"description":"NIST SP 800-53 Rev. 5","url":"https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final"},{"description":"ISO/IEC 27001:2013","url":"https://www.iso.org/standard/54534.html"}],"requirement":"recommended","caption":"Compliance Standards: List","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The compliance check failed for at least one of the evaluated resources.","caption":"Fail"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The compliance check passed for all the evaluated resources.","caption":"Pass"},"2":{"description":"The compliance check did not yield a result due to missing information.","caption":"Warning"},"99":{"description":"The event status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized status identifier of the compliance check.","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"}},"name":"check","description":"The check object defines a specific, testable compliance verification point that evaluates a target device against a standard, framework, or custom requirement. While checks are typically associated with formal standards (like CIS, NIST, or ISO), they can also represent custom or organizational requirements. When mapped to controls, checks can evaluate specific control_parameters to determine compliance status, but neither the control mapping nor control_parameters are required for a valid check.","extends":"object","profiles":["cloud","data_classification"],"caption":"Check"},"account":{"attributes":{"name":{"type":"string_t","description":"The name of the account (e.g. GCP Project name , Linux Account name or AWS Account name).","requirement":"recommended","caption":"Name","type_name":"String","observable":34},"type":{"type":"string_t","description":"The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Type","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the account (e.g. AWS Account ID , OCID , GCP Project ID , Azure Subscription ID , Google Workspace Customer ID , or M365 Tenant UID).","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":35},"labels":{"type":"string_t","description":"The list of labels associated to the account.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the account.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"AWS IAM User","@deprecated":{"message":"Utilize user.type_id to represent this information.","since":"1.6.0"}},"6":{"description":"Note: The new product name for Azure AD is Microsoft Entra ID.","caption":"Azure AD Account"},"0":{"description":"The account type is unknown.","caption":"Unknown"},"1":{"caption":"LDAP Account"},"2":{"caption":"Windows Account"},"99":{"description":"The account type is not mapped.","caption":"Other"},"4":{"caption":"AWS IAM Role","@deprecated":{"message":"Utilize user.type_id to represent this information.","since":"1.6.0"}},"5":{"caption":"GCP Account"},"7":{"caption":"Mac OS Account"},"8":{"caption":"Apple Account"},"9":{"caption":"Linux Account"},"10":{"caption":"AWS Account"},"11":{"caption":"GCP Project"},"12":{"caption":"OCI Compartment"},"14":{"caption":"Salesforce Account"},"15":{"caption":"Google Workspace"},"16":{"caption":"Servicenow Instance"},"17":{"caption":"M365 Tenant"},"18":{"caption":"Email Account"},"13":{"caption":"Azure Subscription"},"19":{"caption":"ActiveDirectory Account"}},"description":"The normalized account type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"is_disabled":{"type":"boolean_t","description":"Indicates if the account is disabled.","requirement":"optional","caption":"Disabled","type_name":"Boolean"},"is_locked":{"type":"boolean_t","description":"Indicates if the account is locked. For example, due to the amount of failed logins.","requirement":"optional","caption":"Locked","type_name":"Boolean"},"is_on_premises_sync_enabled":{"type":"boolean_t","description":"Indicates whether synchronization with an on-premises directory service is enabled. For example, Microsoft Entra Connect.","requirement":"optional","caption":"On-Premises Sync Enabled","type_name":"Boolean"}},"name":"account","description":"The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"D3FEND™ Ontology d3f:UserAccount.","url":"https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/"},{"description":"D3FEND™ Ontology d3f:CloudUserAccount.","url":"https://d3fend.mitre.org/dao/artifact/d3f:CloudUserAccount/"}],"caption":"Account"},"email_auth":{"attributes":{"spf":{"type":"string_t","description":"The Sender Policy Framework (SPF) status of the email.","requirement":"recommended","caption":"SPF Status","type_name":"String"},"dkim":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) status of the email.","requirement":"recommended","caption":"DKIM Status","type_name":"String"},"dkim_domain":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) signing domain of the email.","requirement":"recommended","caption":"DKIM Domain","type_name":"String"},"dkim_signature":{"type":"string_t","description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system.","requirement":"recommended","caption":"DKIM Signature","type_name":"String"},"dmarc":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email.","requirement":"recommended","caption":"DMARC Status","type_name":"String"},"dmarc_override":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action.","requirement":"recommended","caption":"DMARC Override","type_name":"String"},"dmarc_policy":{"type":"string_t","description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status.","requirement":"recommended","caption":"DMARC Policy","type_name":"String"}},"name":"email_auth","description":"The Email Authentication object describes the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) attributes of an email.","extends":"object","caption":"Email Authentication"},"api":{"attributes":{"version":{"type":"string_t","description":"The version of the API service.","requirement":"optional","caption":"Version","type_name":"String"},"request":{"type":"object_t","description":"Details pertaining to the API request.","requirement":"recommended","object_type":"request","caption":"API Request Details","object_name":"Request Elements"},"service":{"type":"object_t","description":"The information pertaining to the API service.","requirement":"optional","object_type":"service","caption":"Service","object_name":"Service"},"group":{"type":"object_t","description":"The information pertaining to the API group.","requirement":"optional","object_type":"group","caption":"Group","object_name":"Group"},"response":{"type":"object_t","description":"Details pertaining to the API response.","requirement":"recommended","object_type":"response","caption":"API Response Details","object_name":"Response Elements"},"operation":{"type":"string_t","description":"Verb/Operation associated with the request","requirement":"required","caption":"Operation","type_name":"String"},"token":{"type":"object_t","description":"The API or client token used to authenticate or authorize the API request. This attribute contains the base token object that represents: (1) IdP-issued client tokens (type_id: 6) such as Okta API tokens or Microsoft Entra ID Application Registration client secrets, or (2) generic API tokens/keys (type_id: 7) used for SaaS application authentication. Use this attribute when the API request was authenticated using a token that should be tracked as part of the API activity event. Note: Protocol-specific authentication tokens (Kerberos, OIDC, SAML) should be represented using authentication_token in authentication events, not in API activity events.","requirement":"optional","object_type":"token","caption":"Token","object_name":"Token"}},"name":"api","description":"The API, or Application Programming Interface, object represents information pertaining to an API request and response.","extends":"object","caption":"API"},"epss":{"attributes":{"version":{"type":"string_t","description":"The version of the EPSS model used to calculate the score.","requirement":"recommended","caption":"Version","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The timestamp indicating when the EPSS score was calculated.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"percentile":{"type":"float_t","description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset.","requirement":"optional","caption":"EPSS Percentile","type_name":"Float"},"score":{"type":"string_t","description":"The EPSS score representing the probability [0-1] of exploitation in the wild in the next 30 days (following score publication).","requirement":"required","caption":"EPPS Score","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The timestamp indicating when the EPSS score was calculated.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"epss","description":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. (EPSS).","extends":"object","profiles":["datetime"],"caption":"EPSS"},"policy":{"attributes":{"data":{"type":"json_t","description":"Additional data about the policy such as the underlying JSON policy itself or other details.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The policy name. For example: AdministratorAccess Policy.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The policy type. For example: Identity Policy, Resource Policy, Service Control Policy, etc..","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The policy version number.","requirement":"recommended","caption":"Version","type_name":"String"},"group":{"type":"object_t","description":"The policy group.","requirement":"optional","object_type":"group","caption":"Group","object_name":"Group"},"desc":{"type":"string_t","description":"The description of the policy.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"A unique identifier of the policy instance.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"is_applied":{"type":"boolean_t","description":"A determination if the content of a policy was applied to a target or request, or not.","requirement":"recommended","caption":"Applied","type_name":"Boolean"}},"name":"policy","description":"The Policy object describes the policies that are applicable.

Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments.

","extends":"_entity","constraints":{"at_least_one":["name","type","uid"]},"caption":"Policy"},"organization":{"attributes":{"name":{"type":"string_t","description":"The name of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, Widget, Inc. or the AWS Organization name .","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, an AWS Org ID or Oracle Cloud Domain ID .","requirement":"recommended","caption":"Unique ID","type_name":"String"},"ou_name":{"type":"string_t","description":"The name of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, the GCP Project Name , or Dev_Prod_OU .","requirement":"recommended","caption":"Org Unit Name","type_name":"String"},"ou_uid":{"type":"string_t","description":"The unique identifier of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, an Oracle Cloud Tenancy ID , AWS OU ID , or GCP Folder ID .","requirement":"optional","caption":"Org Unit ID","type_name":"String"}},"name":"organization","description":"The Organization object describes characteristics of an organization or company and its division if any. Additionally, it also describes cloud and Software-as-a-Service (SaaS) logical hierarchies such as AWS Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and similar constructs.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Organization"},"application":{"attributes":{"data":{"type":"json_t","description":"Additional data describing the application.","requirement":"optional","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the application.","requirement":"recommended","caption":"Application Name","type_name":"String"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the application.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The type of application as defined by the event source, e.g., GitHub, Azure Logic App, or Amazon Elastic BeanStalk.","requirement":"optional","caption":"Application Type","type_name":"String"},"version":{"type":"string_t","description":"The semantic version of the application, e.g., 1.7.4.","requirement":"optional","caption":"Application Version","type_name":"String"},"group":{"type":"object_t","description":"The name of the related application or associated resource group.","requirement":"optional","object_type":"group","caption":"Group","object_name":"Group"},"desc":{"type":"string_t","description":"A description or commentary for an application, usually retrieved from an upstream system.","requirement":"optional","caption":"Application Description","type_name":"String"},"hostname":{"type":"hostname_t","description":"The fully qualified name of the application.","requirement":"optional","caption":"Hostname","type_name":"Hostname"},"uid":{"type":"string_t","description":"The unique identifier for the application.","requirement":"recommended","caption":"Application ID","type_name":"String"},"labels":{"type":"string_t","description":"The list of labels associated to the application.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"url":{"type":"object_t","description":"The URL of the application.","requirement":"optional","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the application.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"criticality":{"type":"string_t","description":"The criticality of the application as defined by the event source.","requirement":"optional","caption":"Business Criticality","type_name":"String"},"region":{"type":"string_t","description":"The cloud region of the resource.","requirement":"optional","profiles":["cloud"],"caption":"Region","type_name":"String"},"resource_relationship":{"type":"object_t","description":"A graph representation showing how this application relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections.","requirement":"optional","object_type":"graph","caption":"Application Relationship","object_name":"Graph"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","requirement":"optional","caption":"Risk Level","type_name":"String"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","requirement":"optional","caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","requirement":"optional","caption":"Risk Score","type_name":"Integer"},"sbom":{"type":"object_t","description":"The Software Bill of Materials (SBOM) associated with the application","requirement":"optional","object_type":"sbom","caption":"Related SBOM","object_name":"Software Bill of Materials"},"uid_alt":{"type":"string_t","description":"An alternative or contextual identifier for the application, such as a configuration, organization, or license UID.","requirement":"optional","caption":"Application Alternative ID","type_name":"String"}},"name":"application","description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps.","extends":"object","constraints":{"at_least_one":["uid","name"]},"references":[{"description":"D3FEND™ Ontology d3f:Application.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Application/"}],"profiles":["data_classification"],"caption":"Application"},"http_request":{"attributes":{"args":{"type":"string_t","description":"The arguments sent along with the HTTP request.","requirement":"optional","caption":"HTTP Arguments","type_name":"String"},"version":{"type":"string_t","description":"The Hypertext Transfer Protocol (HTTP) version.","requirement":"recommended","caption":"HTTP Version","type_name":"String"},"length":{"type":"integer_t","description":"The length of the entire HTTP request, in number of bytes.","requirement":"optional","caption":"Request Length","type_name":"Integer"},"uid":{"type":"string_t","description":"The unique identifier of the http request.","requirement":"optional","caption":"Unique ID","type_name":"String"},"url":{"type":"object_t","description":"The URL object that pertains to the request.","requirement":"recommended","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"x_forwarded_for":{"type":"ip_t","description":"The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer.","is_array":true,"requirement":"optional","caption":"X-Forwarded-For","type_name":"IP Address"},"body_length":{"type":"integer_t","description":"The actual length of the HTTP request body, in number of bytes, independent of a potentially existing Content-Length header.","requirement":"optional","caption":"Request Body Length","type_name":"Integer"},"user_agent":{"type":"string_t","description":"The request header that identifies the operating system and web browser.","requirement":"recommended","caption":"HTTP User-Agent","type_name":"String","observable":16},"http_headers":{"type":"object_t","description":"Additional HTTP headers of an HTTP request or response.","is_array":true,"requirement":"recommended","object_type":"http_header","caption":"HTTP Headers","object_name":"HTTP Header"},"http_method":{"type":"string_t","enum":{"OPTIONS":{"description":"The OPTIONS method describes the communication options for the target resource.","caption":"Options"},"GET":{"description":"The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.","caption":"Get"},"HEAD":{"description":"The HEAD method asks for a response identical to a GET request, but without the response body.","caption":"Head"},"POST":{"description":"The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.","caption":"Post"},"PUT":{"description":"The PUT method replaces all current representations of the target resource with the request payload.","caption":"Put"},"DELETE":{"description":"The DELETE method deletes the specified resource.","caption":"Delete"},"TRACE":{"description":"The TRACE method performs a message loop-back test along the path to the target resource.","caption":"Trace"},"CONNECT":{"description":"The CONNECT method establishes a tunnel to the server identified by the target resource.","caption":"Connect"},"PATCH":{"description":"The PATCH method applies partial modifications to a resource.","caption":"Patch"}},"description":"The HTTP request method indicates the desired action to be performed for a given resource.","requirement":"recommended","caption":"HTTP Method","type_name":"String"},"referrer":{"type":"string_t","description":"The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested.","requirement":"optional","caption":"HTTP Referrer","type_name":"String"}},"name":"http_request","description":"The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:OutboundInternetNetworkTraffic.","url":"https://d3fend.mitre.org/dao/artifact/d3f:OutboundInternetNetworkTraffic/"}],"caption":"HTTP Request"},"function_invocation":{"attributes":{"error":{"type":"string_t","description":"The error indication returned from the function. This may differ from the return value (e.g. when errno is used).","requirement":"optional","caption":"Error Code","type_name":"String"},"parameters":{"type":"object_t","description":"The parameters passed into a function invocation.","is_array":true,"requirement":"optional","object_type":"parameter","caption":"Parameters","object_name":"Parameter"},"return_value":{"type":"string_t","description":"The value returned from a function.","requirement":"optional","caption":"Return Value","type_name":"String"}},"name":"function_invocation","description":"The Function Invocation object provides details regarding the invocation of a function.","extends":"object","constraints":{"at_least_one":["parameters","return_value","error"]},"caption":"Function Invocation"},"process":{"attributes":{"name":{"type":"process_name_t","description":"The friendly name of the process, for example: Notepad++.","requirement":"recommended","caption":"Name","type_name":"Process Name"},"pid":{"type":"integer_t","description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.","requirement":"recommended","caption":"Process ID","type_name":"Integer","observable":15},"session":{"type":"object_t","description":"The user session under which this process is running.","requirement":"optional","object_type":"session","caption":"Session","object_name":"Session"},"file":{"type":"object_t","description":"The process file object.","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"user":{"type":"object_t","description":"The user under which this process is running.","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"path":{"type":"string_t","description":"The process file path.","requirement":"optional","caption":"Path","type_name":"String"},"group":{"type":"object_t","description":"The group under which this process is running.","requirement":"recommended","profiles":["linux/linux_users"],"object_type":"group","caption":"Group","object_name":"Group"},"tid":{"type":"integer_t","description":"The identifier of the thread associated with the event, as returned by the operating system.","requirement":"optional","caption":"Thread ID","type_name":"Integer","@deprecated":{"message":"tid is deprecated in favor of ptid. ptid has type long_t which can accommodate the thread identifiers returned by all platforms (e.g. 64-bit on MacOS).","since":"1.6.0"}},"uid":{"type":"string_t","description":"A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":39},"loaded_modules":{"type":"string_t","description":"The list of loaded module names.","is_array":true,"requirement":"optional","caption":"Loaded Modules","type_name":"String"},"ancestry":{"type":"object_t","description":"An array of Process Entities describing the extended parentage of this process object. Direct parent information should be expressed through the parent_process attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object.","is_array":true,"references":[{"description":"Guidance on Representing Process Parentage","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"}],"requirement":"optional","object_type":"process_entity","caption":"Ancestry","object_name":"Process Entity"},"auid":{"type":"integer_t","description":"The audit user assigned at login by the audit subsystem.","requirement":"optional","profiles":["linux/linux_users"],"caption":"Audit User ID","type_name":"Integer"},"cmd_line":{"type":"string_t","description":"The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used.","requirement":"recommended","caption":"Command Line","type_name":"String","observable":13},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","group":"context","requirement":"recommended","profiles":["container"],"object_type":"container","caption":"Container","object_name":"Container"},"cpid":{"type":"uuid_t","description":"A unique process identifier that can be assigned deterministically by multiple system data producers.","source":"cpid","references":[{"description":"OCSF Common Process Identifier (CPID) Specification","url":"https://github.com/ocsf/common-process-id"}],"requirement":"recommended","caption":"Common Process Identifier","type_name":"UUID"},"created_time":{"type":"timestamp_t","description":"The time when the process was created/started.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"egid":{"type":"integer_t","description":"The effective group under which this process is running.","requirement":"optional","profiles":["linux/linux_users","macos/macos_users"],"caption":"Effective Group ID","type_name":"Integer"},"environment_variables":{"type":"object_t","description":"Environment variables associated with the process.","is_array":true,"requirement":"optional","object_type":"environment_variable","caption":"Environment Variables","object_name":"Environment Variable"},"euid":{"type":"integer_t","description":"The effective user under which this process is running.","requirement":"optional","profiles":["linux/linux_users","macos/macos_users"],"caption":"Effective User ID","type_name":"Integer"},"integrity":{"type":"string_t","description":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only).","requirement":"optional","caption":"Integrity","type_name":"String"},"integrity_id":{"type":"integer_t","enum":{"3":{"caption":"Medium"},"6":{"caption":"Protected"},"0":{"description":"The integrity level is unknown.","caption":"Unknown"},"1":{"caption":"Untrusted"},"2":{"caption":"Low"},"99":{"description":"The integrity level is not mapped. See the integrity attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"High"},"5":{"caption":"System"}},"description":"The normalized identifier of the process integrity level (Windows only).","requirement":"optional","caption":"Integrity Level","sibling":"integrity","type_name":"Integer"},"lineage":{"type":"file_path_t","description":"The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami'].","is_array":true,"requirement":"optional","caption":"Lineage","type_name":"File Path","@deprecated":{"message":"Use the ancestry attribute.","since":"1.4.0"}},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","group":"context","requirement":"recommended","profiles":["container"],"caption":"Namespace PID","type_name":"Integer"},"parent_process":{"type":"object_t","description":"The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the ancestry attribute.","references":[{"description":"Guidance on Representing Process Parentage","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"}],"requirement":"recommended","object_type":"process","caption":"Parent Process","object_name":"Process"},"ptid":{"type":"long_t","description":"The identifier of the process thread associated with the event, as returned by the operating system.","requirement":"optional","caption":"Process Thread ID","type_name":"Long"},"sandbox":{"type":"string_t","description":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.","requirement":"optional","caption":"Sandbox","type_name":"String"},"terminated_time":{"type":"timestamp_t","description":"The time when the process was terminated.","requirement":"optional","caption":"Terminated Time","type_name":"Timestamp"},"working_directory":{"type":"string_t","description":"The working directory of a process.","requirement":"optional","caption":"Working Directory","type_name":"String"},"xattributes":{"type":"object_t","description":"An unordered collection of zero or more name/value pairs that represent a process extended attribute.","requirement":"optional","object_type":"object","caption":"Extended Attributes","object_name":"Object"},"created_time_dt":{"type":"datetime_t","description":"The time when the process was created/started.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"terminated_time_dt":{"type":"datetime_t","description":"The time when the process was terminated.","requirement":"optional","profiles":["datetime"],"caption":"Terminated Time","type_name":"Datetime"},"hosted_services":{"type":"object_t","description":"The Windows services that this process is hosting.","extension":"win","is_array":true,"requirement":"optional","extension_id":2,"object_type":"win/win_service","caption":"Hosted Services","object_name":"Windows Service"}},"name":"process","description":"The Process object describes a running instance of a launched program.","extends":"process_entity","constraints":{"at_least_one":["pid","uid","cpid"]},"references":[{"description":"D3FEND™ Ontology d3f:Process","url":"https://d3fend.mitre.org/dao/artifact/d3f:Process/"}],"profiles":["container","data_classification","datetime","linux/linux_users","macos/macos_users"],"caption":"Process","observable":25},"request":{"attributes":{"data":{"type":"json_t","description":"The additional data that is associated with the api request.","requirement":"optional","caption":"Data","type_name":"JSON"},"flags":{"type":"string_t","description":"The communication flags that are associated with the api request.","is_array":true,"requirement":"optional","caption":"Flags","type_name":"String"},"uid":{"type":"string_t","description":"The unique request identifier.","requirement":"required","caption":"Unique ID","type_name":"String"},"containers":{"type":"object_t","description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application.","is_array":true,"requirement":"optional","object_type":"container","caption":"Containers","object_name":"Container"}},"name":"request","description":"The Request Elements object describes characteristics of an API request.","extends":"object","caption":"Request Elements"},"rpc_interface":{"attributes":{"version":{"type":"string_t","description":"The version of the DCE/RPC protocol being used in the session.","requirement":"required","caption":"Version","type_name":"String"},"uuid":{"type":"uuid_t","description":"The unique identifier of the particular remote procedure or service.","requirement":"required","caption":"UUID","type_name":"UUID"},"ack_reason":{"type":"integer_t","description":"An integer that provides a reason code or additional information about the acknowledgment result.","requirement":"recommended","caption":"Acknowledgement Reason","type_name":"Integer"},"ack_result":{"type":"integer_t","description":"An integer that denotes the acknowledgment result of the DCE/RPC call.","requirement":"recommended","caption":"Acknowledgement Result","type_name":"Integer"}},"name":"rpc_interface","description":"The RPC Interface represents the remote procedure call interface used in the DCE/RPC session.","extends":"object","caption":"RPC Interface"},"auth_factor":{"attributes":{"device":{"type":"object_t","description":"Device used to complete an authentication request.","group":"primary","requirement":"recommended","object_type":"device","caption":"Device","object_name":"Device"},"email_addr":{"type":"email_t","description":"The email address used in an email-based authentication factor.","group":"context","requirement":"optional","caption":"Email Address","type_name":"Email Address"},"factor_type":{"type":"string_t","description":"The type of authentication factor used in an authentication attempt.","group":"primary","requirement":"recommended","caption":"Factor Type","type_name":"String"},"factor_type_id":{"type":"integer_t","enum":{"3":{"description":"System calls the user's registered phone number and requires the user to answer and provide a response.","caption":"Phone Call"},"6":{"description":"Physical device that generates a code to be used for authentication.","caption":"Hardware Token"},"0":{"caption":"Unknown"},"1":{"description":"User receives and inputs a code sent to their mobile device via SMS text message.","caption":"SMS"},"2":{"description":"The user responds to a security question as part of a question-based authentication factor","caption":"Security Question"},"99":{"caption":"Other"},"4":{"description":"Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.","caption":"Biometric"},"5":{"description":"Push notification is sent to user's registered device and requires the user to acknowledge.","caption":"Push Notification"},"7":{"description":"Application generates a one-time password (OTP) for use in authentication.","caption":"OTP"},"8":{"description":"A code or link is sent to a user's registered email address.","caption":"Email"},"9":{"description":"Typically involves a hardware token, which the user physically interacts with to authenticate.","caption":"U2F"},"10":{"description":"Web-based API that enables users to register devices as authentication factors.","caption":"WebAuthn"},"11":{"description":"The user enters a password that they have previously established.","caption":"Password"}},"description":"The normalized identifier for the authentication factor.","group":"primary","requirement":"required","caption":"Factor Type ID","sibling":"factor_type","type_name":"Integer"},"is_hotp":{"type":"boolean_t","description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP).","group":"context","requirement":"recommended","caption":"HMAC-based One-time Password (HOTP)","type_name":"Boolean"},"is_totp":{"type":"boolean_t","description":"Whether the authentication factor is a Time-based One-time Password (TOTP).","group":"context","requirement":"recommended","caption":"Time-based One-time Password (TOTP)","type_name":"Boolean"},"phone_number":{"type":"string_t","description":"The phone number used for a telephony-based authentication request.","group":"context","requirement":"optional","caption":"Phone Number","type_name":"String"},"provider":{"type":"string_t","description":"The name of provider for an authentication factor.","group":"context","requirement":"recommended","caption":"Provider","type_name":"String"},"security_questions":{"type":"string_t","description":"The question(s) provided to user for a question-based authentication factor.","group":"context","is_array":true,"requirement":"optional","caption":"Security Questions","type_name":"String"}},"name":"auth_factor","description":"An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.","extends":"object","profiles":["container"],"caption":"Authentication Factor"},"san":{"attributes":{"name":{"type":"string_t","description":"Name of SAN (e.g. The actual IP Address or domain.)","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"Type descriptor of SAN (e.g. IP Address/domain/etc.)","requirement":"required","caption":"Type","type_name":"String"}},"name":"san","description":"The Subject Alternative name (SAN) object describes a SAN secured by a digital certificate","extends":"object","caption":"Subject Alternative Name"},"unmanned_system_operating_area":{"attributes":{"count":{"type":"integer_t","description":"Indicates the number of UAS in the operating area.","requirement":"recommended","caption":"Count","type_name":"Integer"},"type":{"type":"string_t","description":"The type of operating area. For example, Takeoff Location, Fixed Location, Dynamic Location.","requirement":"optional","caption":"Type","type_name":"String"},"desc":{"type":"string_t","description":"The description of the geographical location.","requirement":"optional","caption":"Description","type_name":"String"},"long":{"type":"float_t","description":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.","requirement":"optional","caption":"Longitude","type_name":"Float"},"start_time":{"type":"timestamp_t","description":"The date and time at which a group or an Intent-Based Network Participant operation starts. (This field is only applicable to Network Remote ID.)","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"city":{"type":"string_t","description":"The name of the city.","requirement":"recommended","caption":"City","type_name":"String"},"country":{"type":"string_t","description":"The ISO 3166-1 Alpha-2 country code.

Note: The two letter country code should be capitalized. For example: US or CA.

","references":[{"description":"ISO 3166-1 alpha-2 codes","url":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}],"requirement":"recommended","caption":"Country","type_name":"String","observable":14},"coordinates":{"type":"float_t","description":"A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. For example: [-73.983, 40.719].","is_array":true,"requirement":"optional","caption":"Coordinates","type_name":"Float","@deprecated":{"message":"Use specific lat, long attributes instead.","since":"1.2.0"}},"continent":{"type":"string_t","description":"The name of the continent.","requirement":"recommended","caption":"Continent","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Dynamic Location"},"0":{"description":"The UA type is empty or not declared.","caption":"Unknown/Undeclared"},"1":{"caption":"Takeoff Location"},"2":{"caption":"Fixed Location"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The operating area type identifier.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"end_time":{"type":"timestamp_t","description":"The date and time at which a group or an Intent-Based Network Participant operation ends. (This field is only applicable to Network Remote ID.)","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The date and time at which a group or an Intent-Based Network Participant operation starts. (This field is only applicable to Network Remote ID.)","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The date and time at which a group or an Intent-Based Network Participant operation ends. (This field is only applicable to Network Remote ID.)","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"aerial_height":{"type":"string_t","description":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Aerial Height","type_name":"String"},"altitude_ceiling":{"type":"string_t","description":"Maximum altitude (WGS-84 HAE) for a group or an Intent-Based Network Participant. Measured in meters. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Altitude Ceiling","type_name":"String"},"altitude_floor":{"type":"string_t","description":"Minimum altitude (WGS-84 HAE) for a group or an Intent-Based Network Participant. Measured in meters. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Altitude Floor","type_name":"String"},"geodetic_altitude":{"type":"string_t","description":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Geodetic Altitude","type_name":"String"},"geodetic_vertical_accuracy":{"type":"string_t","description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.","requirement":"optional","caption":"Geodetic Vertical Accuracy","type_name":"String"},"geohash":{"type":"string_t","description":"

Geohash of the geo-coordinates (latitude and longitude).

Geohashing is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string.","requirement":"optional","caption":"Geohash","type_name":"String"},"horizontal_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters.","requirement":"optional","caption":"Horizontal Accuracy","type_name":"String"},"is_on_premises":{"type":"boolean_t","description":"Indicates whether the location is on-premises.","requirement":"optional","caption":"On-Premises","type_name":"Boolean"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","requirement":"optional","caption":"ISP Name","type_name":"String","@deprecated":{"message":"Utilize isp attribute available in network_endpoint, whois objects according to your use-case.","since":"1.5.0"}},"lat":{"type":"float_t","description":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.","requirement":"optional","caption":"Latitude","type_name":"Float"},"locations":{"type":"object_t","description":"A list of Position Location Information (PLI) (latitude/longitude pairs) defining the area where a group or Intent-Based Network Participant operation is taking place. (This field is only applicable to Network Remote ID.)","is_array":true,"requirement":"recommended","object_type":"location","caption":"Operating Polygon","object_name":"Geo Location"},"postal_code":{"type":"string_t","description":"The postal code of the location.","requirement":"optional","caption":"Postal Code","type_name":"String"},"pressure_altitude":{"type":"string_t","description":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Pressure Altitude","type_name":"String"},"provider":{"type":"string_t","description":"The provider of the geographical location data.","requirement":"optional","caption":"Provider","type_name":"String"},"radius":{"type":"string_t","description":"Farthest horizontal distance from the reported location at which any UA in a group may be located (meters). Also allows defining the area where an Intent-Based Network Participant operation is taking place. Default: 0 m.","requirement":"optional","caption":"Operating Area Radius","type_name":"String"},"region":{"type":"string_t","description":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland","references":[{"description":"ISO Region Codes","url":"https://www.iso.org/iso-3166-country-codes.html"},{"description":"U.S. Region Codes","url":"https://www.iso.org/obp/ui/#iso:code:3166:US"}],"requirement":"optional","caption":"Region","type_name":"String"}},"name":"unmanned_system_operating_area","description":"The Unmanned System Operating Area object describes details about a precise area of operations for a UAS flight or mission.","extends":"location","constraints":{"at_least_one":["city","country","postal_code","region"]},"profiles":["datetime"],"caption":"Unmanned System Operating Area","observable":26},"hassh":{"attributes":{"algorithm":{"type":"string_t","description":"The concatenation of key exchange, encryption, authentication and compression algorithms (separated by ';'). NOTE: This is not the underlying algorithm for the hash implementation.","requirement":"recommended","caption":"Algorithm","type_name":"String"},"fingerprint":{"type":"object_t","description":"The hash of the key exchange, encryption, authentication and compression algorithms.","requirement":"required","object_type":"fingerprint","caption":"Fingerprint","object_name":"Fingerprint"}},"name":"hassh","description":"The HASSH object contains SSH network fingerprinting values for specific client/server implementations. It provides a standardized way of identifying and categorizing SSH connections based on their unique characteristics and behavior.","extends":"object","caption":"HASSH"},"analytic":{"attributes":{"name":{"type":"string_t","description":"The name of the analytic that generated the finding.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The analytic type.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The analytic version. For example: 1.1.","requirement":"optional","caption":"Version","type_name":"String"},"state":{"type":"string_t","description":"The Analytic state.","requirement":"optional","caption":"State","type_name":"String"},"desc":{"type":"string_t","description":"The description of the analytic that generated the finding.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the analytic that generated the finding.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The analytic category.","requirement":"optional","caption":"Category","type_name":"String"},"algorithm":{"type":"string_t","description":"The algorithm used by the underlying analytic to generate the finding.","requirement":"optional","caption":"Algorithm","type_name":"String"},"type_id":{"type":"integer_t","enum":{"3":{"description":"Statistical analytics pertains to analyzing data patterns and anomalies using statistical models to predict, detect, and respond to potential threats, enhancing overall security posture through informed decision-making.","caption":"Statistical"},"6":{"description":"Tagging refers to the practice of assigning labels or identifiers to data, users, assets, or activities to monitor, control access, and facilitate incident response across various security domains such as DLP and EDR.","caption":"Tagging"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A Rule in security analytics refers to predefined criteria or conditions set to monitor, alert, or enforce policies, playing a crucial role in access control, threat detection, and regulatory compliance across security systems.","caption":"Rule"},"2":{"description":"Behavioral analytics focus on monitoring and analyzing user or system actions to identify deviations from established patterns, aiding in the detection of insider threats, fraud, and advanced persistent threats (APTs).","caption":"Behavioral"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Learning (ML/DL) encompasses techniques that can \"learn\" from known data to create analytics that generalize to new data. There may be a statistical component to these techniques, but it is not a requirement.","caption":"Learning (ML/DL)"},"5":{"description":"Fingerprinting is the technique of collecting detailed system data, including software versions and configurations, to enhance threat detection, data loss prevention (DLP), and endpoint detection and response (EDR) capabilities.","caption":"Fingerprinting"},"7":{"description":"Keyword Match involves scanning content for specific terms to identify sensitive information, potential threats, or policy violations, aiding in DLP and compliance monitoring.","caption":"Keyword Match"},"8":{"description":"Regular Expressions are used to define complex search patterns for identifying, validating, and extracting specific data sets or threats within digital content, enhancing DLP, EDR, and threat detection mechanisms.","caption":"Regular Expressions"},"9":{"description":"Exact Data Match is a precise comparison technique used to detect the unauthorized use or exposure of specific, sensitive information, crucial for enforcing DLP policies and protecting against data breaches.","caption":"Exact Data Match"},"10":{"description":"Partial Data Match involves identifying instances where segments of sensitive information or patterns match, facilitating nuanced DLP and threat detection without requiring complete data conformity.","caption":"Partial Data Match"},"11":{"description":"Indexed Data Match refers to comparing content against a pre-compiled index of sensitive information to efficiently detect and prevent unauthorized access or breaches, streamlining DLP and compliance efforts.","caption":"Indexed Data Match"}},"description":"The analytic type ID.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"related_analytics":{"type":"object_t","description":"Other analytics related to this analytic.","is_array":true,"requirement":"optional","object_type":"analytic","caption":"Related Analytics","@deprecated":{"message":"Related Analytics has been decoupled from this object, instead use finding_info.related_analytics.","since":"1.0.0"},"object_name":"Analytic"},"state_id":{"type":"integer_t","enum":{"3":{"description":"The Analytic is still under development and considered experimental.","caption":"Experimental"},"0":{"description":"The state is unknown.","caption":"Unknown"},"1":{"description":"The Analytic is active.","caption":"Active"},"2":{"description":"The Analytic is suppressed. For example, a user/customer has suppressed a particular detection signature in a security product.","caption":"Suppressed"},"99":{"description":"The state is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The Analytic state identifier.","requirement":"optional","caption":"State ID","sibling":"state","type_name":"Integer"}},"name":"analytic","description":"The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Analytic"},"package":{"attributes":{"name":{"type":"string_t","description":"The software package name.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The software package version.","requirement":"required","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"A unique identifier for the package or library reported by the source tool. E.g., the libId within the sbom field of an OX Security Issue or the SPDX components.*.bom-ref.","requirement":"optional","caption":"Package UID","type_name":"String"},"hash":{"type":"object_t","description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library.","requirement":"optional","object_type":"fingerprint","caption":"Hash","object_name":"Fingerprint"},"release":{"type":"string_t","description":"Release is the number of times a version of the software has been packaged.","requirement":"optional","caption":"Software Release Details","type_name":"String"},"epoch":{"type":"integer_t","description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers.","requirement":"optional","caption":"Epoch","type_name":"Integer"},"type_id":{"type":"integer_t","enum":{"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"An application software package.","caption":"Application"},"2":{"description":"An operating system software package.","caption":"Operating System"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The type of software package.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"license":{"type":"string_t","description":"The software license applied to this package.","requirement":"optional","caption":"Software License","type_name":"String"},"architecture":{"type":"string_t","description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on.","requirement":"recommended","caption":"Architecture","type_name":"String"},"cpe_name":{"type":"string_t","description":"The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.","requirement":"optional","caption":"The product CPE identifier","type_name":"String"},"license_url":{"type":"url_t","description":"The URL pointing to the license applied on package or software. This is typically a LICENSE.md file within a repository.","requirement":"optional","caption":"Software License URL","type_name":"URL String"},"package_manager":{"type":"string_t","description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc.","requirement":"optional","caption":"Package Manager","type_name":"String"},"package_manager_url":{"type":"url_t","description":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as AWS CodeArtifact or Artifactory.","requirement":"optional","caption":"Package Manager URL","type_name":"URL String"},"purl":{"type":"string_t","description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.","requirement":"optional","caption":"Package URL","type_name":"String"},"src_url":{"type":"url_t","description":"The link to the specific library or package such as within GitHub, this is different from the link to the package manager where the library or package is hosted.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"vendor_name":{"type":"string_t","description":"The name of the vendor who published the software package.","requirement":"optional","caption":"Vendor Name","type_name":"String"}},"name":"package","description":"The Software Package object describes details about a software package.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:SoftwarePackage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}],"caption":"Software Package"},"remediation":{"attributes":{"desc":{"type":"string_t","description":"The description of the remediation strategy.","requirement":"required","caption":"Description","type_name":"String"},"references":{"type":"string_t","description":"A list of supporting URL/s, references that help describe the remediation strategy.","is_array":true,"requirement":"optional","caption":"References","type_name":"String"},"cis_controls":{"type":"object_t","description":"An array of Center for Internet Security (CIS) Controls that can be optionally mapped to provide additional remediation details.","is_array":true,"references":[{"description":"Center For Internet Security Controls","url":"https://www.cisecurity.org/controls/"}],"requirement":"optional","object_type":"cis_control","caption":"CIS Controls","object_name":"CIS Control"},"kb_article_list":{"type":"object_t","description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.","is_array":true,"requirement":"optional","object_type":"kb_article","caption":"Knowledgebase Articles","object_name":"KB Article"},"kb_articles":{"type":"string_t","description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.","is_array":true,"requirement":"optional","caption":"Knowledgebase Articles","type_name":"String","@deprecated":{"message":"Use the kb_article_list attribute instead.","since":"1.1.0"}}},"name":"remediation","description":"The Remediation object describes the recommended remediation steps to address identified issue(s).","extends":"object","profiles":["data_classification"],"caption":"Remediation"},"kb_article":{"attributes":{"size":{"type":"long_t","description":"The size in bytes for the kb article.","requirement":"optional","caption":"Size","type_name":"Long"},"os":{"type":"object_t","description":"The operating system the kb article applies.","requirement":"recommended","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"title":{"type":"string_t","description":"The title of the kb article.","requirement":"recommended","caption":"Title","type_name":"String"},"product":{"type":"object_t","description":"The product details the kb article applies.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"uid":{"type":"string_t","description":"The unique identifier for the kb article.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"severity":{"type":"string_t","description":"The severity of the kb article.","requirement":"recommended","caption":"Severity","type_name":"String"},"avg_timespan":{"type":"object_t","description":"The average time to patch.","requirement":"optional","object_type":"timespan","caption":"Average Timespan","object_name":"Time Span"},"bulletin":{"type":"string_t","description":"The kb article bulletin identifier.","requirement":"optional","caption":"Patch Bulletin","type_name":"String"},"classification":{"type":"string_t","description":"The vendors classification of the kb article.","requirement":"optional","caption":"Classification","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The date the kb article was released by the vendor.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"install_state":{"type":"string_t","description":"The install state of the kb article.","requirement":"recommended","caption":"Install State","type_name":"String"},"install_state_id":{"type":"integer_t","enum":{"3":{"description":"The item is installed pending reboot operation.","caption":"Installed Pending Reboot"},"0":{"description":"The normalized install state is unknown.","caption":"Unknown"},"1":{"description":"The item is installed.","caption":"Installed"},"2":{"description":"The item is not installed.","caption":"Not Installed"},"99":{"description":"The install state is not mapped. See the install_state attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized install state ID of the kb article.","requirement":"recommended","caption":"Install State ID","sibling":"install_state","type_name":"Integer"},"is_superseded":{"type":"boolean_t","description":"The kb article has been replaced by another.","requirement":"optional","caption":"The patch is superseded.","type_name":"Boolean"},"src_url":{"type":"url_t","description":"The kb article link from the source vendor.","requirement":"optional","caption":"Source URL","type_name":"URL String"},"created_time_dt":{"type":"datetime_t","description":"The date the kb article was released by the vendor.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"kb_article","description":"The KB Article object contains metadata that describes the patch or update.","extends":"object","constraints":{"at_least_one":["uid","src_url"]},"profiles":["data_classification","datetime"],"caption":"KB Article"},"encryption_details":{"attributes":{"type":{"type":"string_t","description":"The type of the encryption used.","requirement":"recommended","caption":"Encryption Type","type_name":"String"},"key_length":{"type":"integer_t","description":"The length of the encryption key used.","requirement":"optional","caption":"Encryption Key Length","type_name":"Integer"},"algorithm":{"type":"string_t","description":"The encryption algorithm used, normalized to the caption of 'algorithm_id","requirement":"optional","caption":"Encryption Algorithm","type_name":"String"},"algorithm_id":{"type":"integer_t","enum":{"3":{"description":"Advanced Encryption Standard Algorithm.","caption":"AES"},"6":{"description":"ShangMi Cryptographic Algorithm","caption":"SM2"},"0":{"description":"The algorithm is unknown.","caption":"Unknown"},"1":{"description":"Data Encryption Standard Algorithm","caption":"DES"},"2":{"description":"Triple Data Encryption Standard Algorithm","caption":"TripleDES"},"99":{"description":"The algorithm is not mapped. See the algorithm attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Rivest-Shamir-Adleman Algorithm","caption":"RSA"},"5":{"description":"Elliptic Curve Cryptography Algorithm","caption":"ECC"}},"description":"The encryption algorithm used.","requirement":"recommended","caption":"Encryption Algorithm ID","sibling":"algorithm","type_name":"Integer"},"key_uid":{"type":"string_t","description":"The unique identifier of the key used for encryption. For example, AWS KMS Key ARN.","requirement":"optional","caption":"Key UID","type_name":"String"}},"name":"encryption_details","description":"Details about the encryption methodology utilized.","extends":"object","caption":"Encryption Details"},"ldap_person":{"attributes":{"location":{"type":"object_t","description":"The geographical location associated with a user. This is typically the user's usual work location.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"labels":{"type":"string_t","description":"The labels associated with the user. For example in AD this could be the userType, employeeType. For example: Member, Employee.","is_array":true,"requirement":"optional","caption":"Labels","type_name":"String"},"manager":{"type":"object_t","description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.","requirement":"optional","object_type":"user","caption":"Manager","object_name":"User"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the user.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"cost_center":{"type":"string_t","description":"The cost center associated with the user.","requirement":"optional","caption":"Cost Center","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The timestamp when the user was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"deleted_time":{"type":"timestamp_t","description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days.","requirement":"optional","caption":"Deleted Time","type_name":"Timestamp"},"department":{"type":"string_t","description":"The name of the department in which the user works.","requirement":"optional","caption":"Department","type_name":"String"},"display_name":{"type":"string_t","description":"The display name of the LDAP person. According to RFC 2798, this is the preferred name of a person to be used when displaying entries.","references":[{"description":"RFC 2798","url":"https://www.rfc-editor.org/rfc/rfc2798.html#section-2.3"},{"description":"Microsoft AD Schema","url":"https://learn.microsoft.com/en-us/windows/win32/adschema/a-displayname"}],"requirement":"optional","caption":"Display Name","type_name":"String"},"email_addrs":{"type":"email_t","description":"A list of additional email addresses for the user.","is_array":true,"requirement":"optional","caption":"Email Addresses","type_name":"Email Address"},"employee_uid":{"type":"string_t","description":"The employee identifier assigned to the user by the organization.","requirement":"optional","caption":"Employee ID","type_name":"String"},"given_name":{"type":"string_t","description":"The given or first name of the user.","requirement":"optional","caption":"Given Name","type_name":"String"},"hire_time":{"type":"timestamp_t","description":"The timestamp when the user was or will be hired by the organization.","requirement":"optional","caption":"Hire Time","type_name":"Timestamp"},"job_title":{"type":"string_t","description":"The user's job title.","requirement":"optional","caption":"Job Title","type_name":"String"},"last_login_time":{"type":"timestamp_t","description":"The last time when the user logged in.","requirement":"optional","caption":"Last Login","type_name":"Timestamp"},"ldap_cn":{"type":"string_t","description":"The LDAP and X.500 commonName attribute, typically the full name of the person. For example, John Doe.","requirement":"optional","caption":"LDAP Common Name","type_name":"String"},"ldap_dn":{"type":"string_t","description":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, cn=John Doe,ou=People,dc=example,dc=com.","requirement":"optional","caption":"LDAP Distinguished Name","type_name":"String"},"leave_time":{"type":"timestamp_t","description":"The timestamp when the user left or will be leaving the organization.","requirement":"optional","caption":"Leave Time","type_name":"Timestamp"},"modified_time":{"type":"timestamp_t","description":"The timestamp when the user entry was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"office_location":{"type":"string_t","description":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, South East Virtual.","requirement":"optional","caption":"Office Location","type_name":"String"},"phone_number":{"type":"string_t","description":"The telephone number of the user. Corresponds to the LDAP Telephone-Number CN.","requirement":"optional","caption":"Telephone Number","type_name":"String"},"surname":{"type":"string_t","description":"The last or family name for the user.","requirement":"optional","caption":"Surname","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The timestamp when the user was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"deleted_time_dt":{"type":"datetime_t","description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days.","requirement":"optional","profiles":["datetime"],"caption":"Deleted Time","type_name":"Datetime"},"hire_time_dt":{"type":"datetime_t","description":"The timestamp when the user was or will be hired by the organization.","requirement":"optional","profiles":["datetime"],"caption":"Hire Time","type_name":"Datetime"},"last_login_time_dt":{"type":"datetime_t","description":"The last time when the user logged in.","requirement":"optional","profiles":["datetime"],"caption":"Last Login","type_name":"Datetime"},"leave_time_dt":{"type":"datetime_t","description":"The timestamp when the user left or will be leaving the organization.","requirement":"optional","profiles":["datetime"],"caption":"Leave Time","type_name":"Datetime"},"modified_time_dt":{"type":"datetime_t","description":"The timestamp when the user entry was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"}},"name":"ldap_person","description":"The additional LDAP attributes that describe a person.","extends":"object","profiles":["datetime"],"caption":"LDAP Person"},"extension":{"attributes":{"name":{"type":"string_t","description":"The schema extension name. For example: dev.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The schema extension version. For example: 1.0.0-alpha.2.","requirement":"required","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The schema extension unique identifier. For example: 999.","requirement":"recommended","caption":"Unique ID","type_name":"String"}},"name":"extension","description":"The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Schema Extension"},"dns_query":{"attributes":{"type":{"type":"string_t","description":"The type of resource records being queried. See RFC1035. For example: A, AAAA, CNAME, MX, and NS.","requirement":"recommended","caption":"Resource Record Type","type_name":"String"},"hostname":{"type":"hostname_t","description":"The hostname or domain being queried. For example: www.example.com","requirement":"required","caption":"Hostname","type_name":"Hostname"},"class":{"type":"string_t","description":"The class of resource records being queried. See RFC1035. For example: IN.","requirement":"recommended","caption":"Resource Record Class","type_name":"String"},"opcode":{"type":"string_t","description":"The DNS opcode specifies the type of the query message.","requirement":"optional","caption":"DNS Opcode","type_name":"String"},"opcode_id":{"type":"integer_t","enum":{"3":{"description":"Reserved, not used","caption":"Reserved"},"6":{"description":"DNS Stateful Operations (DSO)","caption":"DSO Message"},"0":{"description":"Standard query","caption":"Query"},"1":{"description":"Inverse query, obsolete","caption":"Inverse Query"},"2":{"description":"Server status request","caption":"Status"},"99":{"description":"The DNS Opcode is not defined by the RFC. See the opcode attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Zone change notification","caption":"Notify"},"5":{"description":"Dynamic DNS update","caption":"Update"}},"description":"The DNS opcode ID specifies the normalized query message type as defined in RFC-5395.","requirement":"recommended","caption":"DNS Opcode ID","type_name":"Integer","suppress_checks":["enum_convention"]},"packet_uid":{"type":"integer_t","description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.","requirement":"recommended","caption":"Packet UID","type_name":"Integer"}},"name":"dns_query","description":"The DNS query object represents a specific request made to the Domain Name System (DNS) to retrieve information about a domain or perform a DNS operation. This object encapsulates the necessary attributes and methods to construct and send DNS queries, specify the query type (e.g., A, AAAA, MX).","extends":"_dns","references":[{"description":"D3FEND™ Ontology d3f:DNSLookup.","url":"https://d3fend.mitre.org/dao/artifact/d3f:DNSLookup/"}],"caption":"DNS Query"},"attack":{"attributes":{"version":{"type":"string_t","description":"The ATT&CK® or ATLAS™ Matrix version.","requirement":"recommended","caption":"Version","type_name":"String"},"tactics":{"type":"object_t","description":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by ATT&CK® Matrix.","is_array":true,"requirement":"optional","object_type":"tactic","caption":"Tactics","@deprecated":{"message":"Use the tactic attribute instead.","since":"1.1.0"},"object_name":"MITRE Tactic"},"technique":{"type":"object_t","description":"The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"recommended","object_type":"technique","caption":"MITRE Technique","object_name":"MITRE Technique"},"mitigation":{"type":"object_t","description":"The Mitigation object describes the MITRE ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","object_type":"mitigation","caption":"MITRE Mitigation","object_name":"MITRE Mitigation"},"sub_technique":{"type":"object_t","description":"The Sub-technique object describes the MITRE ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"recommended","object_type":"sub_technique","caption":"MITRE Sub-technique","object_name":"MITRE Sub-technique"},"tactic":{"type":"object_t","description":"The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack.","references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"recommended","object_type":"tactic","caption":"MITRE Tactic","object_name":"MITRE Tactic"}},"name":"attack","description":"The MITRE ATT&CK® & ATLAS™ object describes the tactic, technique, sub-technique & mitigation associated to an attack.","extends":"object","constraints":{"at_least_one":["tactic","technique","sub_technique"]},"references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"caption":"MITRE ATT&CK® & ATLAS™"},"rule":{"attributes":{"name":{"type":"string_t","description":"The name of the rule that generated the event.","requirement":"recommended","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The rule type.","requirement":"optional","caption":"Type","type_name":"String"},"version":{"type":"string_t","description":"The rule version. For example: 1.1.","requirement":"optional","caption":"Version","type_name":"String"},"desc":{"type":"string_t","description":"The description of the rule that generated the event.","requirement":"optional","caption":"Description","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the rule that generated the event.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"category":{"type":"string_t","description":"The rule category.","requirement":"optional","caption":"Category","type_name":"String"}},"name":"rule","description":"The Rule object describes characteristics of a rule associated with a policy or an event.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"caption":"Rule"},"session":{"attributes":{"count":{"type":"integer_t","description":"The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time.","requirement":"optional","caption":"Count","type_name":"Integer"},"terminal":{"type":"string_t","description":"The Pseudo Terminal associated with the session. Ex: the tty or pts value.","requirement":"optional","caption":"Terminal","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the session.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"uuid":{"type":"uuid_t","description":"The universally unique identifier of the session.","requirement":"optional","caption":"UUID","type_name":"UUID"},"issuer":{"type":"string_t","description":"The identifier of the session issuer.","requirement":"recommended","caption":"Issuer Details","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the session was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"credential_uid":{"type":"string_t","description":"The unique identifier of the user's credential. For example, AWS Access Key ID.","requirement":"optional","caption":"User Credential ID","type_name":"String","observable":19},"expiration_reason":{"type":"string_t","description":"The reason which triggered the session expiration.","requirement":"optional","caption":"Expiration Reason","type_name":"String"},"expiration_time":{"type":"timestamp_t","description":"The session expiration time.","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"is_mfa":{"type":"boolean_t","description":"Indicates whether Multi Factor Authentication was used during authentication.","requirement":"optional","caption":"Multi Factor Authentication","type_name":"Boolean"},"is_remote":{"type":"boolean_t","description":"The indication of whether the session is remote.","requirement":"recommended","caption":"Remote","type_name":"Boolean"},"is_vpn":{"type":"boolean_t","description":"The indication of whether the session is a VPN session.","requirement":"optional","caption":"VPN Session","type_name":"Boolean"},"uid_alt":{"type":"string_t","description":"The alternate unique identifier of the session. e.g. AWS ARN - arn:aws:sts::123344444444:assumed-role/Admin/example-session.","requirement":"optional","caption":"Alternate ID","type_name":"String"},"created_time_dt":{"type":"datetime_t","description":"The time when the session was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"expiration_time_dt":{"type":"datetime_t","description":"The session expiration time.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"}},"name":"session","description":"The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:Session","url":"https://d3fend.mitre.org/dao/artifact/d3f:Session/"}],"profiles":["datetime"],"caption":"Session"},"privilege_attack_info":{"attributes":{"attack":{"type":"object_t","description":"The MITRE ATT&CK technique that these privileges could enable.","requirement":"required","object_type":"attack","caption":"MITRE ATT&CK® Details","object_name":"MITRE ATT&CK® & ATLAS™"},"privilege_info_list":{"type":"object_t","description":"The list of privilege information objects, where each element describes a specific privilege that could enable the associated attack technique.","is_array":true,"requirement":"required","object_type":"privilege_info","caption":"Privilege Info List","object_name":"Privilege Info"}},"name":"privilege_attack_info","description":"The Privilege Attack Info object groups privileges by the potential attack they could enable. It maps specific privileges to MITRE ATT&CK techniques, helping identify security risks associated with granted permissions.","extends":"object","caption":"Privilege Attack Info"},"sub_technique":{"attributes":{"name":{"type":"string_t","description":"The name of the attack sub-technique. For example: Scanning IP Blocks or User Execution: Unsafe ML Artifacts.","requirement":"recommended","caption":"Name","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the attack sub-technique. For example: T1595.001 or AML.T0011.000.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"src_url":{"type":"url_t","description":"The versioned permalink of the attack sub-technique. For example: https://attack.mitre.org/versions/v14/techniques/T1595/001/.","requirement":"optional","caption":"Source URL","type_name":"URL String"}},"name":"sub_technique","description":"The MITRE Sub-technique object describes the ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"references":[{"description":"ATT&CK® Matrix","url":"https://attack.mitre.org"},{"description":"ATLAS™ Matrix","url":"https://atlas.mitre.org/matrices/ATLAS"}],"caption":"MITRE Sub-technique"},"long_string":{"attributes":{"value":{"type":"string_t","description":"The string value, truncated if is_truncated is true.","requirement":"required","caption":"Value","type_name":"String"},"is_truncated":{"type":"boolean_t","description":"Indicates that value has been truncated. May be omitted if truncation has not occurred.","requirement":"optional","caption":"Is Truncated","type_name":"Boolean"},"untruncated_size":{"type":"integer_t","description":"The size in bytes of the string represented by value before truncation. Should be omitted if truncation has not occurred.","requirement":"optional","caption":"Untruncated Size","type_name":"Integer"}},"name":"long_string","description":"This object is a used to capture strings which may be truncated by a security product due to their length.","extends":"object","caption":"Long String"},"aircraft":{"attributes":{"name":{"type":"string_t","description":"The name of the aircraft, such as the such as the flight name or callsign.","requirement":"recommended","caption":"Name","type_name":"String"},"speed":{"type":"string_t","description":"Ground speed of flight. This value is provided in meters per second with a minimum resolution of 0.25 m/s. Special Values: Invalid, No Value, or Unknown: 255 m/s.","requirement":"optional","caption":"Speed","type_name":"String"},"location":{"type":"object_t","description":"The detailed geographical location usually associated with an IP address.","requirement":"recommended","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"uid":{"type":"string_t","description":"The primary identification identifier for an aircraft, such as the 24-bit International Civil Aviation Organization (ICAO) identifier of the aircraft, as 6 hex digits.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"model":{"type":"string_t","description":"The model name of the aircraft or unmanned system.","requirement":"optional","caption":"Model","type_name":"String"},"serial_number":{"type":"string_t","description":"The serial number of the aircraft.","requirement":"optional","caption":"Serial Number","type_name":"String","observable":37},"speed_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal ground speed. Measured in meters/second.","requirement":"optional","caption":"Speed Accuracy","type_name":"String"},"track_direction":{"type":"string_t","description":"Direction of flight expressed as a “True North-based” ground track angle. This value is provided in clockwise degrees with a minimum resolution of 1 degree. If aircraft is not moving horizontally, use the “Unknown” value","requirement":"optional","caption":"Track Direction","type_name":"String"},"uid_alt":{"type":"string_t","description":"A secondary identification identifier for an aircraft, such as the 4-digit squawk (octal representation).","requirement":"optional","caption":"Alternate ID","type_name":"String"},"vertical_speed":{"type":"string_t","description":"Vertical speed upward relative to the WGS-84 datum, measured in meters per second. Special Values: Invalid, No Value, or Unknown: 63 m/s.","requirement":"optional","caption":"Vertical Speed","type_name":"String"}},"name":"aircraft","description":"The Aircraft object represents any aircraft or otherwise airborne asset such as an unmanned system, airplane, balloon, spacecraft, or otherwise. The Aircraft object is intended to normalized data captured or otherwise logged from active radar, passive radar, multi-spectral systems, or the Automatic Dependant Broadcast - Surveillance (ADS-B), and/or Mode S systems.","extends":"_entity","constraints":{"at_least_one":["name","serial_number","uid","uid_alt"]},"caption":"Aircraft"},"anomaly_analysis":{"attributes":{"analysis_targets":{"type":"object_t","description":"The analysis targets define the scope of monitored activities, specifying what entities, systems or processes are analyzed for activity patterns.","is_array":true,"requirement":"required","object_type":"analysis_target","caption":"Analysis Targets","object_name":"Analysis Target"},"anomalies":{"type":"object_t","description":"List of detected activities that significantly deviate from the established baselines. This can include unusual access patterns, unexpected user-agents, abnormal API usage, suspicious traffic spikes, unauthorized access attempts, and other activities that may indicate potential security threats or system issues.","is_array":true,"requirement":"required","object_type":"anomaly","caption":"Anomalies","object_name":"Anomaly"},"baselines":{"type":"object_t","description":"List of established patterns representing normal activity that serve as reference points for anomaly detection. This includes typical user interaction patterns like common user-agents, expected API access frequencies and patterns, standard resource utilization levels, and regular traffic flows. These baselines help establish what constitutes 'normal' activity in the system.","is_array":true,"requirement":"recommended","object_type":"baseline","caption":"Baselines","object_name":"Baseline"}},"name":"anomaly_analysis","description":"Describes the analysis of activity patterns and anomalies of target entities to identify potential security threats, performance issues, or other deviations from established baselines. This includes monitoring and analyzing user interactions, API usage, resource utilization, access patterns and other measured indicators.","caption":"Anomaly Analysis"},"identity_activity_metrics":{"attributes":{"first_seen_time":{"type":"timestamp_t","description":"The timestamp when this identity was first observed or created in the system. This helps establish the identity's age and lifecycle stage for risk assessment.","requirement":"optional","caption":"First Seen","type_name":"Timestamp"},"last_authentication_time":{"type":"timestamp_t","description":"The timestamp when this identity last successfully authenticated to any system or service. This differs from last_seen_time as it specifically tracks authentication events rather than all activities.","requirement":"optional","caption":"Last Authentication Time","type_name":"Timestamp"},"last_seen_time":{"type":"timestamp_t","description":"The timestamp of the most recent activity performed by this identity, including authentication, resource access, or API calls. This is the most comprehensive indicator of identity usage recency.","requirement":"recommended","caption":"Last Seen","type_name":"Timestamp"},"password_last_used_time":{"type":"timestamp_t","description":"The timestamp when password-based authentication was last used by this identity. This helps distinguish between password and other authentication methods (MFA, SSO, certificates) and identify password-specific usage patterns.","requirement":"optional","caption":"Password Last Used Time","type_name":"Timestamp"},"programmatic_credentials":{"type":"object_t","description":"Details about the programmatic credentials associated with this identity, such as API keys, service account keys, access tokens, and client certificates used for automated access.","is_array":true,"requirement":"optional","object_type":"programmatic_credential","caption":"Programmatic Credentials","object_name":"Programmatic Credential"},"first_seen_time_dt":{"type":"datetime_t","description":"The timestamp when this identity was first observed or created in the system. This helps establish the identity's age and lifecycle stage for risk assessment.","requirement":"optional","profiles":["datetime"],"caption":"First Seen","type_name":"Datetime"},"last_authentication_time_dt":{"type":"datetime_t","description":"The timestamp when this identity last successfully authenticated to any system or service. This differs from last_seen_time as it specifically tracks authentication events rather than all activities.","requirement":"optional","profiles":["datetime"],"caption":"Last Authentication Time","type_name":"Datetime"},"last_seen_time_dt":{"type":"datetime_t","description":"The timestamp of the most recent activity performed by this identity, including authentication, resource access, or API calls. This is the most comprehensive indicator of identity usage recency.","requirement":"optional","profiles":["datetime"],"caption":"Last Seen","type_name":"Datetime"},"password_last_used_time_dt":{"type":"datetime_t","description":"The timestamp when password-based authentication was last used by this identity. This helps distinguish between password and other authentication methods (MFA, SSO, certificates) and identify password-specific usage patterns.","requirement":"optional","profiles":["datetime"],"caption":"Password Last Used Time","type_name":"Datetime"}},"name":"identity_activity_metrics","description":"The Identity Activity Metrics object captures usage patterns, authentication activity, credential usage and other metrics for identities across cloud and on-premises environments. Example identities include AWS IAM Users, Roles, Azure AD Principals, GCP Service Accounts, on-premises Active Directory accounts.","extends":"object","profiles":["datetime"],"caption":"Identity Activity Metrics"},"security_state":{"attributes":{"state":{"type":"string_t","description":"The security state, normalized to the caption of the state_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Security State","type_name":"String"},"state_id":{"type":"integer_t","enum":{"3":{"description":"Isolated from the network.","caption":"In network quarantine"},"6":{"description":"The security solution does not have a valid license.","caption":"Protection not licensed"},"0":{"description":"The security state is unknown.","caption":"Unknown"},"1":{"description":"The content is missing or outdated.","caption":"Missing or outdated content"},"2":{"description":"Not in compliance with the expected security policy.","caption":"Policy mismatch"},"99":{"description":"The security state is not mapped. See the state attribute, which contains data source specific values.","caption":"Other"},"4":{"description":"Not protected by a security solution.","caption":"Protection off"},"5":{"description":"The security solution is not functioning properly.","caption":"Protection malfunction"},"7":{"description":"A detected threat has not been remediated.","caption":"Unremediated threat"},"8":{"description":"Reputation of the entity is suspicious.","caption":"Suspicious reputation"},"9":{"description":"A reboot is required for one or more pending actions.","caption":"Reboot pending"},"10":{"description":"The content is locked to a specific version.","caption":"Content is locked"},"11":{"description":"The entity is not installed.","caption":"Not installed"},"12":{"description":"The system partition is writeable.","caption":"Writable system partition"},"14":{"description":"The device has failed the boot verification process.","caption":"Failed boot verify"},"15":{"description":"The execution environment has been modified.","caption":"Modified execution environment"},"16":{"description":"The SELinux security feature has been disabled.","caption":"SELinux disabled"},"17":{"description":"An elevated privilege shell has been detected.","caption":"Elevated privilege shell"},"18":{"description":"The file system has been altered on an iOS device.","caption":"iOS file system altered"},"20":{"description":"Mobile OTA (Over The Air) updates have been disabled.","caption":"OTA updates disabled"},"21":{"description":"The device has been modified to allow root access.","caption":"Rooted"},"22":{"description":"The Android partition has been modified.","caption":"Android partition modified"},"23":{"description":"The entity is not compliant with the associated security policy.","caption":"Compliance failure"},"13":{"description":"The device has failed the SafetyNet check.","caption":"SafetyNet failure"},"19":{"description":"Remote access is enabled.","caption":"Open remote access"}},"description":"The security state of the managed entity.","requirement":"recommended","caption":"Security State ID","sibling":"state","type_name":"Integer"}},"name":"security_state","description":"The Security State object describes the security related state of a managed entity.","extends":"object","caption":"Security State"},"display":{"attributes":{"scale_factor":{"type":"integer_t","description":"The numeric scale factor of display.","requirement":"optional","caption":"Scale Factor","type_name":"Integer"},"color_depth":{"type":"integer_t","description":"The numeric color depth.","requirement":"optional","caption":"Color Depth","type_name":"Integer"},"physical_height":{"type":"integer_t","description":"The numeric physical height of display.","requirement":"optional","caption":"Physical Height","type_name":"Integer"},"physical_orientation":{"type":"integer_t","description":"The numeric physical orientation of display.","requirement":"optional","caption":"Physical Orientation","type_name":"Integer"},"physical_width":{"type":"integer_t","description":"The numeric physical width of display.","requirement":"optional","caption":"Physical Width","type_name":"Integer"}},"name":"display","description":"The Display object contains information about the physical or virtual display connected to a computer system.","extends":"object","caption":"Display"},"permission_analysis_result":{"attributes":{"analyzed_privileges_count":{"type":"integer_t","description":"The total count of privileges that were analyzed across all services.","requirement":"optional","caption":"Analyzed Privileges Count","type_name":"Integer"},"condition_keys":{"type":"object_t","description":"The condition keys and their values that were evaluated during policy analysis, including contextual constraints that affect permission grants. These conditions define when and how permissions are applied. Examples: aws:SourceIp:1.2.3.4, aws:RequestedRegion:us-east-1.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Condition Keys","object_name":"Key:Value object"},"granted_privileges":{"type":"string_t","description":"The specific privileges, actions, or permissions that are explicitly granted by the analyzed policy. Examples: AWS actions like s3:GetObject, ec2:RunInstances, iam:CreateUser; Azure actions like Microsoft.Storage/storageAccounts/read; or GCP permissions like storage.objects.get.","is_array":true,"requirement":"optional","caption":"Granted Privileges","type_name":"String"},"policy":{"type":"object_t","description":"Detailed information about the policy document that was analyzed, including policy metadata, version, type (identity-based, resource-based, etc.), and structural details. This provides context for understanding the scope and nature of the permission analysis.","requirement":"recommended","object_type":"policy","caption":"Policy","object_name":"Policy"},"service_privilege_analysis_list":{"type":"object_t","description":"The list of privilege analysis results grouped by cloud service or namespace.","is_array":true,"requirement":"optional","object_type":"service_privilege_analysis","caption":"Service Privilege Analysis List","object_name":"Service Privilege Analysis"},"total_potential_attacks_count":{"type":"integer_t","description":"The total count of privilege-to-attack technique mappings identified across all analyzed privileges.","requirement":"optional","caption":"Total Potential Attacks Count","type_name":"Integer"},"unused_privileges_count":{"type":"integer_t","description":"The total count of privileges or actions defined in the policy that have not been utilized within the analysis timeframe. This metric helps identify over-privileged access and opportunities for privilege reduction to follow the principle of least privilege. High counts may indicate policy bloat or excessive permissions.","requirement":"optional","caption":"Unused Privileges Count","type_name":"Integer"},"unused_services_count":{"type":"integer_t","description":"The total count of cloud services or resource types referenced in the policy that have not been accessed or utilized within the analysis timeframe. This helps identify unused service permissions that could be removed to reduce attack surface. Examples: AWS services like S3, SQS, IAM, Lambda; Azure services like Storage, Compute, KeyVault; or GCP services like Cloud Storage, Compute Engine, BigQuery.","requirement":"optional","caption":"Unused Services Count","type_name":"Integer"}},"name":"permission_analysis_result","description":"The Permission Analysis object describes analysis results of permissions, policies directly associated with an identity (user, role, or service account). This evaluates what permissions an identity has been granted through attached policies, which privileges are actively used versus unused, and identifies potential over-privileged access. Use this for identity-centric security assessments such as privilege audits, dormant permission discovery, and least-privilege compliance analysis.","extends":"object","caption":"Permission Analysis Result"},"endpoint_connection":{"attributes":{"code":{"type":"integer_t","description":"A numerical response status code providing details about the connection.","requirement":"recommended","caption":"Response Code","type_name":"Integer"},"network_endpoint":{"type":"object_t","description":"Provides characteristics of the network endpoint.","requirement":"recommended","object_type":"network_endpoint","caption":"Network Endpoint","object_name":"Network Endpoint"}},"name":"endpoint_connection","description":"The Endpoint Connection object contains information detailing a connection attempt to an endpoint.","extends":"object","constraints":{"at_least_one":["network_endpoint","code"]},"profiles":["container"],"caption":"Endpoint Connection"},"enrichment":{"attributes":{"data":{"type":"json_t","description":"The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.","requirement":"required","caption":"Data","type_name":"JSON"},"name":{"type":"string_t","description":"The name of the attribute to which the enriched data pertains.","requirement":"required","caption":"Name","type_name":"String"},"type":{"type":"string_t","description":"The enrichment type. For example: location.","requirement":"recommended","caption":"Type","type_name":"String"},"value":{"type":"string_t","description":"The value of the attribute to which the enriched data pertains.","requirement":"required","caption":"Value","type_name":"String"},"desc":{"type":"string_t","description":"A long description of the enrichment data.","requirement":"optional","caption":"Description","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the enrichment data was generated.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"provider":{"type":"string_t","description":"The enrichment data provider name.","requirement":"recommended","caption":"Provider","type_name":"String"},"reputation":{"type":"object_t","description":"The reputation of the enrichment data.","requirement":"optional","object_type":"reputation","caption":"Reputation Scores","object_name":"Reputation"},"short_desc":{"type":"string_t","description":"A short description of the enrichment data.","requirement":"recommended","caption":"Short Description","type_name":"String"},"src_url":{"type":"url_t","description":"The URL of the source of the enrichment data.","requirement":"recommended","caption":"Source URL","type_name":"URL String"},"created_time_dt":{"type":"datetime_t","description":"The time when the enrichment data was generated.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"}},"name":"enrichment","description":"The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.","extends":"object","profiles":["datetime"],"caption":"Enrichment"},"span":{"attributes":{"message":{"type":"string_t","description":"The message in a span (often referred to as a span event) serves as a way to record significant moments or occurrences during the span's lifecycle. This content typically manifests as log entries, annotations, or semi-structured events as a string, providing additional granularity and context about what happens at specific points during the execution of an operation.","requirement":"optional","caption":"Message","type_name":"String"},"service":{"type":"object_t","description":"Identifies the service or component that generates the span, helping trace its path through the distributed system.","requirement":"optional","object_type":"service","caption":"Service","object_name":"Service"},"uid":{"type":"string_t","description":"The unique identifier for the span, used in distributed systems and microservices architectures to track and correlate requests across different components of an application. It enables tracing the flow of a request through various services.","requirement":"required","caption":"Unique ID","type_name":"String"},"operation":{"type":"string_t","description":"Describes an action performed in a span, such as API requests, database queries, or computations.","requirement":"optional","caption":"Operation","type_name":"String"},"start_time":{"type":"timestamp_t","description":"The start timestamp of the span, essential for identifying latency and performance bottlenecks. This timestamp is normalized across the observability system, ensuring consistency even when events occur across distributed services with potentially unsynchronized clocks. By using normalized time, observability tools can provide accurate, uniform measurements of operation performance and latency, regardless of where or when the events actually occur.","requirement":"required","caption":"Start Time","type_name":"Timestamp"},"duration":{"type":"long_t","description":"The total time, in milliseconds, that the span represents, calculated as the difference between start_time and end_time. It reflects the operation's performance and latency, independent of event timestamps, and accounts for normalized times used by observability tools to ensure consistency across distributed systems.","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"end_time":{"type":"timestamp_t","description":"The end timestamp of the span, essential for identifying latency and performance bottlenecks. Like the start time, this timestamp is normalized across the observability system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time allows for accurate duration calculations and helps observability tools track performance across services, regardless of the individual system time settings.","requirement":"required","caption":"End Time","type_name":"Timestamp"},"start_time_dt":{"type":"datetime_t","description":"The start timestamp of the span, essential for identifying latency and performance bottlenecks. This timestamp is normalized across the observability system, ensuring consistency even when events occur across distributed services with potentially unsynchronized clocks. By using normalized time, observability tools can provide accurate, uniform measurements of operation performance and latency, regardless of where or when the events actually occur.","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"end_time_dt":{"type":"datetime_t","description":"The end timestamp of the span, essential for identifying latency and performance bottlenecks. Like the start time, this timestamp is normalized across the observability system to ensure consistency, even when events are recorded across distributed services with unsynchronized clocks. Normalized time allows for accurate duration calculations and helps observability tools track performance across services, regardless of the individual system time settings.","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"parent_uid":{"type":"string_t","description":"The ID of the parent span for this span object, establishing its relationship in the trace hierarchy.","requirement":"optional","caption":"Parent Unique ID","type_name":"String"},"status_code":{"type":"string_t","description":"Indicates the outcome of the operation in the span, such as success, failure, or error. Issues in a span typically refer to problems such as failed operations, timeouts, service unavailability, or errors in processing that can negatively impact the performance or reliability of the system. Tracking the `status_code` helps pinpoint these issues, enabling quicker identification and resolution of system inefficiencies or faults.","requirement":"optional","caption":"Status Code","type_name":"String"}},"name":"span","description":"Represents a single unit of work or operation within a distributed trace. A span typically tracks the execution of a request across a service, capturing important details such as the operation, timestamps, and status. Spans help break down the overall trace into smaller, manageable parts, enabling detailed analysis of the performance and behavior of specific operations within the system. They are crucial for understanding latency, dependencies, and bottlenecks in complex distributed systems.","extends":"object","profiles":["datetime"],"caption":"Span"},"certificate":{"attributes":{"version":{"type":"string_t","description":"The certificate version.","requirement":"recommended","caption":"Version","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the certificate.","requirement":"optional","caption":"Unique ID","type_name":"String"},"issuer":{"type":"string_t","description":"The certificate issuer distinguished name.","requirement":"required","caption":"Issuer Distinguished Name","type_name":"String"},"is_self_signed":{"type":"boolean_t","description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA).","requirement":"recommended","caption":"Certificate Self-Signed","type_name":"Boolean"},"subject":{"type":"string_t","description":"The certificate subject distinguished name.","requirement":"recommended","caption":"Subject Distinguished Name","type_name":"String"},"fingerprints":{"type":"object_t","description":"The fingerprint list of the certificate.","is_array":true,"requirement":"recommended","object_type":"fingerprint","caption":"Fingerprints","object_name":"Fingerprint"},"created_time":{"type":"timestamp_t","description":"The time when the certificate was created.","requirement":"recommended","caption":"Created Time","type_name":"Timestamp"},"expiration_time":{"type":"timestamp_t","description":"The expiration time of the certificate.","requirement":"recommended","caption":"Expiration Time","type_name":"Timestamp"},"sans":{"type":"object_t","description":"The list of subject alternative names that are secured by a specific certificate.","is_array":true,"requirement":"optional","object_type":"san","caption":"Subject Alternative Names","object_name":"Subject Alternative Name"},"serial_number":{"type":"string_t","description":"The serial number of the certificate used to create the digital signature.","requirement":"required","caption":"Certificate Serial Number","type_name":"String","observable":37},"created_time_dt":{"type":"datetime_t","description":"The time when the certificate was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"expiration_time_dt":{"type":"datetime_t","description":"The expiration time of the certificate.","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"}},"name":"certificate","description":"The Digital Certificate, also known as a Public Key Certificate, object contains information about the ownership and usage of a public key. It serves as a means to establish trust in the authenticity and integrity of the public key and the associated entity.","extends":"object","references":[{"description":"D3FEND™ Ontology d3f:Certificate.","url":"https://d3fend.mitre.org/dao/artifact/d3f:Certificate/"}],"profiles":["datetime"],"caption":"Digital Certificate"},"key_value_object":{"attributes":{"name":{"type":"string_t","description":"The name of the key.","requirement":"required","caption":"Name","type_name":"String"},"value":{"type":"string_t","description":"The value associated to the key.","requirement":"recommended","caption":"Value","type_name":"String"},"values":{"type":"string_t","description":"Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key.","is_array":true,"requirement":"recommended","caption":"Values","type_name":"String"}},"name":"key_value_object","description":"A generic object allowing to define a {key:value} pair.","extends":"object","constraints":{"at_least_one":["value","values"]},"caption":"Key:Value object"},"location":{"attributes":{"desc":{"type":"string_t","description":"The description of the geographical location.","requirement":"optional","caption":"Description","type_name":"String"},"long":{"type":"float_t","description":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.","requirement":"optional","caption":"Longitude","type_name":"Float"},"city":{"type":"string_t","description":"The name of the city.","requirement":"recommended","caption":"City","type_name":"String"},"country":{"type":"string_t","description":"The ISO 3166-1 Alpha-2 country code.

Note: The two letter country code should be capitalized. For example: US or CA.

","references":[{"description":"ISO 3166-1 alpha-2 codes","url":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}],"requirement":"recommended","caption":"Country","type_name":"String","observable":14},"coordinates":{"type":"float_t","description":"A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. For example: [-73.983, 40.719].","is_array":true,"requirement":"optional","caption":"Coordinates","type_name":"Float","@deprecated":{"message":"Use specific lat, long attributes instead.","since":"1.2.0"}},"continent":{"type":"string_t","description":"The name of the continent.","requirement":"recommended","caption":"Continent","type_name":"String"},"aerial_height":{"type":"string_t","description":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Aerial Height","type_name":"String"},"geodetic_altitude":{"type":"string_t","description":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Geodetic Altitude","type_name":"String"},"geodetic_vertical_accuracy":{"type":"string_t","description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.","requirement":"optional","caption":"Geodetic Vertical Accuracy","type_name":"String"},"geohash":{"type":"string_t","description":"

Geohash of the geo-coordinates (latitude and longitude).

Geohashing is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string.","requirement":"optional","caption":"Geohash","type_name":"String"},"horizontal_accuracy":{"type":"string_t","description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters.","requirement":"optional","caption":"Horizontal Accuracy","type_name":"String"},"is_on_premises":{"type":"boolean_t","description":"Indicates whether the location is on-premises.","requirement":"optional","caption":"On-Premises","type_name":"Boolean"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","requirement":"optional","caption":"ISP Name","type_name":"String","@deprecated":{"message":"Utilize isp attribute available in network_endpoint, whois objects according to your use-case.","since":"1.5.0"}},"lat":{"type":"float_t","description":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.","requirement":"optional","caption":"Latitude","type_name":"Float"},"postal_code":{"type":"string_t","description":"The postal code of the location.","requirement":"optional","caption":"Postal Code","type_name":"String"},"pressure_altitude":{"type":"string_t","description":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: Invalid, No Value, or Unknown: -1000 m.","requirement":"optional","caption":"Pressure Altitude","type_name":"String"},"provider":{"type":"string_t","description":"The provider of the geographical location data.","requirement":"optional","caption":"Provider","type_name":"String"},"region":{"type":"string_t","description":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland","references":[{"description":"ISO Region Codes","url":"https://www.iso.org/iso-3166-country-codes.html"},{"description":"U.S. Region Codes","url":"https://www.iso.org/obp/ui/#iso:code:3166:US"}],"requirement":"optional","caption":"Region","type_name":"String"}},"name":"location","description":"The Geo Location object describes a geographical location, usually associated with an IP address.","extends":"object","constraints":{"at_least_one":["city","country","postal_code","region"]},"caption":"Geo Location","observable":26},"query_evidence":{"attributes":{"module":{"type":"object_t","description":"The module that pertains to the event when query_type_id indicates a Module query.","group":"primary","requirement":"recommended","object_type":"module","caption":"Module","object_name":"Module"},"process":{"type":"object_t","description":"The process that pertains to the event when query_type_id indicates a Process query.","group":"primary","requirement":"recommended","object_type":"process","caption":"Process","object_name":"Process"},"session":{"type":"object_t","description":"The authenticated user or service session when query_type_id indicates a Session query.","group":"primary","requirement":"recommended","object_type":"session","caption":"Session","object_name":"Session"},"file":{"type":"object_t","description":"The file that is the target of the query when query_type_id indicates a File query.","group":"primary","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"state":{"type":"string_t","description":"The state of the socket, normalized to the caption of the state_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","caption":"Network Connection State","type_name":"String"},"user":{"type":"object_t","description":"The user that pertains to the event when query_type_id indicates a User query.","group":"primary","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"kernel":{"type":"object_t","description":"The kernel object that pertains to the event when query_type_id indicates a Kernel query.","group":"primary","requirement":"recommended","object_type":"kernel","caption":"Kernel","object_name":"Kernel Resource"},"service":{"type":"object_t","description":"The service that pertains to the event when query_type_id indicates a Service query.","group":"primary","requirement":"recommended","object_type":"service","caption":"Service","object_name":"Service"},"group":{"type":"object_t","description":"The administrative group that is the target of the query when query_type_id indicates an Admin Group query.","group":"primary","requirement":"recommended","object_type":"group","caption":"Group","object_name":"Group"},"users":{"type":"object_t","description":"The users that belong to the administrative group when query_type_id indicates a Users query.","group":"context","is_array":true,"requirement":"optional","object_type":"user","caption":"Users","object_name":"User"},"connection_info":{"type":"object_t","description":"The network connection information related to a Network Connection query type.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"folder":{"type":"object_t","description":"The folder that is the target of the query when query_type_id indicates a Folder query.","group":"primary","requirement":"recommended","object_type":"file","caption":"Folder","object_name":"File"},"job":{"type":"object_t","description":"The job object that pertains to the event when query_type_id indicates a Job query.","group":"primary","requirement":"recommended","object_type":"job","caption":"Job","object_name":"Job"},"network_interfaces":{"type":"object_t","description":"The physical or virtual network interfaces that are associated with the device when query_type_id indicates a Network Interfaces query.","group":"primary","is_array":true,"requirement":"recommended","object_type":"network_interface","caption":"Network Interfaces","object_name":"Network Interface"},"peripheral_device":{"type":"object_t","description":"The peripheral device that triggered the event when query_type_id indicates a Peripheral Device query.","group":"primary","requirement":"recommended","object_type":"peripheral_device","caption":"Peripheral Device","object_name":"Peripheral Device"},"query_type":{"type":"string_t","description":"The normalized caption of query_type_id or the source-specific query type.","group":"classification","requirement":"optional","caption":"Query Type","type_name":"String"},"query_type_id":{"type":"integer_t","enum":{"3":{"description":"A query about folder attributes, metadata, content, or structure.","caption":"Folder"},"6":{"description":"A query about loaded modules, their base addresses, load types, or function entry points.","caption":"Module"},"0":{"description":"The query type was unknown or not specified.","caption":"Unknown"},"1":{"description":"A query about kernel resources including system calls, shared mutex, or other kernel components.","caption":"Kernel"},"2":{"description":"A query about file attributes, metadata, content, hash values, or properties.","caption":"File"},"99":{"description":"The query type was not mapped to a standard category. See the query_type attribute for source-specific value.","caption":"Other"},"4":{"description":"A query about group membership, privileges, domain, or group properties.","caption":"Admin Group"},"5":{"description":"A query about scheduled jobs, their command lines, run states, or execution times.","caption":"Job"},"7":{"description":"A query about active network connections, boundaries, protocols, or TCP states.","caption":"Network Connection"},"8":{"description":"A query about physical or virtual network interfaces, their IP/MAC addresses, or types.","caption":"Network Interfaces"},"9":{"description":"A query about attached peripheral devices, their classes, models, or vendor information.","caption":"Peripheral Device"},"10":{"description":"A query about running processes, command lines, ancestry, loaded modules, or execution context.","caption":"Process"},"11":{"description":"A query about system services, their names, versions, labels, or properties.","caption":"Service"},"12":{"description":"A query about authenticated user or service sessions, their creation times, or issuer details.","caption":"Session"},"14":{"description":"A query about multiple users belonging to an administrative group.","caption":"Users"},"15":{"description":"A query about startup configuration items, their run modes, start types, or current states.","caption":"Startup Item"},"16":{"description":"A Windows-specific query about registry keys, their paths, security descriptors, or modification times.","caption":"Registry Key"},"17":{"description":"A Windows-specific query about registry values, their data types, content, or names.","caption":"Registry Value"},"18":{"description":"A Windows-specific query about prefetch files, their run counts, last execution times, or existence.","caption":"Prefetch"},"13":{"description":"A query about user accounts, their properties, credentials, or domain information.","caption":"User"}},"description":"The normalized type of system query performed against a device or system component.","group":"classification","requirement":"required","caption":"Query Type ID","sibling":"query_type","type_name":"Integer"},"startup_item":{"type":"object_t","description":"The startup item object that pertains to the event when query_type_id indicates a Startup Item query.","group":"primary","requirement":"recommended","object_type":"startup_item","caption":"Startup Item","object_name":"Startup Item"},"tcp_state_id":{"type":"integer_t","enum":{"3":{"description":"The socket has passively received a connection request from a remote peer.","caption":"SYN-RECEIVED"},"6":{"description":"The socket connection has been closed by the local application, the remote peer has closed its half of the connection, and the system is waiting to be sure that the remote peer received the last acknowledgement.","caption":"TIME-WAIT"},"0":{"description":"The socket state is unknown.","caption":"Unknown"},"1":{"description":"The socket has an established connection between a local application and a remote peer.","caption":"ESTABLISHED"},"2":{"description":"The socket is actively trying to establish a connection to a remote peer.","caption":"SYN-SENT"},"4":{"description":"The socket connection has been closed by the local application, the remote peer has not yet acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN-WAIT-1"},"5":{"description":"The socket connection has been closed by the local application, the remote peer has acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN-WAIT-2"},"7":{"description":"The socket is not in use.","caption":"CLOSED"},"8":{"description":"The socket connection has been closed by the remote peer, and the system is waiting for the local application to close its half of the connection.","caption":"CLOSE-WAIT"},"9":{"description":"The socket connection has been closed by the remote peer, the local application has closed its half of the connection, and the system is waiting for the remote peer to acknowledge the close.","caption":"LAST-ACK"},"10":{"description":"The socket is listening for incoming connections.","caption":"LISTEN"},"11":{"description":"The socket connection has been closed by the local application and the remote peer simultaneously, and the remote peer has not yet acknowledged the close attempt of the local application.","caption":"CLOSING"}},"description":"The state of the TCP socket for the network connection.","group":"context","references":[{"description":"RFC 9293","url":"https://datatracker.ietf.org/doc/html/rfc9293"}],"requirement":"optional","caption":"TCP State ID","type_name":"Integer"},"reg_key":{"type":"object_t","description":"The registry key object describes a Windows registry key.","group":"primary","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/reg_key","caption":"Registry Key","object_name":"Registry Key"},"reg_value":{"type":"object_t","description":"The registry key object describes a Windows registry value.","group":"primary","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/reg_value","caption":"Registry Value","object_name":"Registry Value"}},"name":"query_evidence","description":"The specific resulting evidence information that was queried or discovered. When mapping raw telemetry data users should select the appropriate child object that best matches the evidence type as defined by query_type_id.","constraints":{"just_one":["connection_info","file","folder","group","job","kernel","module","network_interfaces","peripheral_device","process","reg_key","reg_value","service","session","startup_item","user"]},"profiles":["container","data_classification","linux/linux_users","macos/macos_users"],"caption":"Query Evidence"},"discovery_details":{"attributes":{"count":{"type":"integer_t","description":"The number of discovered entities of the specified type.","requirement":"recommended","caption":"Count","type_name":"Integer"},"type":{"type":"string_t","description":"The specific type of information that was discovered. e.g. name, phone_number, etc.","requirement":"recommended","caption":"Type","type_name":"String"},"value":{"type":"string_t","description":"Optionally, the specific value of discovered information.","requirement":"optional","caption":"Value","type_name":"String"},"occurrence_details":{"type":"object_t","description":"Details about where in the target entity, specified information was discovered. Only the attributes, relevant to the target entity type should be populated.","requirement":"optional","object_type":"occurrence_details","caption":"Occurrence Details","@deprecated":{"message":"Use occurrences instead.","since":"1.4.0"},"object_name":"Occurrence Details"},"occurrences":{"type":"object_t","description":"Details about where in the target entity, specified information was discovered. Only the attributes, relevant to the target entity type should be populated.","is_array":true,"requirement":"optional","object_type":"occurrence_details","caption":"Occurrences","object_name":"Occurrence Details"}},"name":"discovery_details","description":"The Discovery Details object describes results of a discovery task/job.","extends":"object","caption":"Discovery Details"},"file":{"attributes":{"modified_time":{"type":"timestamp_t","description":"The time when the file was last modified.","requirement":"optional","caption":"Modified Time","type_name":"Timestamp"},"ext":{"type":"string_t","description":"The extension of the file, excluding the leading dot. For example: exe from svchost.exe, or gz from export.tar.gz.","requirement":"recommended","caption":"File Extension","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the file as defined by the storage system, such the file system file ID.","requirement":"optional","caption":"Unique ID","type_name":"String"},"parent_folder":{"type":"string_t","description":"The parent folder in which the file resides. For example: c:\\windows\\system32","requirement":"optional","caption":"Parent Folder","type_name":"String"},"is_public":{"type":"boolean_t","description":"Indicates if the file is publicly accessible. For example in an object's public access in AWS S3","requirement":"optional","profiles":["cloud"],"caption":"Public","type_name":"Boolean"},"is_deleted":{"type":"boolean_t","description":"Indicates if the file was deleted from the filesystem.","requirement":"optional","caption":"Deleted","type_name":"Boolean"},"mime_type":{"type":"string_t","description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable.","requirement":"optional","caption":"MIME type","type_name":"String"},"owner":{"type":"object_t","description":"The user that owns the file/object.","requirement":"optional","object_type":"user","caption":"Owner","object_name":"User"},"is_system":{"type":"boolean_t","description":"The indication of whether the object is part of the operating system.","requirement":"optional","caption":"System","type_name":"Boolean"},"type":{"type":"string_t","description":"The file type.","requirement":"optional","caption":"Type","type_name":"String"},"signature":{"type":"object_t","description":"The digital signature of the file.","requirement":"optional","object_type":"digital_signature","caption":"Digital Signature","@deprecated":{"message":"Use the signatures attribute.","since":"1.8.0"},"object_name":"Digital Signature"},"attributes":{"type":"integer_t","description":"The bitmask value that represents the file attributes.","requirement":"optional","caption":"Attributes","type_name":"Integer"},"uri":{"type":"url_t","description":"The file URI, such as those reporting by static analysis tools. E.g., file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js","references":[{"description":"RFC 3986","url":"https://datatracker.ietf.org/doc/html/rfc3986"}],"requirement":"optional","caption":"File URI","type_name":"URL String"},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Character Device"},"6":{"caption":"Named Pipe"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"caption":"Regular File"},"2":{"caption":"Folder"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Block Device"},"5":{"caption":"Local Socket"},"7":{"caption":"Symbolic Link"},"8":{"caption":"Executable File"}},"description":"The file type ID. Note the distinction between a Regular File and an Executable File. If the distinction is not known, or not indicated by the log, use Regular File. In this case, it should not be assumed that a Regular File is not executable.","requirement":"required","caption":"Type ID","sibling":"type","type_name":"Integer"},"xattributes":{"type":"object_t","description":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute.

For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS:

","requirement":"optional","object_type":"object","caption":"Extended Attributes","object_name":"Object"},"modified_time_dt":{"type":"datetime_t","description":"The time when the file was last modified.","requirement":"optional","profiles":["datetime"],"caption":"Modified Time","type_name":"Datetime"},"imported_symbols":{"type":"string_t","description":"A list of symbols imported by the executable file.","is_array":true,"requirement":"optional","caption":"Imported Symbols","type_name":"String"},"product":{"type":"object_t","description":"The product that created or installed the file.","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"signatures":{"type":"object_t","description":"A collection of Digital Signature objects.","is_array":true,"requirement":"optional","object_type":"digital_signature","caption":"Digital Signatures","object_name":"Digital Signature"},"is_encrypted":{"type":"boolean_t","description":"Indicates if the file is encrypted.","requirement":"optional","caption":"Encrypted","type_name":"Boolean"},"internal_name":{"type":"string_t","description":"The name of the file as identified within the file itself. This contrasts with the name by which the file is known on disk. Where available, the internal name is widely used by security practitioners and detection content because the on-disk file name is not reliable. On the Windows OS, most PE files contain a VERSIONINFO resource from which the internal name can be obtained. On macOS, binaries can optionally embed a copy of the application's Info.plist file which in turn contains the name of the executable.","requirement":"optional","caption":"Internal Name","type_name":"String"},"name":{"type":"file_name_t","description":"The name of the file. For example: svchost.exe","requirement":"required","caption":"Name","type_name":"File Name"},"url":{"type":"object_t","description":"The URL of the file, when applicable.","requirement":"optional","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"accessed_time":{"type":"timestamp_t","description":"The time when the file was last accessed.","requirement":"optional","caption":"Accessed Time","type_name":"Timestamp"},"desc":{"type":"string_t","description":"The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.","requirement":"optional","caption":"Description","type_name":"String"},"created_time":{"type":"timestamp_t","description":"The time when the file was created.","requirement":"optional","caption":"Created Time","type_name":"Timestamp"},"confidentiality_id":{"type":"integer_t","enum":{"3":{"caption":"Secret"},"6":{"caption":"Restricted"},"0":{"description":"The confidentiality is unknown.","caption":"Unknown"},"1":{"caption":"Not Confidential"},"2":{"caption":"Confidential"},"99":{"description":"The confidentiality is not mapped. See the confidentiality attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Top Secret"},"5":{"caption":"Private"}},"description":"The normalized identifier of the file content confidentiality indicator.","requirement":"optional","caption":"Confidentiality ID","sibling":"confidentiality","type_name":"Integer"},"data_classification":{"type":"object_t","description":"The Data Classification object includes information about data classification levels and data category types.","group":"context","requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","@deprecated":{"message":"Use the attribute data_classifications instead","since":"1.4.0"},"object_name":"Data Classification"},"created_time_dt":{"type":"datetime_t","description":"The time when the file was created.","requirement":"optional","profiles":["datetime"],"caption":"Created Time","type_name":"Datetime"},"data_classifications":{"type":"object_t","description":"A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.","group":"context","is_array":true,"requirement":"recommended","profiles":["data_classification"],"object_type":"data_classification","caption":"Data Classification","object_name":"Data Classification"},"version":{"type":"string_t","description":"The file version. For example: 8.0.7601.17514.","requirement":"optional","caption":"Version","type_name":"String"},"tags":{"type":"object_t","description":"The list of tags; {key:value} pairs associated to the file.","is_array":true,"requirement":"optional","object_type":"key_value_object","caption":"Tags","object_name":"Key:Value object"},"accessed_time_dt":{"type":"datetime_t","description":"The time when the file was last accessed.","requirement":"optional","profiles":["datetime"],"caption":"Accessed Time","type_name":"Datetime"},"security_descriptor":{"type":"string_t","description":"The object security descriptor.","requirement":"optional","caption":"Security Descriptor","type_name":"String"},"accessor":{"type":"object_t","description":"The name of the user who last accessed the object.","requirement":"optional","object_type":"user","caption":"Accessor","object_name":"User"},"volume":{"type":"string_t","description":"The volume on the storage device where the file is located.","requirement":"optional","caption":"Volume","type_name":"String"},"path":{"type":"file_path_t","description":"The full path to the file. For example: c:\\windows\\system32\\svchost.exe.","requirement":"recommended","caption":"Path","type_name":"File Path"},"creator":{"type":"object_t","description":"The user that created the file.","requirement":"optional","object_type":"user","caption":"Creator","object_name":"User"},"modifier":{"type":"object_t","description":"The user that last modified the file.","requirement":"optional","object_type":"user","caption":"Modifier","object_name":"User"},"drive_type_id":{"type":"integer_t","enum":{"3":{"description":"The drive is a remote (network) drive.","caption":"Remote"},"0":{"description":"The drive type is unknown.","caption":"Unknown"},"1":{"description":"The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader.","caption":"Removable"},"2":{"description":"The drive has fixed media; for example, a hard disk drive or flash drive.","caption":"Fixed"},"99":{"description":"The drive type is not mapped. See the drive_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The drive is a CD-ROM drive.","caption":"CD-ROM"},"5":{"description":"The drive is a RAM disk.","caption":"RAM Disk"}},"description":"Identifies the type of a disk drive, i.e. fixed, removable, etc.","requirement":"optional","caption":"Drive Type ID","sibling":"drive_type","type_name":"Integer"},"is_readonly":{"type":"boolean_t","description":"Indicates that the file cannot be modified.","requirement":"optional","caption":"Read-Only","type_name":"Boolean"},"size":{"type":"long_t","description":"The size of data, in bytes.","requirement":"optional","caption":"Size","type_name":"Long"},"storage_class":{"type":"string_t","description":"The storage class of the file. For example in AWS S3: STANDARD, STANDARD_IA, GLACIER.","requirement":"optional","profiles":["cloud"],"caption":"Storage Class","type_name":"String"},"hashes":{"type":"object_t","description":"An array of hash attributes.","is_array":true,"requirement":"recommended","object_type":"fingerprint","caption":"Hashes","object_name":"Fingerprint"},"confidentiality":{"type":"string_t","description":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.","requirement":"optional","caption":"Confidentiality","type_name":"String"},"encryption_details":{"type":"object_t","description":"The encryption details of the file. Should be populated if the file is encrypted.","requirement":"optional","object_type":"encryption_details","caption":"Encryption Details","object_name":"Encryption Details"},"drive_type":{"type":"string_t","description":"The drive type, normalized to the caption of the drive_type_id value. In the case of Other, it is defined by the source.","requirement":"optional","caption":"Drive Type","type_name":"String"},"company_name":{"type":"string_t","description":"The name of the company that published the file. For example: Microsoft Corporation.","requirement":"optional","caption":"Company Name","type_name":"String"}},"name":"file","description":"The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.","extends":"_entity","constraints":{},"references":[{"description":"D3FEND™ Ontology d3f:File","url":"https://next.d3fend.mitre.org/dao/artifact/d3f:File/"}],"profiles":["data_classification","datetime"],"caption":"File","observable":24},"logger":{"attributes":{"name":{"type":"string_t","description":"The name of the logging product instance.","requirement":"recommended","caption":"Name","type_name":"String"},"version":{"type":"string_t","description":"The version of the logging provider.","requirement":"optional","caption":"Version","type_name":"String"},"device":{"type":"object_t","description":"The device where the events are logged.","requirement":"recommended","object_type":"device","caption":"Device","object_name":"Device"},"product":{"type":"object_t","description":"The product logging the event. This may be the event source product, a management server product, a scanning product, a SIEM, etc.","requirement":"recommended","object_type":"product","caption":"Product","object_name":"Product"},"uid":{"type":"string_t","description":"The unique identifier of the logging product instance.","requirement":"recommended","caption":"Unique ID","type_name":"String"},"log_level":{"type":"string_t","description":"The level at which an event was logged. This can be log provider specific. For example the audit level.","requirement":"optional","caption":"Log Level","type_name":"String"},"event_uid":{"type":"string_t","description":"The unique identifier of the event assigned by the logger.","requirement":"optional","caption":"Event UID","type_name":"String"},"is_truncated":{"type":"boolean_t","description":"Indicates whether the OCSF event data has been truncated due to size limitations. When true, some event data may have been omitted to fit within system constraints.","requirement":"optional","caption":"Is Truncated","type_name":"Boolean"},"log_format":{"type":"string_t","description":"The format of data in the log. For example JSON, syslog or CSV.","requirement":"optional","caption":"Log Format","type_name":"String"},"log_name":{"type":"string_t","description":"The log name for the logging provider log, or the file name of the system log. This may be an intermediate store-and-forward log or a vendor destination log. For example /archive/server1/var/log/messages.0 or /var/log/.","requirement":"recommended","caption":"Log Name","type_name":"String"},"log_provider":{"type":"string_t","description":"The logging provider or logging service that logged the event. This may be an intermediate application store-and-forward log or a vendor destination log.","requirement":"recommended","caption":"Log Provider","type_name":"String"},"log_version":{"type":"string_t","description":"The event log schema version of the original event. For example the syslog version or the Cisco Log Schema version","requirement":"optional","caption":"Log Version","type_name":"String"},"logged_time":{"type":"timestamp_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","requirement":"recommended","caption":"Logged Time","type_name":"Timestamp"},"transmit_time":{"type":"timestamp_t","description":"The time when the event was transmitted from the logging device to it's next destination.","requirement":"recommended","caption":"Transmission Time","type_name":"Timestamp"},"untruncated_size":{"type":"integer_t","description":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when is_truncated is true to indicate the full size of the original event.","requirement":"optional","caption":"Untruncated Size","type_name":"Integer"},"logged_time_dt":{"type":"datetime_t","description":"

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.","requirement":"optional","profiles":["datetime"],"caption":"Logged Time","type_name":"Datetime"},"transmit_time_dt":{"type":"datetime_t","description":"The time when the event was transmitted from the logging device to it's next destination.","requirement":"optional","profiles":["datetime"],"caption":"Transmission Time","type_name":"Datetime"}},"name":"logger","description":"The Logger object represents the device and product where events are stored with times for receipt and transmission. This may be at the source device where the event occurred, a remote scanning device, intermediate hops, or the ultimate destination.","extends":"_entity","constraints":{"at_least_one":["name","uid"]},"profiles":["container","data_classification","datetime"],"caption":"Logger"},"network_endpoint":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).","requirement":"optional","object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"zone":{"type":"string_t","description":"The network zone or LAN segment.","requirement":"optional","caption":"Network Zone","type_name":"String"},"uid":{"type":"string_t","description":"The unique identifier of the endpoint.","requirement":"recommended","caption":"Unique ID","type_name":"String","observable":48},"os":{"type":"object_t","description":"The endpoint operating system.","requirement":"optional","object_type":"os","caption":"OS","object_name":"Operating System (OS)"},"vpc_uid":{"type":"string_t","description":"The unique identifier of the Virtual Private Cloud (VPC).","requirement":"optional","caption":"VPC UID","type_name":"String"},"port":{"type":"port_t","description":"The port used for communication within the network connection.","requirement":"recommended","caption":"Port","type_name":"Port"},"network_scope_id":{"type":"integer_t","enum":{"0":{"description":"Unknown whether this endpoint resides within the customer’s network.","caption":"Unknown"},"1":{"description":"The endpoint resides inside the customer’s network.","caption":"Internal"},"2":{"description":"The endpoint is on the Internet or otherwise external to the customer’s network.","caption":"External"},"99":{"description":"The network scope is not mapped. See the network_scope attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the endpoint’s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined.","requirement":"optional","caption":"Network Scope ID","sibling":"network_scope","type_name":"Integer"},"fingerprints":{"type":"object_t","description":"Fingerprints that identify the specific application implementation on this endpoint, such as Cisco NPF or HASSH.","is_array":true,"requirement":"optional","object_type":"fingerprint","caption":"Fingerprints","object_name":"Fingerprint"},"owner":{"type":"object_t","description":"The identity of the service or user account that owns the endpoint or was last logged into it.","requirement":"recommended","object_type":"user","caption":"Owner","object_name":"User"},"type":{"type":"string_t","description":"The network endpoint type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.","requirement":"optional","caption":"Type","type_name":"String"},"network_scope":{"type":"string_t","description":"Indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined. The value is normalized to the caption of the network_scope_id.","requirement":"optional","caption":"Network Scope","type_name":"String"},"container":{"type":"object_t","description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","group":"context","requirement":"recommended","profiles":["container"],"object_type":"container","caption":"Container","object_name":"Container"},"type_id":{"type":"integer_t","enum":{"3":{"description":"A laptop computer.","caption":"Laptop"},"6":{"description":"A virtual machine.","caption":"Virtual"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"A server.","caption":"Server"},"2":{"description":"A desktop computer.","caption":"Desktop"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A tablet computer.","caption":"Tablet"},"5":{"description":"A mobile phone.","caption":"Mobile"},"7":{"description":"An IOT (Internet of Things) device.","caption":"IOT"},"8":{"description":"A web browser.","caption":"Browser"},"9":{"description":"A networking firewall.","caption":"Firewall"},"10":{"description":"A networking switch.","caption":"Switch"},"11":{"description":"A networking hub.","caption":"Hub"},"12":{"description":"A networking router.","caption":"Router"},"14":{"description":"An intrusion prevention system.","caption":"IPS"},"15":{"description":"A Load Balancer device.","caption":"Load Balancer"},"13":{"description":"An intrusion detection system.","caption":"IDS"}},"description":"The network endpoint type ID.","requirement":"recommended","caption":"Type ID","sibling":"type","type_name":"Integer"},"domain":{"type":"string_t","description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint.","requirement":"optional","caption":"Domain","type_name":"String"},"pool":{"type":"object_t","description":"The pool of desktops or virtual machines to which the endpoint belongs.","requirement":"optional","object_type":"group","caption":"Pool","object_name":"Group"},"interface_name":{"type":"string_t","description":"The name of the network interface (e.g. eth2).","requirement":"recommended","caption":"Network Interface Name","type_name":"String"},"isp":{"type":"string_t","description":"The name of the Internet Service Provider (ISP).","requirement":"optional","caption":"ISP Name","type_name":"String"},"namespace_pid":{"type":"integer_t","description":"If running under a process namespace (such as in a container), the process identifier within that process namespace.","group":"context","requirement":"recommended","profiles":["container"],"caption":"Namespace PID","type_name":"Integer"},"mac_vendor":{"type":"string_t","description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address.","references":[{"description":"IEEE Registration Authority","url":"https://standards.ieee.org/products-programs/regauth/"}],"requirement":"optional","caption":"MAC Vendor","type_name":"String"},"name":{"type":"string_t","description":"The short name of the endpoint.","requirement":"recommended","caption":"Name","type_name":"String"},"mac":{"type":"mac_t","description":"The Media Access Control (MAC) address of the endpoint.","requirement":"optional","caption":"MAC Address","type_name":"MAC Address"},"instance_uid":{"type":"string_t","description":"The unique identifier of a VM instance.","requirement":"recommended","caption":"Instance ID","type_name":"String"},"subnet_uid":{"type":"string_t","description":"The unique identifier of a virtual subnet.","requirement":"optional","caption":"Subnet UID","type_name":"String"},"vlan_uid":{"type":"string_t","description":"The Virtual LAN identifier.","requirement":"optional","caption":"VLAN","type_name":"String"},"svc_name":{"type":"string_t","description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service.","requirement":"recommended","caption":"Service Name","type_name":"String"},"hostname":{"type":"hostname_t","description":"The fully qualified name of the endpoint.","requirement":"recommended","caption":"Hostname","type_name":"Hostname"},"autonomous_system":{"type":"object_t","description":"The Autonomous System details associated with an IP address.","requirement":"optional","object_type":"autonomous_system","caption":"Autonomous System","object_name":"Autonomous System"},"agent_list":{"type":"object_t","description":"A list of agent objects associated with a device, endpoint, or resource.","is_array":true,"requirement":"optional","object_type":"agent","caption":"Agent List","object_name":"Agent"},"interface_uid":{"type":"string_t","description":"The unique identifier of the network interface.","requirement":"recommended","caption":"Network Interface ID","type_name":"String"},"hw_info":{"type":"object_t","description":"The endpoint hardware information.","requirement":"optional","object_type":"device_hw_info","caption":"Hardware Info","object_name":"Device Hardware Info"},"ip":{"type":"ip_t","description":"The IP address of the endpoint, in either IPv4 or IPv6 format.","requirement":"recommended","caption":"IP Address","type_name":"IP Address"},"isp_org":{"type":"string_t","description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.","requirement":"optional","caption":"ISP Org","type_name":"String"},"location":{"type":"object_t","description":"The geographical location of the endpoint.","requirement":"optional","object_type":"location","caption":"Geo Location","object_name":"Geo Location"},"intermediate_ips":{"type":"ip_t","description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header.","is_array":true,"requirement":"optional","caption":"Intermediate IP Addresses","type_name":"IP Address"}},"name":"network_endpoint","description":"The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.","extends":"endpoint","constraints":{"at_least_one":["ip","uid","name","hostname","svc_name","instance_uid","interface_uid","interface_name","domain"]},"references":[{"description":"D3FEND™ Ontology d3f:ComputerNetworkNode.","url":"https://d3fend.mitre.org/dao/artifact/d3f:ComputerNetworkNode/"}],"profiles":["container"],"caption":"Network Endpoint","observable":20}},"categories":{"attributes":{"system":{"description":"System Activity events.","uid":1,"caption":"System Activity"},"application":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"},"discovery":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"},"findings":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"},"iam":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"},"network":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"},"remediation":{"description":"Remediation events report the results of remediation commands targeting files, processes, and other objects.","uid":7,"caption":"Remediation"},"unmanned_systems":{"description":"Unmanned Systems events report the activity, existence, and/or state of unmanned systems for tracking, mission planning, and other related activities.","uid":8,"caption":"Unmanned Systems"}},"name":"category","description":"The OCSF categories organize event classes, each aligned with a specific domain or area of focus.","caption":"Categories"},"classes":{"application_lifecycle":{"attributes":{"app":{"type":"object_t","description":"The application that was affected by the lifecycle event. This also applies to self-updating application systems.","group":"primary","requirement":"required","object_type":"product","caption":"Application","object_name":"Product"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"6002":{"description":"Application Lifecycle events report installation, removal, start, stop of an application or service.","caption":"Application Lifecycle"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Start the application.","caption":"Start"},"6":{"description":"Enable the application.","caption":"Enable"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Install the application.","caption":"Install"},"2":{"description":"Remove the application.","caption":"Remove"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Stop the application.","caption":"Stop"},"5":{"description":"Restart the application.","caption":"Restart"},"7":{"description":"Disable the application.","caption":"Disable"},"8":{"description":"Update the application.","caption":"Update"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600200":{"caption":"Application Lifecycle: Unknown"},"600299":{"caption":"Application Lifecycle: Other"},"600201":{"description":"Install the application.","caption":"Application Lifecycle: Install"},"600202":{"description":"Remove the application.","caption":"Application Lifecycle: Remove"},"600203":{"description":"Start the application.","caption":"Application Lifecycle: Start"},"600204":{"description":"Stop the application.","caption":"Application Lifecycle: Stop"},"600205":{"description":"Restart the application.","caption":"Application Lifecycle: Restart"},"600206":{"description":"Enable the application.","caption":"Application Lifecycle: Enable"},"600207":{"description":"Disable the application.","caption":"Application Lifecycle: Disable"},"600208":{"description":"Update the application.","caption":"Application Lifecycle: Update"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Application Lifecycle.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"application_lifecycle","description":"Application Lifecycle events report installation, removal, start, stop of an application or service.","uid":6002,"extends":"application","category":"application","references":[{"description":"D3FEND™ Ontology d3f:ApplicationEvent","url":"https://d3fend.mitre.org/event/d3f:ApplicationEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Application Activity","caption":"Application Lifecycle","category_uid":6},"patch_state":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5004":{"description":"Operating System Patch State reports the installation of an OS patch to a device and any associated knowledgebase articles.","caption":"Operating System Patch State"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500400":{"caption":"Operating System Patch State: Unknown"},"500499":{"caption":"Operating System Patch State: Other"},"500401":{"description":"The discovered information is via a log.","caption":"Operating System Patch State: Log"},"500402":{"description":"The discovered information is via a collection process.","caption":"Operating System Patch State: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"kb_article_list":{"type":"object_t","description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.","group":"primary","is_array":true,"requirement":"recommended","object_type":"kb_article","caption":"Knowledgebase Articles","object_name":"KB Article"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Operating System Patch State.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"patch_state","description":"Operating System Patch State reports the installation of an OS patch to a device and any associated knowledgebase articles.","uid":5004,"extends":"discovery","category":"discovery","constraints":{"at_least_one":["device.os.sp_name","device.os.sp_ver","device.os.version"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Operating System Patch State","category_uid":5},"dhcp_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"transaction_uid":{"type":"string_t","description":"The unique identifier of the transaction. This is typically a random number generated from the client to associate a dhcp request/response pair.","group":"primary","requirement":"recommended","caption":"Transaction UID","type_name":"String"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"is_renewal":{"type":"boolean_t","description":"Indicates whether this is a lease/session renewal event.","group":"primary","requirement":"recommended","caption":"Renewal","type_name":"Boolean"},"class_uid":{"type":"integer_t","enum":{"4004":{"description":"DHCP Activity events report MAC to IP assignment via DHCP from a client or server.","caption":"DHCP Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"DHCPREQUEST","caption":"Request"},"6":{"description":"DHCPNAK","caption":"Nak"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"DHCPDISCOVER","caption":"Discover"},"2":{"description":"DHCPOFFER","caption":"Offer"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"DHCPDECLINE","caption":"Decline"},"5":{"description":"DHCPACK: The server accepts the request by sending the client a DHCP Acknowledgment message.","caption":"Ack"},"7":{"description":"DHCPRELEASE: A DHCP client sends a DHCPRELEASE packet to the server to release the IP address and cancel any remaining lease.","caption":"Release"},"8":{"description":"DHCPINFORM","caption":"Inform"},"9":{"description":"DHCPEXPIRE: A DHCP lease expired.","caption":"Expire"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400400":{"caption":"DHCP Activity: Unknown"},"400499":{"caption":"DHCP Activity: Other"},"400401":{"description":"DHCPDISCOVER","caption":"DHCP Activity: Discover"},"400402":{"description":"DHCPOFFER","caption":"DHCP Activity: Offer"},"400403":{"description":"DHCPREQUEST","caption":"DHCP Activity: Request"},"400404":{"description":"DHCPDECLINE","caption":"DHCP Activity: Decline"},"400405":{"description":"DHCPACK: The server accepts the request by sending the client a DHCP Acknowledgment message.","caption":"DHCP Activity: Ack"},"400406":{"description":"DHCPNAK","caption":"DHCP Activity: Nak"},"400407":{"description":"DHCPRELEASE: A DHCP client sends a DHCPRELEASE packet to the server to release the IP address and cancel any remaining lease.","caption":"DHCP Activity: Release"},"400408":{"description":"DHCPINFORM","caption":"DHCP Activity: Inform"},"400409":{"description":"DHCPEXPIRE: A DHCP lease expired.","caption":"DHCP Activity: Expire"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"relay":{"type":"object_t","description":"The network relay that is associated with the event.","group":"primary","requirement":"recommended","object_type":"network_interface","caption":"Relay","object_name":"Network Interface"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the DHCP connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"lease_dur":{"type":"integer_t","description":"This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events.","group":"primary","requirement":"recommended","caption":"Lease Duration","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: DHCP Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) of the DHCP connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"dhcp_activity","description":"DHCP Activity events report MAC to IP assignment via DHCP from a client or server.","uid":4004,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:DHCPEvent","url":"https://d3fend.mitre.org/event/d3f:DHCPEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"DHCP Activity","category_uid":4},"evidence_info":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5040":{"description":"Data collected directly from devices that represents forensic information pulled, queried, or discovered from devices that may indicate malicious activity. It contains a number of child objects, each representing a distinct evidence domain (network connections, file artifacts, registry entries, etc.). When mapping raw telemetry data users should select Query Evidence and then the appropriate child object that best matches the evidence type.","caption":"Live Evidence Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host from which evidence was collected.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"504000":{"caption":"Live Evidence Info: Unknown"},"504099":{"caption":"Live Evidence Info: Other"},"504001":{"description":"The discovered results are via a query request.","caption":"Live Evidence Info: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Live Evidence Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"query_evidence":{"type":"object_t","description":"The specific resulting evidence information that was queried or discovered based on the query type. Contains various child objects corresponding to the query_type_id values.","group":"primary","requirement":"required","object_type":"query_evidence","caption":"Query Evidence","object_name":"Query Evidence"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"evidence_info","description":"Data collected directly from devices that represents forensic information pulled, queried, or discovered from devices that may indicate malicious activity. It contains a number of child objects, each representing a distinct evidence domain (network connections, file artifacts, registry entries, etc.). When mapping raw telemetry data users should select Query Evidence and then the appropriate child object that best matches the evidence type.","uid":5040,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Live Evidence Info","category_uid":5},"admin_group_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5009":{"description":"Admin Group Query events report information about administrative groups.","caption":"Admin Group Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"group":{"type":"object_t","description":"The administrative group.","group":"primary","requirement":"required","object_type":"group","caption":"Group","object_name":"Group"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500900":{"caption":"Admin Group Query: Unknown"},"500999":{"caption":"Admin Group Query: Other"},"500901":{"description":"The discovered results are via a query request.","caption":"Admin Group Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"users":{"type":"object_t","description":"The users that belong to the administrative group.","group":"primary","is_array":true,"requirement":"recommended","object_type":"user","caption":"Users","object_name":"User"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Admin Group Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"admin_group_query","description":"Admin Group Query events report information about administrative groups.","uid":5009,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Admin Group Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"group_management":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3006":{"description":"Group Management events report management updates to a group, including updates to membership and permissions.","caption":"Group Management"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"A user that was added to or removed from the group.","group":"primary","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"subgroup":{"type":"object_t","description":"A subgroup that was added to or removed from the group.","group":"primary","requirement":"recommended","object_type":"group","caption":"Subgroup","object_name":"Group"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Add user to a group.","caption":"Add User"},"6":{"description":"A group was created.","caption":"Create"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Assign privileges to a group.","caption":"Assign Privileges"},"2":{"description":"Revoke privileges from a group.","caption":"Revoke Privileges"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Remove user from a group.","caption":"Remove User"},"5":{"description":"A group was deleted.","caption":"Delete"},"7":{"description":"Add subgroup to a group.","caption":"Add Subgroup"},"8":{"description":"Remove subgroup from a group.","caption":"Remove Subgroup"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"group":{"type":"object_t","description":"Group that was the target of the event.","group":"primary","requirement":"required","object_type":"group","caption":"Group","object_name":"Group"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"resource":{"type":"object_t","description":"Resource that the privileges give access to.","group":"primary","requirement":"recommended","object_type":"resource_details","caption":"Resource","object_name":"Resource Details"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"privileges":{"type":"string_t","description":"A list of privileges assigned to the group.","group":"primary","is_array":true,"requirement":"recommended","caption":"Privileges","type_name":"String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300600":{"caption":"Group Management: Unknown"},"300699":{"caption":"Group Management: Other"},"300601":{"description":"Assign privileges to a group.","caption":"Group Management: Assign Privileges"},"300602":{"description":"Revoke privileges from a group.","caption":"Group Management: Revoke Privileges"},"300603":{"description":"Add user to a group.","caption":"Group Management: Add User"},"300604":{"description":"Remove user from a group.","caption":"Group Management: Remove User"},"300605":{"description":"A group was deleted.","caption":"Group Management: Delete"},"300606":{"description":"A group was created.","caption":"Group Management: Create"},"300607":{"description":"Add subgroup to a group.","caption":"Group Management: Add Subgroup"},"300608":{"description":"Remove subgroup from a group.","caption":"Group Management: Remove Subgroup"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Group Management.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"group_management","description":"Group Management events report management updates to a group, including updates to membership and permissions.","uid":3006,"extends":"iam","category":"iam","references":[{"description":"D3FEND™ Ontology d3f:GroupManagementEvent","url":"https://d3fend.mitre.org/event/d3f:GroupManagementEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"Group Management","category_uid":3},"datastore_activity":{"attributes":{"query_info":{"type":"object_t","description":"The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a database query must be written using a specific syntax.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"ai_model":{"type":"object_t","description":"The AI Model object describes the characteristics of an AI/ML model. Examples include language models like GPT-4, embedding models like text-embedding-ada-002, and computer vision models like CLIP.","group":"context","requirement":"recommended","profiles":["ai_operation"],"object_type":"ai_model","caption":"AI Model","object_name":"AI Model"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying http response.","group":"primary","requirement":"recommended","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"6005":{"description":"Datastore events describe general activities (Read, Update, Query, Delete, etc.) which affect datastores or data within those datastores, e.g. (AWS RDS, AWS S3).","caption":"Datastore Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"type":{"type":"string_t","description":"The datastore resource type (e.g. database, datastore, or table).","requirement":"optional","caption":"Datastore Type","type_name":"String"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"message_context":{"type":"object_t","description":"Communication context for AI system interactions including protocols, roles, clients, and session information for MCP and other AI communication systems.","group":"context","requirement":"optional","profiles":["ai_operation"],"object_type":"message_context","caption":"Message Context","object_name":"Message Context"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The 'Connect' activity involves establishing a connection to the datastore.","caption":"Connect"},"6":{"description":"The 'Create' activity involves generating new data record details.","caption":"Create"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The 'Read' activity involves accessing specific data record details.","caption":"Read"},"2":{"description":"The 'Update' activity pertains to modifying specific data record details.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The 'Query' activity involves retrieving a filtered subset of data based on specific criteria.","caption":"Query"},"5":{"description":"The 'Write' activity involves writing specific data record details.","caption":"Write"},"7":{"description":"The 'Delete' activity involves removing specific data record details.","caption":"Delete"},"8":{"description":"The 'List' activity provides an overview of existing data records.","caption":"List"},"9":{"description":"The 'Encrypt' activity involves securing data by encrypting a specific data record.","caption":"Encrypt"},"10":{"description":"The 'Decrypt' activity involves converting encrypted data back to its original format.","caption":"Decrypt"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"type_id":{"type":"integer_t","enum":{"3":{"caption":"Table"},"0":{"description":"The datastore resource type is unknown.","caption":"Unknown"},"1":{"caption":"Database"},"2":{"caption":"Databucket"},"99":{"description":"The datastore resource type is not mapped.","caption":"Other"}},"description":"The normalized datastore resource type identifier.","requirement":"recommended","caption":"Datastore Type ID","sibling":"type","type_name":"Integer"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"databucket":{"type":"object_t","description":"The data bucket object is a basic container that holds data, typically organized through the use of data partitions.","group":"primary","requirement":"recommended","object_type":"databucket","caption":"Databucket","object_name":"Databucket"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"database":{"type":"object_t","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","group":"primary","requirement":"recommended","object_type":"database","caption":"Database","object_name":"Database"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600500":{"caption":"Datastore Activity: Unknown"},"600599":{"caption":"Datastore Activity: Other"},"600501":{"description":"The 'Read' activity involves accessing specific data record details.","caption":"Datastore Activity: Read"},"600502":{"description":"The 'Update' activity pertains to modifying specific data record details.","caption":"Datastore Activity: Update"},"600503":{"description":"The 'Connect' activity involves establishing a connection to the datastore.","caption":"Datastore Activity: Connect"},"600504":{"description":"The 'Query' activity involves retrieving a filtered subset of data based on specific criteria.","caption":"Datastore Activity: Query"},"600505":{"description":"The 'Write' activity involves writing specific data record details.","caption":"Datastore Activity: Write"},"600506":{"description":"The 'Create' activity involves generating new data record details.","caption":"Datastore Activity: Create"},"600507":{"description":"The 'Delete' activity involves removing specific data record details.","caption":"Datastore Activity: Delete"},"600508":{"description":"The 'List' activity provides an overview of existing data records.","caption":"Datastore Activity: List"},"600509":{"description":"The 'Encrypt' activity involves securing data by encrypting a specific data record.","caption":"Datastore Activity: Encrypt"},"600510":{"description":"The 'Decrypt' activity involves converting encrypted data back to its original format.","caption":"Datastore Activity: Decrypt"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"table":{"type":"object_t","description":"The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.","group":"primary","requirement":"recommended","object_type":"table","caption":"Table","object_name":"Table"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the activity.","group":"primary","requirement":"required","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying http request.","group":"primary","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Datastore Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"Details about the endpoint hosting the datastore application or service.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"datastore_activity","description":"Datastore events describe general activities (Read, Update, Query, Delete, etc.) which affect datastores or data within those datastores, e.g. (AWS RDS, AWS S3).","uid":6005,"extends":"application","category":"application","constraints":{"at_least_one":["database","databucket","table"]},"profiles":["ai_operation","cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Application Activity","caption":"Datastore Activity","category_uid":6},"user_inventory":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5003":{"description":"User Inventory Info events report user inventory data that is either logged or proactively collected. For example, when collecting user information from Active Directory entries.","caption":"User Inventory Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The user that is being discovered by an inventory process.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor describes the process that was the source of the inventory activity. In the case of user inventory data, that could be a particular process or script that is run to scrape the user data. For example, it could be a powershell process that runs to pull data from the Azure AD graph API.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500300":{"caption":"User Inventory Info: Unknown"},"500399":{"caption":"User Inventory Info: Other"},"500301":{"description":"The discovered information is via a log.","caption":"User Inventory Info: Log"},"500302":{"description":"The discovered information is via a collection process.","caption":"User Inventory Info: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: User Inventory Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"user_inventory","description":"User Inventory Info events report user inventory data that is either logged or proactively collected. For example, when collecting user information from Active Directory entries.","uid":5003,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"User Inventory Info","category_uid":5},"api_activity":{"attributes":{"ai_model":{"type":"object_t","description":"The AI Model object describes the characteristics of an AI/ML model. Examples include language models like GPT-4, embedding models like text-embedding-ada-002, and computer vision models like CLIP.","group":"context","requirement":"recommended","profiles":["ai_operation"],"object_type":"ai_model","caption":"AI Model","object_name":"AI Model"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Details about resources that were affected by the activity/event.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying http response.","group":"primary","requirement":"recommended","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"6003":{"description":"API events describe general CRUD (Create, Read, Update, Delete) API activities, e.g. (AWS Cloudtrail)","caption":"API Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"message_context":{"type":"object_t","description":"Communication context for AI system interactions including protocols, roles, clients, and session information for MCP and other AI communication systems.","group":"context","requirement":"optional","profiles":["ai_operation"],"object_type":"message_context","caption":"Message Context","object_name":"Message Context"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The API call in the event pertains to a 'update' activity.","caption":"Update"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The API call in the event pertains to a 'create' activity.","caption":"Create"},"2":{"description":"The API call in the event pertains to a 'read' activity.","caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The API call in the event pertains to a 'delete' activity.","caption":"Delete"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600300":{"caption":"API Activity: Unknown"},"600399":{"caption":"API Activity: Other"},"600301":{"description":"The API call in the event pertains to a 'create' activity.","caption":"API Activity: Create"},"600302":{"description":"The API call in the event pertains to a 'read' activity.","caption":"API Activity: Read"},"600303":{"description":"The API call in the event pertains to a 'update' activity.","caption":"API Activity: Update"},"600304":{"description":"The API call in the event pertains to a 'delete' activity.","caption":"API Activity: Delete"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"trace":{"type":"object_t","description":"The trace object contains information about distributed traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.","group":"primary","requirement":"recommended","profiles":["trace"],"object_type":"trace","caption":"Trace","object_name":"Trace"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the activity.","group":"primary","requirement":"required","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"primary","requirement":"required","profiles":null,"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying http request.","group":"primary","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: API Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The network destination endpoint.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"api_activity","description":"API events describe general CRUD (Create, Read, Update, Delete) API activities, e.g. (AWS Cloudtrail)","uid":6003,"extends":"application","category":"application","profiles":["ai_operation","cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control","trace"],"category_name":"Application Activity","caption":"API Activity","category_uid":6},"authorize_session":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3003":{"description":"Authorize Session events report privileges or groups assigned to a new user session, usually at login time.","caption":"Authorize Session"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The user to which new privileges were assigned.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Assign special privileges to a new logon.","caption":"Assign Privileges"},"2":{"description":"Assign special groups to a new logon.","caption":"Assign Groups"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"group":{"type":"object_t","description":"Group that was assigned to the new user session.","group":"primary","requirement":"recommended","object_type":"group","caption":"Group","object_name":"Group"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"privileges":{"type":"string_t","description":"The list of sensitive privileges, assigned to the new user session.","group":"primary","is_array":true,"requirement":"recommended","caption":"Privileges","type_name":"String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300300":{"caption":"Authorize Session: Unknown"},"300399":{"caption":"Authorize Session: Other"},"300301":{"description":"Assign special privileges to a new logon.","caption":"Authorize Session: Assign Privileges"},"300302":{"description":"Assign special groups to a new logon.","caption":"Authorize Session: Assign Groups"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Authorize Session.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The Endpoint for which the user session was targeted.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"session":{"type":"object_t","description":"The user session with the assigned privileges.","group":"primary","requirement":"recommended","object_type":"session","caption":"Session","object_name":"Session"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"authorize_session","description":"Authorize Session events report privileges or groups assigned to a new user session, usually at login time.","uid":3003,"extends":"iam","category":"iam","constraints":{"just_one":["privileges","group"]},"references":[{"description":"D3FEND™ Ontology d3f:AuthorizationEvent","url":"https://d3fend.mitre.org/event/d3f:AuthorizationEvent/"}],"associations":{"session":["user"],"user":["session"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"Authorize Session","category_uid":3},"application_security_posture_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"vulnerabilities":{"type":"object_t","description":"This object describes vulnerabilities reported in a security finding.","group":"primary","is_array":true,"requirement":"recommended","object_type":"vulnerability","caption":"Vulnerabilities","object_name":"Vulnerability Details"},"compliance":{"type":"object_t","description":"Provides compliance context to vulnerabilities and other weaknesses that are reported as part of an Application Security or Vulnerability Management tool's built-in compliance framework mapping.","group":"primary","requirement":"recommended","object_type":"compliance","caption":"Related Compliance","object_name":"Compliance"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities.","group":"context","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Affected Resources","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2007":{"description":"The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"Application Security Posture Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A finding was created.","caption":"Create"},"2":{"description":"A finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the affected device/host. If applicable, it can be used in conjunction with Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

","group":"context","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200700":{"caption":"Application Security Posture Finding: Unknown"},"200799":{"caption":"Application Security Posture Finding: Other"},"200701":{"description":"A finding was created.","caption":"Application Security Posture Finding: Create"},"200702":{"description":"A finding was updated.","caption":"Application Security Posture Finding: Update"},"200703":{"description":"A finding was closed.","caption":"Application Security Posture Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","profiles":["incident"],"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"application":{"type":"object_t","description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps.","group":"primary","requirement":"recommended","object_type":"application","caption":"Related Application","object_name":"Application"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified vulnerabilities or weaknesses.","group":"context","requirement":"recommended","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Application Security Posture Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"application_security_posture_finding","description":"The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2007,"extends":"finding","category":"findings","constraints":{"at_least_one":["application","compliance","remediation","vulnerabilities"]},"profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Application Security Posture Finding","category_uid":2},"peripheral_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1010":{"description":"Peripheral Activity events log a system's interactions with external, connectable, and detachable hardware. These events provide visibility into the external devices connected to and used by a system.","caption":"Peripheral Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A peripheral device was enabled on the system.","caption":"Enable"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A peripheral device was connected to the system.","caption":"Connect"},"2":{"description":"A peripheral device was disconnected from the system.","caption":"Disconnect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A peripheral device was disabled on the system.","caption":"Disable"},"5":{"description":"A peripheral device was ejected from the system. This is typically used for removable media devices. Note: For Mount and Unmount events, see the File System Activity event class.","caption":"Eject"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"peripheral_device":{"type":"object_t","description":"The peripheral device that is the subject of the activity.","group":"primary","requirement":"required","object_type":"peripheral_device","caption":"Peripheral Device","object_name":"Peripheral Device"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"101000":{"caption":"Peripheral Activity: Unknown"},"101099":{"caption":"Peripheral Activity: Other"},"101001":{"description":"A peripheral device was connected to the system.","caption":"Peripheral Activity: Connect"},"101002":{"description":"A peripheral device was disconnected from the system.","caption":"Peripheral Activity: Disconnect"},"101003":{"description":"A peripheral device was enabled on the system.","caption":"Peripheral Activity: Enable"},"101004":{"description":"A peripheral device was disabled on the system.","caption":"Peripheral Activity: Disable"},"101005":{"description":"A peripheral device was ejected from the system. This is typically used for removable media devices. Note: For Mount and Unmount events, see the File System Activity event class.","caption":"Peripheral Activity: Eject"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Peripheral Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"peripheral_activity","description":"Peripheral Activity events log a system's interactions with external, connectable, and detachable hardware. These events provide visibility into the external devices connected to and used by a system.","uid":1010,"extends":"system","category":"system","associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Peripheral Activity","category_uid":1},"networks_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5013":{"description":"Networks Query events report information about network adapters.","caption":"Networks Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501300":{"caption":"Networks Query: Unknown"},"501399":{"caption":"Networks Query: Other"},"501301":{"description":"The discovered results are via a query request.","caption":"Networks Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Networks Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"network_interfaces":{"type":"object_t","description":"The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

","group":"primary","is_array":true,"requirement":"required","object_type":"network_interface","caption":"Network Interfaces","object_name":"Network Interface"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"networks_query","description":"Networks Query events report information about network adapters.","uid":5013,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Networks Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"file_activity":{"attributes":{"file_diff":{"type":"string_t","description":"File content differences used for change detection. For example, a common use case is to identify itemized changes within INI or configuration/property setting values.","group":"primary","requirement":"recommended","caption":"File Diff","type_name":"String"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1001":{"description":"File System Activity events report when a process performs an action on a file or folder.","caption":"File System Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A request to write data to a file on a file system.","caption":"Update"},"6":{"description":"A request to set attributes for a file on a file system.","caption":"Set Attributes"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A request to create a new file on a file system.","caption":"Create"},"2":{"description":"A request to read data from a file on a file system.","caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A request to delete a file on a file system.","caption":"Delete"},"5":{"description":"A request to rename a file on a file system.","caption":"Rename"},"7":{"description":"A request to set security for a file on a file system.","caption":"Set Security"},"8":{"description":"A request to get attributes for a file on a file system.","caption":"Get Attributes"},"9":{"description":"A request to get security for a file on a file system.","caption":"Get Security"},"10":{"description":"A request to encrypt a file on a file system.","caption":"Encrypt"},"11":{"description":"A request to decrypt a file on a file system.","caption":"Decrypt"},"12":{"description":"A request to mount a file on a file system.","caption":"Mount"},"14":{"description":"A request to create a file handle.","caption":"Open"},"13":{"description":"A request to unmount a file from a file system.","caption":"Unmount"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"connection_uid":{"type":"string_t","description":"The network connection identifier.","group":"context","requirement":"optional","caption":"Connection Identifier","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"create_mask":{"type":"string_t","description":"The original Windows mask that is required to create the object.","group":"primary","requirement":"recommended","caption":"Create Mask","type_name":"String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the file object","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100100":{"caption":"File System Activity: Unknown"},"100199":{"caption":"File System Activity: Other"},"100101":{"description":"A request to create a new file on a file system.","caption":"File System Activity: Create"},"100102":{"description":"A request to read data from a file on a file system.","caption":"File System Activity: Read"},"100103":{"description":"A request to write data to a file on a file system.","caption":"File System Activity: Update"},"100104":{"description":"A request to delete a file on a file system.","caption":"File System Activity: Delete"},"100105":{"description":"A request to rename a file on a file system.","caption":"File System Activity: Rename"},"100106":{"description":"A request to set attributes for a file on a file system.","caption":"File System Activity: Set Attributes"},"100107":{"description":"A request to set security for a file on a file system.","caption":"File System Activity: Set Security"},"100108":{"description":"A request to get attributes for a file on a file system.","caption":"File System Activity: Get Attributes"},"100109":{"description":"A request to get security for a file on a file system.","caption":"File System Activity: Get Security"},"100110":{"description":"A request to encrypt a file on a file system.","caption":"File System Activity: Encrypt"},"100111":{"description":"A request to decrypt a file on a file system.","caption":"File System Activity: Decrypt"},"100112":{"description":"A request to mount a file on a file system.","caption":"File System Activity: Mount"},"100113":{"description":"A request to unmount a file from a file system.","caption":"File System Activity: Unmount"},"100114":{"description":"A request to create a file handle.","caption":"File System Activity: Open"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"access_mask":{"type":"integer_t","description":"The access mask in a platform-native format.","group":"context","requirement":"optional","caption":"Access Mask","type_name":"Integer"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: File System Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"component":{"type":"string_t","description":"

The name or relative pathname of a sub-component of the data object, if applicable.

For example: attachment.doc, attachment.zip/bad.doc, or part.mime/part.cab/part.uue/part.doc.","group":"primary","requirement":"recommended","caption":"Component","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file_result":{"type":"object_t","description":"The resulting file object when the activity was allowed and successful.","group":"primary","requirement":"recommended","object_type":"file","caption":"File Result","object_name":"File"},"file":{"type":"object_t","description":"The file that is the target of the activity.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"file_activity","description":"File System Activity events report when a process performs an action on a file or folder.","uid":1001,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:FileEvent","url":"https://d3fend.mitre.org/event/d3f:FileEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"File System Activity","category_uid":1},"email_file_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4011":{"description":"Email File Activity events report files within emails.","caption":"Email File Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Email file being scanned (example: security scanning).","caption":"Scan"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Send"},"2":{"caption":"Receive"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"email_uid":{"type":"string_t","description":"The unique identifier of the email, used to correlate related email alert and activity events.","group":"primary","requirement":"required","caption":"Email UID","type_name":"String","@deprecated":{"message":"Use the email.uid attribute instead.","since":"1.4.0"}},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"401100":{"caption":"Email File Activity: Unknown"},"401199":{"caption":"Email File Activity: Other"},"401101":{"caption":"Email File Activity: Send"},"401102":{"caption":"Email File Activity: Receive"},"401103":{"description":"Email file being scanned (example: security scanning).","caption":"Email File Activity: Scan"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Email File Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The email file attachment.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"email_file_activity","description":"Email File Activity events report files within emails.","uid":4011,"extends":"base_event","category":"network","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Network Activity","caption":"Email File Activity","@deprecated":{"message":"Use the Email Activity class with the email.files[] array instead.","since":"1.3.0"},"category_uid":4},"tunnel_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4014":{"description":"Tunnel Activity events report secure tunnel establishment (such as VPN), teardowns, renewals, and other network tunnel specific actions.","caption":"Tunnel Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The user associated with the tunnel activity.","group":"primary","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"tunnel_interface":{"type":"object_t","description":"The information about the virtual tunnel interface, e.g. utun0. This is usually associated with the private (rfc-1918) ip of the tunnel.","group":"primary","requirement":"recommended","object_type":"network_interface","caption":"Tunnel Interface","object_name":"Network Interface"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Renew a tunnel.","caption":"Renew"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Open a tunnel.","caption":"Open"},"2":{"description":"Close a tunnel.","caption":"Close"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"The device that reported the event.","group":"primary","requirement":"recommended","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"401400":{"caption":"Tunnel Activity: Unknown"},"401499":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Tunnel Activity: Other"},"401401":{"description":"Open a tunnel.","caption":"Tunnel Activity: Open"},"401402":{"description":"Close a tunnel.","caption":"Tunnel Activity: Close"},"401403":{"description":"Renew a tunnel.","caption":"Tunnel Activity: Renew"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the tunnel connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"tunnel_type_id":{"type":"integer_t","enum":{"0":{"caption":"Unknown"},"1":{"caption":"Split Tunnel"},"2":{"caption":"Full Tunnel"},"99":{"caption":"Other"}},"description":"The normalized tunnel type ID.","group":"primary","requirement":"recommended","caption":"Type","sibling":"tunnel_type","type_name":"Integer"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"tunnel_type":{"type":"string_t","description":"The tunnel type. Example: Split or Full.","group":"primary","requirement":"recommended","caption":"Type","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"Traffic refers to the amount of data moving across the tunnel at a given point of time. Ex: bytes_in and bytes_out.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"protocol_name":{"type":"string_t","description":"The networking protocol associated with the tunnel. E.g. IPSec, SSL, GRE.","group":"context","requirement":"optional","caption":"Tunnel Protocol","type_name":"String"},"connection_info":{"type":"object_t","description":"The tunnel connection information.","group":"context","requirement":"optional","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Tunnel Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The server responding to the tunnel connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"session":{"type":"object_t","description":"The session associated with the tunnel.","group":"primary","requirement":"recommended","object_type":"session","caption":"Tunnel Session","object_name":"Session"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"tunnel_activity","description":"Tunnel Activity events report secure tunnel establishment (such as VPN), teardowns, renewals, and other network tunnel specific actions.","uid":4014,"extends":"network","category":"network","constraints":{"at_least_one":["connection_info","session","src_endpoint","traffic","tunnel_interface","tunnel_type_id"]},"references":[{"description":"D3FEND™ Ontology d3f:TunnelEvent","url":"https://d3fend.mitre.org/event/d3f:TunnelEvent/"}],"associations":{"user":["src_endpoint"],"src_endpoint":["user"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"Tunnel Activity","category_uid":4},"win/registry_key_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"205004":{"description":"Registry Key Query events report information about discovered Windows registry keys.","caption":"Registry Key Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20500400":{"caption":"Registry Key Query: Unknown"},"20500499":{"caption":"Registry Key Query: Other"},"20500401":{"description":"The discovered results are via a query request.","caption":"Registry Key Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Registry Key Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"reg_key":{"type":"object_t","description":"The registry key that pertains to the event.","group":"primary","extension":"win","requirement":"required","extension_id":2,"object_type":"win/reg_key","caption":"Registry Key","object_name":"Registry Key"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"registry_key_query","description":"Registry Key Query events report information about discovered Windows registry keys.","extension":"win","uid":205004,"extends":"discovery_result","category":"discovery","extension_id":2,"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Registry Key Query","@deprecated":{"message":"Use the Evidence Info class with the Query Evidence object populated with Registry Key instead.","since":"1.5.0"},"category_uid":5},"win/registry_value_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"205005":{"description":"Registry Value Query events report information about discovered Windows registry values.","caption":"Registry Value Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"reg_value":{"type":"object_t","description":"The registry value that pertains to the event.","group":"primary","extension":"win","requirement":"required","extension_id":2,"object_type":"win/reg_value","caption":"Registry Value","object_name":"Registry Value"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20500500":{"caption":"Registry Value Query: Unknown"},"20500599":{"caption":"Registry Value Query: Other"},"20500501":{"description":"The discovered results are via a query request.","caption":"Registry Value Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Registry Value Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"registry_value_query","description":"Registry Value Query events report information about discovered Windows registry values.","extension":"win","uid":205005,"extends":"discovery_result","category":"discovery","extension_id":2,"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Registry Value Query","@deprecated":{"message":"Use the Evidence Info class with the Query Evidence object populated with Registry Value instead.","since":"1.5.0"},"category_uid":5},"job_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5010":{"description":"Job Query events report information about scheduled jobs.","caption":"Job Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501000":{"caption":"Job Query: Unknown"},"501099":{"caption":"Job Query: Other"},"501001":{"description":"The discovered results are via a query request.","caption":"Job Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"job":{"type":"object_t","description":"The job object that pertains to the event.","group":"primary","requirement":"required","object_type":"job","caption":"Job","object_name":"Job"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Job Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"job_query","description":"Job Query events report information about scheduled jobs.","uid":5010,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Job Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"scheduled_job_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1006":{"description":"Scheduled Job Activity events report activities related to scheduled jobs or tasks.","caption":"Scheduled Job Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"caption":"Delete"},"6":{"caption":"Start"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Create"},"2":{"caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Enable"},"5":{"caption":"Disable"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the job object.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100600":{"caption":"Scheduled Job Activity: Unknown"},"100699":{"caption":"Scheduled Job Activity: Other"},"100601":{"caption":"Scheduled Job Activity: Create"},"100602":{"caption":"Scheduled Job Activity: Update"},"100603":{"caption":"Scheduled Job Activity: Delete"},"100604":{"caption":"Scheduled Job Activity: Enable"},"100605":{"caption":"Scheduled Job Activity: Disable"},"100606":{"caption":"Scheduled Job Activity: Start"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"job":{"type":"object_t","description":"The job object that pertains to the event.","group":"primary","requirement":"required","object_type":"job","caption":"Job","object_name":"Job"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Scheduled Job Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"scheduled_job_activity","description":"Scheduled Job Activity events report activities related to scheduled jobs or tasks.","uid":1006,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:ScheduledJobEvent","url":"https://d3fend.mitre.org/event/d3f:ScheduledJobEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Scheduled Job Activity","category_uid":1},"process_activity":{"attributes":{"ai_model":{"type":"object_t","description":"The AI Model object describes the characteristics of an AI/ML model. Examples include language models like GPT-4, embedding models like text-embedding-ada-002, and computer vision models like CLIP.","group":"context","requirement":"recommended","profiles":["ai_operation"],"object_type":"ai_model","caption":"AI Model","object_name":"AI Model"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"launch_type_id":{"type":"integer_t","enum":{"3":{"description":"Denotes that the Launch event represents the \"exec\" step of Unix process creation, where a process replaces its executable image, command line, and environment. WSL1 pico processes on Windows also use the 2-step Unix model.","caption":"Exec"},"0":{"description":"The launch type is unknown or not specified.","caption":"Unknown"},"1":{"description":"Denotes that the Launch event represents atomic creation of a new process on Windows. This launch type ID may also be used to represent both steps of Unix process creation in a single Launch event.","caption":"Spawn"},"2":{"description":"Denotes that the Launch event represents the \"fork\" step of Unix process creation, where a process creates a clone of itself in a parent-child relationship. WSL1 pico processes on Windows also use the 2-step Unix model.","caption":"Fork"},"99":{"description":"The launch type is not mapped. See the launch_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier for the specific type of Launch activity.","group":"primary","references":[{"description":"fork() man page","url":"https://www.man7.org/linux/man-pages/man2/fork.2.html"},{"description":"execve() man page","url":"https://www.man7.org/linux/man-pages/man2/execve.2.html"}],"requirement":"recommended","caption":"Launch Type ID","sibling":"launch_type","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"1007":{"description":"Process Activity events report when a process launches, injects, opens or terminates another process, successful or otherwise.","caption":"Process Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"message_context":{"type":"object_t","description":"Communication context for AI system interactions including protocols, roles, clients, and session information for MCP and other AI communication systems.","group":"context","requirement":"optional","profiles":["ai_operation"],"object_type":"message_context","caption":"Message Context","object_name":"Message Context"},"injection_type_id":{"type":"integer_t","enum":{"3":{"caption":"Queue APC"},"0":{"description":"The injection type is unknown.","caption":"Unknown"},"1":{"caption":"Remote Thread"},"2":{"caption":"Load Library"},"99":{"description":"The injection type is not mapped. See the injection_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the process injection method.","group":"primary","requirement":"recommended","caption":"Injection Type ID","sibling":"injection_type","type_name":"Integer"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A request by the actor to obtain a handle or descriptor to a process with the aim of performing further actions upon that process. The target is usually a different process but this activity can also be reflexive.","caption":"Open"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A request by the actor to launch another process. Refer to the launch_type_id attribute for details of the specific launch type.","caption":"Launch"},"2":{"description":"A request by the actor to terminate a process. This activity is most commonly reflexive, this being the case when a process exits at its own initiation. Note too that Windows security products cannot always identify the actor in the case of inter-process termination. In this case, actor.process and process refer to the exiting process, i.e. indistinguishable from the reflexive case.","caption":"Terminate"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A request by the actor to execute code within the context of a process. The target is usually a different process but this activity can also be reflexive. Refer to the injection_type_id attribute for details of the specific injection type.","references":[{"description":"Guidance on the use of \"Module Activity: Load\" and \"Process Activity: Inject\".","url":"https://github.com/ocsf/ocsf-docs/blob/main/faqs/schema-faq.md#when-should-i-use-a-module-activity-load-event-and-when-should-i-use-a-process-activity-inject-event"}],"caption":"Inject"},"5":{"description":"A request by the actor to change its user identity by invoking the setuid() system call. Common programs like su and sudo use this mechanism. Note that the impersonation mechanism on Windows is not directly equivalent because it acts at the thread level.","caption":"Set User ID"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","references":[{"description":"setuid() man page","url":"https://www.man7.org/linux/man-pages/man2/setuid.2.html"}],"requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"module":{"type":"object_t","description":"The module that was injected by the actor process.","group":"primary","requirement":"recommended","object_type":"module","caption":"Module","object_name":"Module"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"launch_type":{"type":"string_t","description":"The specific type of Launch activity, normalized to the caption of the launch_type_id value. In the case of Other it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Launch Type","type_name":"String"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the target process. For example, the process that started a new process or injected code into another process.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100700":{"caption":"Process Activity: Unknown"},"100799":{"caption":"Process Activity: Other"},"100701":{"description":"A request by the actor to launch another process. Refer to the launch_type_id attribute for details of the specific launch type.","caption":"Process Activity: Launch"},"100702":{"description":"A request by the actor to terminate a process. This activity is most commonly reflexive, this being the case when a process exits at its own initiation. Note too that Windows security products cannot always identify the actor in the case of inter-process termination. In this case, actor.process and process refer to the exiting process, i.e. indistinguishable from the reflexive case.","caption":"Process Activity: Terminate"},"100703":{"description":"A request by the actor to obtain a handle or descriptor to a process with the aim of performing further actions upon that process. The target is usually a different process but this activity can also be reflexive.","caption":"Process Activity: Open"},"100704":{"description":"A request by the actor to execute code within the context of a process. The target is usually a different process but this activity can also be reflexive. Refer to the injection_type_id attribute for details of the specific injection type.","references":[{"description":"Guidance on the use of \"Module Activity: Load\" and \"Process Activity: Inject\".","url":"https://github.com/ocsf/ocsf-docs/blob/main/faqs/schema-faq.md#when-should-i-use-a-module-activity-load-event-and-when-should-i-use-a-process-activity-inject-event"}],"caption":"Process Activity: Inject"},"100705":{"description":"A request by the actor to change its user identity by invoking the setuid() system call. Common programs like su and sudo use this mechanism. Note that the impersonation mechanism on Windows is not directly equivalent because it acts at the thread level.","caption":"Process Activity: Set User ID"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"injection_type":{"type":"string_t","description":"The process injection method, normalized to the caption of the injection_type_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Injection Type","type_name":"String"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"actual_permissions":{"type":"integer_t","description":"The permissions that were granted to the process in a platform-native format.","group":"primary","requirement":"recommended","caption":"Actual Permissions","type_name":"Integer"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process that was launched, injected into, opened, or terminated.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"requested_permissions":{"type":"integer_t","description":"The permissions mask that was requested by the process.","group":"primary","requirement":"recommended","caption":"Requested Permissions","type_name":"Integer"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Process Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"exit_code":{"type":"integer_t","description":"The exit code reported by a process when it terminates. The convention is that zero indicates success and any non-zero exit code indicates that some error occurred.","group":"primary","requirement":"recommended","caption":"Exit Code","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"process_activity","description":"Process Activity events report when a process launches, injects, opens or terminates another process, successful or otherwise.","uid":1007,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:ProcessEvent","url":"https://d3fend.mitre.org/event/d3f:ProcessEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["ai_operation","cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Process Activity","category_uid":1},"kernel_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1003":{"description":"Kernel Activity events report when an process creates, reads, or deletes a kernel resource.","caption":"Kernel Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"caption":"Delete"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Create"},"2":{"caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Invoke"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"kernel":{"type":"object_t","description":"The target kernel resource.","group":"primary","requirement":"required","object_type":"kernel","caption":"Kernel","object_name":"Kernel Resource"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100300":{"caption":"Kernel Activity: Unknown"},"100399":{"caption":"Kernel Activity: Other"},"100301":{"caption":"Kernel Activity: Create"},"100302":{"caption":"Kernel Activity: Read"},"100303":{"caption":"Kernel Activity: Delete"},"100304":{"caption":"Kernel Activity: Invoke"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Kernel Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"kernel_activity","description":"Kernel Activity events report when an process creates, reads, or deletes a kernel resource.","uid":1003,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:KernelEvent","url":"https://d3fend.mitre.org/event/d3f:KernelEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Kernel Activity","category_uid":1},"security_finding":{"attributes":{"state_id":{"type":"integer_t","enum":{"3":{"description":"The finding was reviewed, considered as a false positive and is now suppressed.","caption":"Suppressed"},"0":{"description":"The state is unknown.","caption":"Unknown"},"1":{"description":"The finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The finding is under review.","caption":"In Progress"},"99":{"description":"The state is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The finding was reviewed and remediated and is now considered resolved.","caption":"Resolved"}},"description":"The normalized state identifier of a security finding.","group":"context","requirement":"required","caption":"State ID","sibling":"state","type_name":"Integer"},"vulnerabilities":{"type":"object_t","description":"This object describes vulnerabilities reported in a security finding.","group":"context","is_array":true,"requirement":"optional","object_type":"vulnerability","caption":"Vulnerabilities","object_name":"Vulnerability Details"},"compliance":{"type":"object_t","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details.","group":"context","requirement":"optional","object_type":"compliance","caption":"Compliance","object_name":"Compliance"},"state":{"type":"string_t","description":"The normalized state of a security finding.","group":"context","requirement":"optional","caption":"State","type_name":"String"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"kill_chain":{"type":"object_t","description":"The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.","group":"context","is_array":true,"requirement":"optional","object_type":"kill_chain_phase","caption":"Kill Chain","object_name":"Kill Chain Phase"},"resources":{"type":"object_t","description":"Describes details about resources that were affected by the activity/event.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"context","is_array":true,"requirement":"optional","profiles":null,"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"2001":{"description":"Security Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products","caption":"Security Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A security finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A security finding was created.","caption":"Create"},"2":{"description":"A security finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"nist":{"type":"string_t","description":"The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk.","group":"context","is_array":true,"requirement":"optional","caption":"NIST List","type_name":"String"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"primary","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing the tactics, techniques & sub-techniques associated to the Finding.","group":"context","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":null,"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"cis_csc":{"type":"object_t","description":"The CIS Critical Security Controls is a list of top 20 actions and practices an organization’s security team can take on such that cyber attacks or malware, are minimized and prevented.","group":"context","is_array":true,"requirement":"optional","object_type":"cis_csc","caption":"CIS CSC","@deprecated":{"message":"Use CIS Controls for standard benchmark controls.","since":"1.5.0"},"object_name":"CIS CSC"},"evidence":{"type":"json_t","description":"The data the finding exposes to the analyst.","group":"context","requirement":"optional","caption":"Evidence","type_name":"JSON","@deprecated":{"message":"Use the evidences attribute instead.","since":"1.1.0"}},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"primary","requirement":"recommended","profiles":null,"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200100":{"caption":"Security Finding: Unknown"},"200199":{"caption":"Security Finding: Other"},"200101":{"description":"A security finding was created.","caption":"Security Finding: Create"},"200102":{"description":"A security finding was updated.","caption":"Security Finding: Update"},"200103":{"description":"A security finding was closed.","caption":"Security Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"data_sources":{"type":"string_t","description":"A list of data sources utilized in generation of the finding.","group":"context","is_array":true,"requirement":"optional","caption":"Data Sources","type_name":"String"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"primary","requirement":"recommended","profiles":null,"caption":"Risk Score","type_name":"Integer"},"finding":{"type":"object_t","description":"The Finding object provides details about a finding/detection generated by a security tool.","group":"primary","requirement":"required","object_type":"finding","caption":"Finding","object_name":"Finding"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"primary","requirement":"recommended","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","profiles":null,"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process object.","group":"context","requirement":"optional","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"analytic":{"type":"object_t","description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion.","group":"primary","requirement":"recommended","object_type":"analytic","caption":"Analytic","object_name":"Analytic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"primary","requirement":"recommended","profiles":null,"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Security Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"security_finding","description":"Security Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products","uid":2001,"extends":"base_event","category":"findings","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Security Finding","@deprecated":{"message":"Use the new specific classes according to the use-case: Vulnerability Finding, Compliance Finding, Detection Finding, Incident Finding, Data Security Finding.","since":"1.1.0"},"category_uid":2},"email_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"email":{"type":"object_t","description":"The email object.","group":"primary","requirement":"required","object_type":"email","caption":"Email","object_name":"Email"},"banner":{"type":"string_t","description":"The initial connection response that a messaging server receives after it connects to an email server.","group":"context","requirement":"optional","caption":"Protocol Banner","type_name":"String"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4009":{"description":"Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the Email object for details.","caption":"Email Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Email being scanned (example: security scanning)","caption":"Scan"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Send"},"2":{"caption":"Receive"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Follow an email message as it travels through an organization. The message_trace_uid should be populated when selected.","references":[{"description":"For example Office 365 Email Message Trace","url":"href='https://learn.microsoft.com/en-us/Exchange/monitoring/trace-an-email-message/message-trace-modern-eac"}],"caption":"Trace"},"5":{"description":"Email processed by an MTA, typically combining send, receive, and scan operations into a single activity.","caption":"MTA Relay"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"message_trace_uid":{"type":"string_t","description":"The identifier that tracks a message that travels through multiple points of a messaging service.","group":"primary","references":[{"description":"For example Office 365 Message Trace Report.","url":"https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)"}],"requirement":"recommended","caption":"Message Trace UID","type_name":"String"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"direction":{"type":"string_t","description":"The direction of the email, as defined by the direction_id value.","group":"context","requirement":"optional","caption":"Direction","type_name":"String"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"attempt":{"type":"integer_t","description":"The attempt number for attempting to deliver the email.","group":"context","requirement":"optional","caption":"Attempt","type_name":"Integer"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400900":{"caption":"Email Activity: Unknown"},"400999":{"caption":"Email Activity: Other"},"400901":{"caption":"Email Activity: Send"},"400902":{"caption":"Email Activity: Receive"},"400903":{"description":"Email being scanned (example: security scanning)","caption":"Email Activity: Scan"},"400904":{"description":"Follow an email message as it travels through an organization. The message_trace_uid should be populated when selected.","references":[{"description":"For example Office 365 Email Message Trace","url":"href='https://learn.microsoft.com/en-us/Exchange/monitoring/trace-an-email-message/message-trace-modern-eac"}],"caption":"Email Activity: Trace"},"400905":{"description":"Email processed by an MTA, typically combining send, receive, and scan operations into a single activity.","caption":"Email Activity: MTA Relay"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) sending the email.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"command":{"type":"string_t","description":"The command issued by the initiator (client), such as SMTP HELO or EHLO.","group":"primary","requirement":"recommended","caption":"Command","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"smtp_hello":{"type":"string_t","description":"The value of the SMTP HELO or EHLO command sent by the initiator (client).","group":"primary","requirement":"recommended","caption":"SMTP Hello","type_name":"String","@deprecated":{"message":"Use the command attribute instead.","since":"1.4.0"}},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"email_auth":{"type":"object_t","description":"The SPF, DKIM and DMARC attributes of an email.","group":"primary","requirement":"recommended","object_type":"email_auth","caption":"Email Authentication","object_name":"Email Authentication"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"from":{"type":"email_t","description":"The sender address from the transmission envelope. This reflects the actual sending party and may differ from the 'From' header in the message.","group":"primary","references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"From","type_name":"Email Address"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"protocol_name":{"type":"string_t","description":"The Protocol Name specifies the email communication protocol, such as SMTP, IMAP, or POP3.","group":"primary","requirement":"recommended","caption":"Protocol Name","type_name":"String"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Email Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) receiving the email.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"direction_id":{"type":"integer_t","enum":{"3":{"description":"Email Internal, from inside the network destined for an entity inside network.","caption":"Internal"},"0":{"description":"The email direction is unknown.","caption":"Unknown"},"1":{"description":"Email Inbound, from the Internet or outside network destined for an entity inside network.","caption":"Inbound"},"2":{"description":"Email Outbound, from inside the network destined for an entity outside network.","caption":"Outbound"},"99":{"description":"The direction is not mapped. See the direction attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Local network connection (localhost). The connection is intra-device, originating from and destined for services running on the same device.","caption":"Local"}},"description":"

The direction of the email relative to the scanning host or organization.

Email scanned at an internet gateway might be characterized as inbound to the organization from the Internet, outbound from the organization to the Internet, or internal within the organization. Email scanned at a workstation might be characterized as inbound to, or outbound from the workstation.","group":"context","requirement":"required","caption":"Direction ID","sibling":"direction","type_name":"Integer"},"to":{"type":"email_t","description":"The recipient address from the transmission envelope. This may differ from the 'To' header and represents where the message was actually delivered.","group":"primary","is_array":true,"references":[{"description":"RFC 5322","url":"https://www.rfc-editor.org/rfc/rfc5322"}],"requirement":"recommended","caption":"To","type_name":"Email Address"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"email_activity","description":"Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the Email object for details.","uid":4009,"extends":"base_event","category":"network","references":[{"description":"D3FEND™ Ontology d3f:EmailEvent","url":"https://d3fend.mitre.org/event/d3f:EmailEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Network Activity","caption":"Email Activity","category_uid":4},"data_security_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Describes details about additional resources, where classified or sensitive data is stored in, or was accessed from.

You can populate this object, if the specific resource type objects available in the class (database, databucket, table, file) aren't sufficient; OR
You can also choose to duplicate uid, name of the specific resources objects, for a consistent access to resource uids across all findings.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Additional Resources","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2006":{"description":"A Data Security Finding describes detections or alerts generated by various data security products such as Data Loss Prevention (DLP), Data Classification, Secrets Management, Digital Rights Management (DRM), Data Security Posture Management (DSPM), and similar tools. These detections or alerts can be created using fingerprinting, statistical analysis, machine learning or other methodologies. The finding describes the actors and endpoints who accessed or own the sensitive data, as well as the resources which store the sensitive data. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"Data Security Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"data_security":{"type":"object_t","description":"The Data Security object describes the characteristics, techniques and content of a Data Loss Prevention (DLP), Data Loss Detection (DLD), Data Classification, or similar tools' finding, alert, or detection mechanism(s).","group":"context","requirement":"recommended","object_type":"data_security","caption":"Data Security","object_name":"Data Security"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"An existing Data Security finding is closed, this can be due to any resolution (e.g., True Positive, False Positive, etc.).","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A new Data Security finding is created.","caption":"Create"},"2":{"description":"An existing Data Security finding is updated with more information.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"An existing Data Security finding is suppressed due to inaccurate detection techniques or a known true negative.","caption":"Suppressed","@deprecated":{"message":"Use status_id attribute instead.","since":"1.4.0"}}},"description":"The normalized identifier of the Data Security Finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"databucket":{"type":"object_t","description":"Describes the databucket where classified or sensitive data is stored in, or was accessed from. The data bucket object is a basic container that holds data, typically organized through the use of data partitions.","group":"primary","requirement":"recommended","object_type":"databucket","caption":"Databucket","object_name":"Databucket"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"database":{"type":"object_t","description":"Describes the database where classified or sensitive data is stored in, or was accessed from. Databases are typically datastore services that contain an organized collection of structured and/or semi-structured data.","group":"primary","requirement":"recommended","object_type":"database","caption":"Database","object_name":"Database"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the device where classified or sensitive data is stored in, or was accessed from.","group":"context","requirement":"recommended","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"Describes details about the actor implicated in the data security finding. Either an actor that owns a particular digital file or information store, or an actor which accessed classified or sensitive data.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200600":{"caption":"Data Security Finding: Unknown"},"200699":{"caption":"Data Security Finding: Other"},"200601":{"description":"A new Data Security finding is created.","caption":"Data Security Finding: Create"},"200602":{"description":"An existing Data Security finding is updated with more information.","caption":"Data Security Finding: Update"},"200603":{"description":"An existing Data Security finding is closed, this can be due to any resolution (e.g., True Positive, False Positive, etc.).","caption":"Data Security Finding: Close"},"200604":{"description":"An existing Data Security finding is suppressed due to inaccurate detection techniques or a known true negative.","caption":"Data Security Finding: Suppressed","@deprecated":{"message":"Use status_id attribute instead.","since":"1.4.0"}}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"table":{"type":"object_t","description":"Describes the table where classified or sensitive data is stored in, or was accessed from. The table object represents a table within a structured relational database, warehouse, lake, or similar.","group":"primary","requirement":"recommended","object_type":"table","caption":"Table","object_name":"Table"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"src_endpoint":{"type":"object_t","description":"Details about the source endpoint where classified or sensitive data was accessed from.","group":"context","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The Data Security finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"context","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"optional","profiles":null,"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. For example, an activity_id of 'Create' could constitute an alertable signal and the value would be true, while 'Close' likely would not and either omit the attribute or set its value to false. Note that other events with the security_control profile may also be deemed alertable signals and may also carry is_alert = true attributes.","group":"primary","requirement":"recommended","profiles":null,"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Data Security Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"Describes the endpoint where classified or sensitive data is stored in, or was accessed from.","group":"context","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"file":{"type":"object_t","description":"Describes a file that contains classified or sensitive data.","group":"primary","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"context","requirement":"optional","profiles":null,"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"data_security_finding","description":"A Data Security Finding describes detections or alerts generated by various data security products such as Data Loss Prevention (DLP), Data Classification, Secrets Management, Digital Rights Management (DRM), Data Security Posture Management (DSPM), and similar tools. These detections or alerts can be created using fingerprinting, statistical analysis, machine learning or other methodologies. The finding describes the actors and endpoints who accessed or own the sensitive data, as well as the resources which store the sensitive data. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2006,"extends":"finding","category":"findings","profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Data Security Finding","category_uid":2},"win/registry_key_activity":{"attributes":{"prev_reg_key":{"type":"object_t","description":"The registry key before the mutation","group":"primary","extension":"win","requirement":"recommended","extension_id":2,"object_type":"win/reg_key","caption":"Previous Registry Key","object_name":"Registry Key"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"201001":{"description":"Registry Key Activity events report when a process performs an action on a Windows registry key.","caption":"Registry Key Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"caption":"Modify"},"6":{"caption":"Set Security"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Create"},"2":{"caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Delete"},"5":{"caption":"Rename"},"7":{"caption":"Restore"},"8":{"caption":"Import"},"9":{"caption":"Export"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"create_mask":{"type":"string_t","description":"The original Windows mask that is required to create the object.","group":"primary","requirement":"recommended","caption":"Create Mask","type_name":"String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the reg_key object.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"open_mask":{"type":"integer_t","description":"The Windows options needed to open a registry key.","group":"primary","requirement":"recommended","caption":"Open Mask","type_name":"Integer"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20100100":{"caption":"Registry Key Activity: Unknown"},"20100199":{"caption":"Registry Key Activity: Other"},"20100101":{"caption":"Registry Key Activity: Create"},"20100102":{"caption":"Registry Key Activity: Read"},"20100103":{"caption":"Registry Key Activity: Modify"},"20100104":{"caption":"Registry Key Activity: Delete"},"20100105":{"caption":"Registry Key Activity: Rename"},"20100106":{"caption":"Registry Key Activity: Set Security"},"20100107":{"caption":"Registry Key Activity: Restore"},"20100108":{"caption":"Registry Key Activity: Import"},"20100109":{"caption":"Registry Key Activity: Export"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"access_mask":{"type":"integer_t","description":"The access mask in a platform-native format.","group":"primary","requirement":"recommended","caption":"Access Mask","type_name":"Integer"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Registry Key Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"reg_key":{"type":"object_t","description":"The registry key.","group":"primary","extension":"win","requirement":"required","extension_id":2,"object_type":"win/reg_key","caption":"Registry Key","object_name":"Registry Key"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"registry_key_activity","description":"Registry Key Activity events report when a process performs an action on a Windows registry key.","extension":"win","uid":201001,"extends":"system","category":"system","extension_id":2,"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Registry Key Activity","category_uid":1},"base_event":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"0":{"description":"The base event is a generic and concrete event. It also defines a set of attributes available in most event classes. As a generic event that does not belong to any event category, it could be used to log events that are not otherwise defined by the schema.","caption":"Base Event"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"0":{"caption":"Uncategorized"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"0":{"caption":"Base Event: Unknown"},"99":{"caption":"Base Event: Other"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Base Event.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"base_event","description":"The base event is a generic and concrete event. It also defines a set of attributes available in most event classes. As a generic event that does not belong to any event category, it could be used to log events that are not otherwise defined by the schema.","uid":0,"category":"other","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"caption":"Base Event","category_uid":0},"ftp_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"port":{"type":"port_t","description":"The dynamic port established for impending data transfers.","group":"primary","requirement":"recommended","caption":"Port","type_name":"Port"},"class_uid":{"type":"integer_t","enum":{"4008":{"description":"File Transfer Protocol (FTP) Activity events report file transfers between a server and a client as seen on the network.","caption":"FTP Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"type":{"type":"string_t","description":"The type of FTP network connection (e.g. active, passive).","group":"primary","requirement":"recommended","caption":"Type","type_name":"String"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Poll directory for specific file(s) or folder(s) at the FTP or SFTP site location.","caption":"Poll"},"6":{"description":"List files in a specified directory.","caption":"List"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"File upload to the FTP or SFTP site.","caption":"Put"},"2":{"description":"File download from the FTP or SFTP site.","caption":"Get"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Delete file(s) from the FTP or SFTP site.","caption":"Delete"},"5":{"description":"Rename the file(s) in the FTP or SFTP site.","caption":"Rename"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"name":{"type":"string_t","description":"The name of the data affiliated with the command.","group":"primary","requirement":"recommended","caption":"Name","type_name":"String"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"command_responses":{"type":"string_t","description":"The list of responses to the FTP command.","group":"primary","is_array":true,"requirement":"recommended","caption":"Command Responses","type_name":"String"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400800":{"caption":"FTP Activity: Unknown"},"400899":{"caption":"FTP Activity: Other"},"400801":{"description":"File upload to the FTP or SFTP site.","caption":"FTP Activity: Put"},"400802":{"description":"File download from the FTP or SFTP site.","caption":"FTP Activity: Get"},"400803":{"description":"Poll directory for specific file(s) or folder(s) at the FTP or SFTP site location.","caption":"FTP Activity: Poll"},"400804":{"description":"Delete file(s) from the FTP or SFTP site.","caption":"FTP Activity: Delete"},"400805":{"description":"Rename the file(s) in the FTP or SFTP site.","caption":"FTP Activity: Rename"},"400806":{"description":"List files in a specified directory.","caption":"FTP Activity: List"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"codes":{"type":"integer_t","description":"The list of return codes to the FTP command.","group":"primary","is_array":true,"requirement":"recommended","caption":"Response Codes","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"command":{"type":"string_t","description":"The FTP command.","group":"primary","requirement":"recommended","caption":"Command","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: FTP Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the FTP activity.","group":"context","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"ftp_activity","description":"File Transfer Protocol (FTP) Activity events report file transfers between a server and a client as seen on the network.","uid":4008,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:FTPEvent","url":"https://d3fend.mitre.org/event/d3f:FTPEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"FTP Activity","category_uid":4},"win/windows_resource_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"201003":{"description":"Windows Resource Activity events report when a process accesses a Windows managed resource object, successful or otherwise.","caption":"Windows Resource Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Access"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"win_resource":{"type":"object_t","description":"The Windows resource object that was accessed, such as a mutant or timer.","group":"primary","extension":"win","requirement":"required","extension_id":2,"object_type":"win/win_resource","caption":"Windows Resource","object_name":"Windows Resource"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20100300":{"caption":"Windows Resource Activity: Unknown"},"20100399":{"caption":"Windows Resource Activity: Other"},"20100301":{"caption":"Windows Resource Activity: Access"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Windows Resource Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"windows_resource_activity","description":"Windows Resource Activity events report when a process accesses a Windows managed resource object, successful or otherwise.","extension":"win","uid":201003,"extends":"system","category":"system","extension_id":2,"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Windows Resource Activity","category_uid":1},"authentication":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3002":{"description":"Authentication events report authentication session activities, including user attempts to log on or log off, regardless of success, as well as other key stages within the authentication process. These events are typically generated by authentication services, such as Kerberos, OIDC, or SAML, and may include information about the user, the authentication method used, and the status of the authentication attempt.","caption":"Authentication"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The subject (user/role or account) to authenticate.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"account_switch_type":{"type":"string_t","description":"The account switch method, normalized to the caption of the account_switch_type_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Account Switch Type","type_name":"String"},"logon_type_id":{"type":"integer_t","enum":{"3":{"description":"A user or device logged onto this device from the network.","caption":"Network"},"0":{"description":"The logon type is unknown.","caption":"Unknown"},"1":{"description":"Used only by the System account, for example at system startup.","caption":"System"},"2":{"description":"A local logon to device console.","caption":"Interactive"},"99":{"description":"The logon type is not mapped. See the logon_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A batch server logon, where processes may be executing on behalf of a user without their direct intervention.","caption":"Batch"},"5":{"description":"A logon by a service or daemon that was started by the OS.","caption":"OS Service"},"7":{"description":"A user unlocked the device.","caption":"Unlock"},"8":{"description":"A user logged on to this device from the network. The user's password in the authentication package was not hashed.","caption":"Network Cleartext"},"9":{"description":"A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.","caption":"New Credentials"},"10":{"description":"A remote logon using Terminal Services or remote desktop application.","caption":"Remote Interactive"},"11":{"description":"A user logged on to this device with network credentials that were stored locally on the device and the domain controller was not contacted to verify the credentials.","caption":"Cached Interactive"},"12":{"description":"Same as Remote Interactive. This is used for internal auditing.","caption":"Cached Remote Interactive"},"13":{"description":"Workstation logon.","caption":"Cached Unlock"}},"description":"The normalized logon type identifier.","group":"primary","requirement":"recommended","caption":"Logon Type ID","sibling":"logon_type","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A Kerberos authentication ticket (TGT) was requested.","caption":"Authentication Ticket"},"6":{"description":"A preauthentication stage was engaged.","caption":"Preauth"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A new logon session was requested.","caption":"Logon"},"2":{"description":"A logon session was terminated and no longer exists.","caption":"Logoff"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A Kerberos service ticket was requested.","caption":"Service Ticket Request"},"5":{"description":"A Kerberos service ticket was renewed.","caption":"Service Ticket Renew"},"7":{"description":"A utility or service switched the user account. See the account_switch_type_id attribute for more details.","caption":"Account Switch"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"auth_factors":{"type":"object_t","description":"Describes a category of methods used for identity verification in an authentication attempt.","group":"context","is_array":true,"requirement":"optional","object_type":"auth_factor","caption":"Authentication Factors","object_name":"Authentication Factor"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"auth_protocol":{"type":"string_t","description":"The authentication protocol as defined by the caption of auth_protocol_id. In the case of Other, it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Auth Protocol","type_name":"String"},"is_remote":{"type":"boolean_t","description":"The attempted authentication is over a remote connection.","group":"primary","requirement":"recommended","caption":"Remote","type_name":"Boolean"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"authentication_token":{"type":"object_t","description":"The authentication token, ticket, or assertion, e.g. Kerberos, OIDC, SAML.","group":"context","references":[{"description":"RFC 4120: The Kerberos Network Authentication Service (V5)","url":"https://www.rfc-editor.org/rfc/rfc4120"},{"description":"OpenID Connect Core 1.0","url":"https://openid.net/specs/openid-connect-core-1_0.html"},{"description":"The OASIS Security Assertion Markup Language (SAML) V2.0","url":"https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"}],"requirement":"optional","object_type":"authentication_token","caption":"Authentication Token","object_name":"Authentication Token"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"is_new_logon":{"type":"boolean_t","description":"Indicates logon is from a device not seen before or a first time account logon.","group":"context","requirement":"optional","caption":"New Logon","type_name":"Boolean"},"auth_protocol_id":{"type":"integer_t","enum":{"3":{"caption":"Digest"},"6":{"caption":"OAUTH 2.0"},"0":{"description":"The authentication protocol is unknown.","caption":"Unknown"},"1":{"caption":"NTLM"},"2":{"caption":"Kerberos"},"99":{"description":"The authentication protocol is not mapped. See the auth_protocol attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"OpenID"},"5":{"caption":"SAML"},"7":{"caption":"PAP"},"8":{"caption":"CHAP"},"9":{"caption":"EAP"},"10":{"caption":"RADIUS"},"11":{"caption":"Basic Authentication"},"12":{"caption":"LDAP"}},"description":"The normalized identifier of the authentication protocol used to create the user session.","group":"primary","requirement":"recommended","caption":"Auth Protocol ID","sibling":"auth_protocol","type_name":"Integer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"service":{"type":"object_t","description":"The service or gateway to which the user or process is being authenticated","group":"primary","requirement":"recommended","object_type":"service","caption":"Service","object_name":"Service"},"is_mfa":{"type":"boolean_t","description":"Indicates whether Multi Factor Authentication was used during authentication.","group":"primary","requirement":"recommended","caption":"Multi Factor Authentication","type_name":"Boolean"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"account_switch_type_id":{"type":"integer_t","enum":{"0":{"description":"The account switch type is unknown.","caption":"Unknown"},"1":{"description":"A utility like sudo, su, or equivalent was used to perform actions in the context of another user.","references":[{"description":"sudo documentation","url":"https://www.sudo.ws/"},{"description":"su Linux manual page","url":"https://man7.org/linux/man-pages/man1/su.1.html"},{"description":"su macOS manual page","url":"https://www.unix.com/man_page/osx/1/su/"}],"caption":"Substitute User"},"2":{"description":"An API like ImpersonateLoggedOnUser() or equivalent was used to perform actions in the context of another user.","references":[{"description":"Microsoft ImpersonateLoggedOnUser() documentation","url":"https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-impersonateloggedonuser"}],"caption":"Impersonate"},"99":{"description":"The account switch type is not mapped. See the account_switch_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the account switch method.","group":"primary","requirement":"recommended","caption":"Account Switch Type ID","sibling":"account_switch_type","type_name":"Integer"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"logon_process":{"type":"object_t","description":"The trusted process that validated the authentication credentials.","group":"context","requirement":"optional","object_type":"process","caption":"Logon Process","object_name":"Process"},"is_cleartext":{"type":"boolean_t","description":"Indicates whether the credentials were passed in clear text.

Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text.

","group":"context","requirement":"optional","caption":"Cleartext Credentials","type_name":"Boolean"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300200":{"caption":"Authentication: Unknown"},"300299":{"caption":"Authentication: Other"},"300201":{"description":"A new logon session was requested.","caption":"Authentication: Logon"},"300202":{"description":"A logon session was terminated and no longer exists.","caption":"Authentication: Logoff"},"300203":{"description":"A Kerberos authentication ticket (TGT) was requested.","caption":"Authentication: Authentication Ticket"},"300204":{"description":"A Kerberos service ticket was requested.","caption":"Authentication: Service Ticket Request"},"300205":{"description":"A Kerberos service ticket was renewed.","caption":"Authentication: Service Ticket Renew"},"300206":{"description":"A preauthentication stage was engaged.","caption":"Authentication: Preauth"},"300207":{"description":"A utility or service switched the user account. See the account_switch_type_id attribute for more details.","caption":"Authentication: Account Switch"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"logon_type":{"type":"string_t","description":"The logon type, normalized to the caption of the logon_type_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Logon Type","type_name":"String"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Authentication.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The endpoint to which the authentication was targeted.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"session":{"type":"object_t","description":"The authenticated user or service session.","group":"primary","requirement":"recommended","object_type":"session","caption":"Session","object_name":"Session"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The details about the authentication request. For example, possible details for Windows logon or logoff events are:","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"certificate":{"type":"object_t","description":"The certificate associated with the authentication or pre-authentication (Kerberos).","group":"primary","requirement":"recommended","object_type":"certificate","caption":"Certificate","object_name":"Digital Certificate"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"authentication","description":"Authentication events report authentication session activities, including user attempts to log on or log off, regardless of success, as well as other key stages within the authentication process. These events are typically generated by authentication services, such as Kerberos, OIDC, or SAML, and may include information about the user, the authentication method used, and the status of the authentication attempt.","uid":3002,"extends":"iam","category":"iam","constraints":{"at_least_one":["service","dst_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:AuthenticationEvent","url":"https://d3fend.mitre.org/event/d3f:AuthenticationEvent"}],"associations":{"user":["dst_endpoint"],"dst_endpoint":["user"],"src_endpoint":["actor.user"],"actor.user":["src_endpoint"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"Authentication","category_uid":3},"module_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1005":{"description":"Module Activity events report when an endpoint process acts on a module.","caption":"Module Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A function exported from the target module was invoked.","caption":"Invoke"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The target module was loaded.","references":[{"description":"Guidance on the use of \"Module Activity: Load\" and \"Process Activity: Inject\".","url":"https://github.com/ocsf/ocsf-docs/blob/main/faqs/schema-faq.md#when-should-i-use-a-module-activity-load-event-and-when-should-i-use-a-process-activity-inject-event"}],"caption":"Load"},"2":{"description":"The target module was unloaded.","caption":"Unload"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"module":{"type":"object_t","description":"The module that was loaded, unloaded, or invoked.","group":"primary","requirement":"required","object_type":"module","caption":"Module","object_name":"Module"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the target module. For example, the process that loaded a module into memory.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100500":{"caption":"Module Activity: Unknown"},"100599":{"caption":"Module Activity: Other"},"100501":{"description":"The target module was loaded.","references":[{"description":"Guidance on the use of \"Module Activity: Load\" and \"Process Activity: Inject\".","url":"https://github.com/ocsf/ocsf-docs/blob/main/faqs/schema-faq.md#when-should-i-use-a-module-activity-load-event-and-when-should-i-use-a-process-activity-inject-event"}],"caption":"Module Activity: Load"},"100502":{"description":"The target module was unloaded.","caption":"Module Activity: Unload"},"100503":{"description":"A function exported from the target module was invoked.","caption":"Module Activity: Invoke"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Module Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"module_activity","description":"Module Activity events report when an endpoint process acts on a module.","uid":1005,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:LoadLibraryEvent","url":"https://d3fend.mitre.org/event/d3f:LoadLibraryEvent/"},{"description":"D3FEND™ Ontology d3f:UnloadLibraryEvent","url":"https://d3fend.mitre.org/event/d3f:UnloadLibraryEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Module Activity","category_uid":1},"airborne_broadcast_activity":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"recommended","object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"8002":{"description":"Airborne Broadcast Activity events report the activity of any aircraft or unmanned system as reported and tracked by Automatic Dependent Surveillance - Broadcast (ADS-B) receivers. Based on the ADS-B standards described in Code of Federal Regulations (CFR) Title 14 Chapter I Subchapter F Part 91 and in other general Federal Aviation Administration (FAA) supplemental orders and guidance described here.","caption":"Airborne Broadcast Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"ADS-B information is being captured (collected).","caption":"Capture"},"2":{"description":"ADS-B information is being recorded, for example by a standalone transceiver.","caption":"Record"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"primary","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"8":{"description":"Unmanned Systems events report the activity, existence, and/or state of unmanned systems for tracking, mission planning, and other related activities.","uid":8,"caption":"Unmanned Systems"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"unmanned_system_operator":{"type":"object_t","description":"The human or machine operator of an Unmanned System.","group":"primary","requirement":"required","object_type":"user","caption":"Unmanned Systems Operator","object_name":"User"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"800200":{"caption":"Airborne Broadcast Activity: Unknown"},"800299":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Airborne Broadcast Activity: Other"},"800201":{"description":"ADS-B information is being captured (collected).","caption":"Airborne Broadcast Activity: Capture"},"800202":{"description":"ADS-B information is being recorded, for example by a standalone transceiver.","caption":"Airborne Broadcast Activity: Record"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"unmanned_aerial_system":{"type":"object_t","description":"The Unmanned Aerial System object describes the characteristics, Position Location Information (PLI), and other metadata of Unmanned Aerial Systems (UAS) and other unmanned and drone systems used in Remote ID. Remote ID is defined in the Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a.","group":"primary","requirement":"required","object_type":"unmanned_aerial_system","caption":"Unmanned Aerial System","object_name":"Unmanned Aerial System"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"rssi":{"type":"integer_t","description":"Recent average RSSI (signal power) measured in dbFS. This value will always be negative, e.g., -87.13.","group":"context","requirement":"optional","caption":"RSSI","type_name":"Integer"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The source network endpoint for the ADS-B system.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Unmanned Systems.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"unmanned_system_operating_area":{"type":"object_t","description":"The UAS Operating Area object describes details about a precise area of operations for a UAS flight or mission.","group":"primary","requirement":"recommended","object_type":"unmanned_system_operating_area","caption":"UAS Operating Area","object_name":"Unmanned System Operating Area"},"traffic":{"type":"object_t","description":"Traffic refers to the amount of data transmitted from a ADS-B remote monitoring system at a given point of time. Ex: bytes_in and bytes_out.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"protocol_name":{"type":"string_t","description":"The specific protocol associated with the ADS-B system. E.g. ADS-B UAT or ADS-B ES.","group":"primary","requirement":"recommended","caption":"ADS-B Protocol","type_name":"String"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"context","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Airborne Broadcast Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The destination network endpoint for the ADS-B system, if telemetry is being remotely broadcasted.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"aircraft":{"type":"object_t","description":"The Aircraft object represents any aircraft or otherwise airborne asset such as an unmanned system, airplane, balloon, spacecraft, or otherwise. The Aircraft object is intended to normalized data captured or otherwise logged from active radar, passive radar, multi-spectral systems, or the Automatic Dependant Broadcast - Surveillance (ADS-B), and/or Mode S systems.","group":"primary","requirement":"recommended","object_type":"aircraft","caption":"Aircraft","object_name":"Aircraft"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"airborne_broadcast_activity","description":"Airborne Broadcast Activity events report the activity of any aircraft or unmanned system as reported and tracked by Automatic Dependent Surveillance - Broadcast (ADS-B) receivers. Based on the ADS-B standards described in Code of Federal Regulations (CFR) Title 14 Chapter I Subchapter F Part 91 and in other general Federal Aviation Administration (FAA) supplemental orders and guidance described here.","uid":8002,"extends":"unmanned_systems","category":"unmanned_systems","constraints":{"at_least_one":["aircraft","unmanned_aerial_system","unmanned_system_operating_area"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Unmanned Systems","caption":"Airborne Broadcast Activity","category_uid":8},"rdp_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4005":{"description":"Remote Desktop Protocol (RDP) Activity events report post-authentication remote client connections between clients and servers over the network.","caption":"RDP Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The target user associated with the RDP activity.","group":"primary","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"An RDP connection request.","caption":"Connect Request"},"6":{"description":"Network traffic report.","caption":"Traffic"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The initial RDP request.","caption":"Initial Request"},"2":{"description":"The initial RDP response.","caption":"Initial Response"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"An RDP connection response.","caption":"Connect Response"},"5":{"description":"The TLS handshake.","caption":"TLS Handshake"},"7":{"description":"An RDP connection disconnect.","caption":"Disconnect"},"8":{"description":"An RDP connection reconnect.","caption":"Reconnect"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","references":[{"description":"Suricata Event Type: RDP","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-format.html#event-type-rdp"}],"requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"response":{"type":"object_t","description":"The server response in an RDP network connection.","group":"primary","requirement":"recommended","object_type":"response","caption":"API Response Details","object_name":"Response Elements"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"The device instigating the RDP connection.","group":"primary","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400500":{"caption":"RDP Activity: Unknown"},"400599":{"caption":"RDP Activity: Other"},"400501":{"description":"The initial RDP request.","caption":"RDP Activity: Initial Request"},"400502":{"description":"The initial RDP response.","caption":"RDP Activity: Initial Response"},"400503":{"description":"An RDP connection request.","caption":"RDP Activity: Connect Request"},"400504":{"description":"An RDP connection response.","caption":"RDP Activity: Connect Response"},"400505":{"description":"The TLS handshake.","caption":"RDP Activity: TLS Handshake"},"400506":{"description":"Network traffic report.","caption":"RDP Activity: Traffic"},"400507":{"description":"An RDP connection disconnect.","caption":"RDP Activity: Disconnect"},"400508":{"description":"An RDP connection reconnect.","caption":"RDP Activity: Reconnect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"capabilities":{"type":"string_t","description":"A list of RDP capabilities.","group":"context","is_array":true,"requirement":"optional","caption":"Capabilities","type_name":"String"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"identifier_cookie":{"type":"string_t","description":"The client identifier cookie during client/server exchange.","group":"context","requirement":"optional","caption":"Identifier Cookie","type_name":"String"},"keyboard_info":{"type":"object_t","description":"The keyboard detailed information.","group":"context","requirement":"optional","object_type":"keyboard_info","caption":"Keyboard Information","object_name":"Keyboard Information"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"request":{"type":"object_t","description":"The client request in an RDP network connection.","group":"primary","requirement":"recommended","object_type":"request","caption":"API Request Details","object_name":"Request Elements"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"certificate_chain":{"type":"string_t","description":"The list of observed certificates in an RDP TLS connection.","group":"primary","is_array":true,"requirement":"recommended","caption":"Certificate Chain","type_name":"String"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The remote desktop connection details, either connection-based or connectionless.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: RDP Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"protocol_ver":{"type":"string_t","description":"The Remote Desktop Protocol version.","group":"context","requirement":"recommended","caption":"RDP Version","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"remote_display":{"type":"object_t","description":"The remote display affiliated with the event","group":"context","requirement":"optional","object_type":"display","caption":"Remote Display","object_name":"Display"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the RDP activity.","group":"context","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"rdp_activity","description":"Remote Desktop Protocol (RDP) Activity events report post-authentication remote client connections between clients and servers over the network.","uid":4005,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:RDPEvent","url":"https://d3fend.mitre.org/event/d3f:RDPEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"RDP Activity","category_uid":4},"compliance_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"compliance":{"type":"object_t","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details.","group":"primary","requirement":"required","object_type":"compliance","caption":"Compliance","object_name":"Compliance"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Describes details about the resource/resources that are the subject of the compliance check.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2003":{"description":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001 etc. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"Compliance Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A finding was created.","caption":"Create"},"2":{"description":"A finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"evidences":{"type":"object_t","description":"Describes various evidence artifacts associated with the compliance finding.","group":"context","is_array":true,"requirement":"optional","object_type":"evidences","caption":"Evidence Artifacts","object_name":"Evidence Artifacts"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"resource":{"type":"object_t","description":"Describes details about the resource that is the subject of the compliance check.","group":"primary","requirement":"recommended","object_type":"resource_details","caption":"Resource","@deprecated":{"message":"Use the resources attribute instead.","since":"1.3.0"},"object_name":"Resource Details"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the affected device/host. If applicable, it can be used in conjunction with Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

","group":"context","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200300":{"caption":"Compliance Finding: Unknown"},"200399":{"caption":"Compliance Finding: Other"},"200301":{"description":"A finding was created.","caption":"Compliance Finding: Create"},"200302":{"description":"A finding was updated.","caption":"Compliance Finding: Update"},"200303":{"description":"A finding was closed.","caption":"Compliance Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","profiles":["incident"],"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"recommended","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Compliance Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"compliance_finding","description":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001 etc. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2003,"extends":"finding","category":"findings","profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Compliance Finding","category_uid":2},"session_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5017":{"description":"User Session Query events report information about existing user sessions.","caption":"User Session Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501700":{"caption":"User Session Query: Unknown"},"501799":{"caption":"User Session Query: Other"},"501701":{"description":"The discovered results are via a query request.","caption":"User Session Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: User Session Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"session":{"type":"object_t","description":"The authenticated user or service session.","group":"primary","requirement":"required","object_type":"session","caption":"Session","object_name":"Session"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"session_query","description":"User Session Query events report information about existing user sessions.","uid":5017,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"User Session Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"peripheral_device_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5014":{"description":"Peripheral Device Query events report information about peripheral devices.","caption":"Peripheral Device Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"peripheral_device":{"type":"object_t","description":"The peripheral device that triggered the event.","group":"primary","requirement":"required","object_type":"peripheral_device","caption":"Peripheral Device","object_name":"Peripheral Device"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501400":{"caption":"Peripheral Device Query: Unknown"},"501499":{"caption":"Peripheral Device Query: Other"},"501401":{"description":"The discovered results are via a query request.","caption":"Peripheral Device Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Peripheral Device Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"peripheral_device_query","description":"Peripheral Device Query events report information about peripheral devices.","uid":5014,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Peripheral Device Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"scan_activity":{"attributes":{"scan":{"type":"object_t","description":"The Scan object describes characteristics of the scan job.","group":"primary","requirement":"required","object_type":"scan","caption":"Scan","object_name":"Scan"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"num_detections":{"type":"integer_t","description":"The number of detections.","group":"primary","requirement":"recommended","caption":"Detections","type_name":"Integer"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"6007":{"description":"Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.","caption":"Scan Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"num_network_items":{"type":"integer_t","description":"The number of network items scanned.","group":"primary","requirement":"recommended","caption":"Scanned Network Items","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The scan was cancelled.","caption":"Cancelled"},"6":{"description":"The scan could not be completed due to an internal error.","caption":"Error"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The scan was started.","caption":"Started"},"2":{"description":"The scan was completed.","caption":"Completed"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The allocated scan time was insufficient to complete the requested scan.","caption":"Duration Violation"},"5":{"description":"The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time.","caption":"Pause Violation"},"7":{"description":"The scan was paused.","caption":"Paused"},"8":{"description":"The scan was resumed from the pause point.","caption":"Resumed"},"9":{"description":"The scan restarted from the beginning of the file enumeration.","caption":"Restarted"},"10":{"description":"The user delayed the scan.","caption":"Delayed"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"num_trusted_items":{"type":"integer_t","description":"The number of trusted items.","group":"primary","requirement":"recommended","caption":"Trusted","type_name":"Integer"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"num_resolutions":{"type":"integer_t","description":"The number of items that were resolved.","group":"primary","requirement":"recommended","caption":"Resolutions","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of the scan job.","group":"occurrence","requirement":"recommended","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600700":{"caption":"Scan Activity: Unknown"},"600799":{"caption":"Scan Activity: Other"},"600701":{"description":"The scan was started.","caption":"Scan Activity: Started"},"600702":{"description":"The scan was completed.","caption":"Scan Activity: Completed"},"600703":{"description":"The scan was cancelled.","caption":"Scan Activity: Cancelled"},"600704":{"description":"The allocated scan time was insufficient to complete the requested scan.","caption":"Scan Activity: Duration Violation"},"600705":{"description":"The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time.","caption":"Scan Activity: Pause Violation"},"600706":{"description":"The scan could not be completed due to an internal error.","caption":"Scan Activity: Error"},"600707":{"description":"The scan was paused.","caption":"Scan Activity: Paused"},"600708":{"description":"The scan was resumed from the pause point.","caption":"Scan Activity: Resumed"},"600709":{"description":"The scan restarted from the beginning of the file enumeration.","caption":"Scan Activity: Restarted"},"600710":{"description":"The user delayed the scan.","caption":"Scan Activity: Delayed"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"command_uid":{"type":"string_t","description":"The command identifier that is associated with this scan event. This ID uniquely identifies the proactive scan command, e.g., if remotely initiated.","group":"primary","requirement":"recommended","caption":"Command UID","type_name":"String"},"num_skipped_items":{"type":"integer_t","description":"The number of skipped items.","group":"primary","requirement":"recommended","caption":"Skipped","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"schedule_uid":{"type":"string_t","description":"The unique identifier of the schedule associated with a scan job.","group":"primary","requirement":"recommended","caption":"Schedule UID","type_name":"String"},"num_folders":{"type":"integer_t","description":"The number of folders scanned.","group":"primary","requirement":"recommended","caption":"Scanned Folders","type_name":"Integer"},"num_processes":{"type":"integer_t","description":"The number of processes scanned.","group":"primary","requirement":"recommended","caption":"Scanned Processes","type_name":"Integer"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of the scan job.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy associated with this Scan event; required if the scan was initiated by a policy.","group":"primary","requirement":"recommended","profiles":null,"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"num_registry_items":{"type":"integer_t","description":"The number of registry items scanned.","group":"primary","requirement":"recommended","caption":"Scanned Registry Items","type_name":"Integer"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of the scan job.","group":"occurrence","requirement":"recommended","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Scan Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"total":{"type":"integer_t","description":"The total number of items that were scanned; zero if no items were scanned.","group":"primary","requirement":"recommended","caption":"Total","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"num_files":{"type":"integer_t","description":"The number of files scanned.","group":"primary","requirement":"recommended","caption":"Scanned Files","type_name":"Integer"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The duration of the scan","group":"occurrence","requirement":"recommended","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of the scan job.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"scan_activity","description":"Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.","uid":6007,"extends":"application","category":"application","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Application Activity","caption":"Scan Activity","category_uid":6},"network_remediation_activity":{"attributes":{"scan":{"type":"object_t","description":"The remediation scan that pertains to this event.","group":"context","requirement":"optional","object_type":"scan","caption":"Scan","object_name":"Scan"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"7004":{"description":"Network Remediation Activity events report on attempts at remediating computer networks. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Techniques and Sub-techniques will include Network, such as Network Isolation or Network Traffic Filtering.","caption":"Network Remediation Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Restore"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Isolate"},"2":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Evict"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Harden"},"5":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Detect"}},"description":"Matches the MITRE D3FEND™ Tactic. Note: the Model and Detect Tactics are not supported as remediations by the OCSF Remediation event class.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"7":{"description":"Remediation events report the results of remediation commands targeting files, processes, and other objects.","uid":7,"caption":"Remediation"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"700400":{"caption":"Network Remediation Activity: Unknown"},"700499":{"caption":"Network Remediation Activity: Other"},"700401":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Network Remediation Activity: Isolate"},"700402":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Network Remediation Activity: Evict"},"700403":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Network Remediation Activity: Restore"},"700404":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Network Remediation Activity: Harden"},"700405":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Network Remediation Activity: Detect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"command_uid":{"type":"string_t","description":"The unique identifier of the remediation command that pertains to this event.","group":"primary","requirement":"required","caption":"Command UID","type_name":"String"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Remediation.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection that pertains to the remediation event.","group":"primary","requirement":"required","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"countermeasures":{"type":"object_t","description":"The MITRE D3FEND™ Matrix Countermeasures associated with a remediation.","group":"primary","is_array":true,"requirement":"recommended","object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Network Remediation Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The target of the remediation does not exist.","caption":"Does Not Exist"},"6":{"description":"There was an error during the remediation process.","caption":"Error"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The remediation was partially completed.","caption":"Partial"},"5":{"description":"The remediation was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"network_remediation_activity","description":"Network Remediation Activity events report on attempts at remediating computer networks. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Techniques and Sub-techniques will include Network, such as Network Isolation or Network Traffic Filtering.","uid":7004,"extends":"remediation_activity","category":"remediation","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Remediation","caption":"Network Remediation Activity","category_uid":7},"account_change":{"attributes":{"policies":{"type":"object_t","description":"Details about the IAM policies associated with the Attach/Detach Policy activities.","group":"context","is_array":true,"requirement":"optional","object_type":"policy","caption":"Policies","object_name":"Policy"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3001":{"description":"Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked.","caption":"Account Change"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The user that was a target of an activity.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"An attempt was made to change a user account's password.","caption":"Password Change"},"6":{"description":"A user/role was deleted.","caption":"Delete"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A user/role was created.","caption":"Create"},"2":{"description":"A user/role was enabled.","caption":"Enable"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"An attempt was made to reset a user account's password.","caption":"Password Reset"},"5":{"description":"A user/role was disabled.","caption":"Disable"},"7":{"description":"An IAM Policy was attached to a user/role.","caption":"Attach Policy"},"8":{"description":"An IAM Policy was detached from a user/role.","caption":"Detach Policy"},"9":{"description":"A user account was locked out.","caption":"Lock"},"10":{"description":"One or more authentication factors were enabled for a user account.","caption":"MFA Factor Enable"},"11":{"description":"One or more authentication factors were disabled for a user account.","caption":"MFA Factor Disable"},"12":{"description":"A user account was unlocked.","caption":"Unlock"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"auth_factors":{"type":"object_t","description":"Details about the authentication factors associated with the MFA Factor Enable/Disable activities.","group":"context","is_array":true,"requirement":"optional","object_type":"auth_factor","caption":"Authentication Factors","object_name":"Authentication Factor"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300100":{"caption":"Account Change: Unknown"},"300199":{"caption":"Account Change: Other"},"300101":{"description":"A user/role was created.","caption":"Account Change: Create"},"300102":{"description":"A user/role was enabled.","caption":"Account Change: Enable"},"300103":{"description":"An attempt was made to change a user account's password.","caption":"Account Change: Password Change"},"300104":{"description":"An attempt was made to reset a user account's password.","caption":"Account Change: Password Reset"},"300105":{"description":"A user/role was disabled.","caption":"Account Change: Disable"},"300106":{"description":"A user/role was deleted.","caption":"Account Change: Delete"},"300107":{"description":"An IAM Policy was attached to a user/role.","caption":"Account Change: Attach Policy"},"300108":{"description":"An IAM Policy was detached from a user/role.","caption":"Account Change: Detach Policy"},"300109":{"description":"A user account was locked out.","caption":"Account Change: Lock"},"300110":{"description":"One or more authentication factors were enabled for a user account.","caption":"Account Change: MFA Factor Enable"},"300111":{"description":"One or more authentication factors were disabled for a user account.","caption":"Account Change: MFA Factor Disable"},"300112":{"description":"A user account was unlocked.","caption":"Account Change: Unlock"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"user_result":{"type":"object_t","description":"The result of the user account change. It should contain the new values of the changed attributes.","group":"primary","requirement":"recommended","object_type":"user","caption":"User Result","object_name":"User"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"Details about the IAM policy associated to the Attach/Detach Policy activities.","group":"context","requirement":"optional","profiles":null,"object_type":"policy","caption":"Policy","@deprecated":{"message":"Use the policies attribute instead.","since":"1.4.0"},"object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Account Change.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"account_change","description":"Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked.","uid":3001,"extends":"iam","category":"iam","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"Account Change","category_uid":3},"win/prefetch_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"run_count":{"type":"integer_t","description":"The prefetch file run count.","group":"primary","extension":"win","requirement":"recommended","extension_id":2,"caption":"Run Count","type_name":"Integer"},"last_run_time":{"type":"timestamp_t","description":"The prefetch file last run time.","group":"occurrence","requirement":"recommended","caption":"Last Run","type_name":"Timestamp"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"205019":{"description":"Prefetch Query events report information about Windows prefetch files.","caption":"Prefetch Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"name":{"type":"string_t","description":"The name of the prefetch file that is the target of the query.","group":"primary","requirement":"required","caption":"Name","type_name":"String"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20501900":{"caption":"Prefetch Query: Unknown"},"20501999":{"caption":"Prefetch Query: Other"},"20501901":{"description":"The discovered results are via a query request.","caption":"Prefetch Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Prefetch Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"last_run_time_dt":{"type":"datetime_t","description":"The prefetch file last run time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Last Run","type_name":"Datetime"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"prefetch_query","description":"Prefetch Query events report information about Windows prefetch files.","extension":"win","uid":205019,"extends":"discovery_result","category":"discovery","extension_id":2,"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Prefetch Query","@deprecated":{"message":"Use the Evidence Info class with the Query Evidence object populated with File instead.","since":"1.5.0"},"category_uid":5},"user_access":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Resources that the privileges give access to.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3005":{"description":"User Access Management events report management updates to a user's privileges.","caption":"User Access Management"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"User to which privileges were assigned.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Assign privileges to a user.","caption":"Assign Privileges"},"2":{"description":"Revoke privileges from a user.","caption":"Revoke Privileges"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"resource":{"type":"object_t","description":"Resource that the privileges give access to.","group":"primary","requirement":"recommended","object_type":"resource_details","caption":"Resource","@deprecated":{"message":"Use the resources attribute instead.","since":"1.5.0"},"object_name":"Resource Details"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"privileges":{"type":"string_t","description":"List of privileges assigned to a user.","group":"primary","is_array":true,"requirement":"required","caption":"Privileges","type_name":"String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300500":{"caption":"User Access Management: Unknown"},"300599":{"caption":"User Access Management: Other"},"300501":{"description":"Assign privileges to a user.","caption":"User Access Management: Assign Privileges"},"300502":{"description":"Revoke privileges from a user.","caption":"User Access Management: Revoke Privileges"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: User Access Management.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"user_access","description":"User Access Management events report management updates to a user's privileges.","uid":3005,"extends":"iam","category":"iam","references":[{"description":"D3FEND™ Ontology d3f:PermissionGrantingEvent","url":"https://d3fend.mitre.org/event/d3f:PermissionGrantingEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"User Access Management","category_uid":3},"smb_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"dce_rpc":{"type":"object_t","description":"The DCE/RPC object describes the remote procedure call system for distributed computing environments.","group":"context","requirement":"optional","object_type":"dce_rpc","caption":"Distributed Computing Environment/Remote Procedure Call (DCE/RPC)","object_name":"DCE/RPC"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4006":{"description":"Server Message Block (SMB) Protocol Activity events report client/server connections sharing resources within the network.","caption":"SMB Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"open_type":{"type":"string_t","description":"Indicates how the file was opened (e.g. normal, delete on close).","group":"primary","requirement":"recommended","caption":"Open Type","type_name":"String"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The event pertains to file creation activity (a file is created if it does not exist and fails if it does).","caption":"File Create"},"6":{"description":"The event pertains to file overwrite activity (the file is opened in a truncated form if it exists and created otherwise)","caption":"File Overwrite If"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The event pertains to file superseded activity (overwritten if it exists and created if not).","caption":"File Supersede"},"2":{"description":"The event pertains to file open activity (the file is opened if it exists and fails to open if it doesn't).","caption":"File Open"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The event pertains to file open activity (the file is opened if it exists and is created if it doesn't).","caption":"File Open If"},"5":{"description":"The event pertains to file overwrite activity (the file is opened in a truncated form if it exists and fails if it doesn't).","caption":"File Overwrite"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"share":{"type":"string_t","description":"The SMB share name.","group":"primary","requirement":"recommended","caption":"Share","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"share_type":{"type":"string_t","description":"The SMB share type, normalized to the caption of the share_type_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Share Type","type_name":"String"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"response":{"type":"object_t","description":"The server response in an SMB network connection.","group":"primary","requirement":"recommended","object_type":"response","caption":"API Response Details","object_name":"Response Elements"},"client_dialects":{"type":"string_t","description":"The list of SMB dialects that the client speaks.","group":"context","is_array":true,"requirement":"recommended","caption":"Client Dialects","type_name":"String"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400600":{"caption":"SMB Activity: Unknown"},"400699":{"caption":"SMB Activity: Other"},"400601":{"description":"The event pertains to file superseded activity (overwritten if it exists and created if not).","caption":"SMB Activity: File Supersede"},"400602":{"description":"The event pertains to file open activity (the file is opened if it exists and fails to open if it doesn't).","caption":"SMB Activity: File Open"},"400603":{"description":"The event pertains to file creation activity (a file is created if it does not exist and fails if it does).","caption":"SMB Activity: File Create"},"400604":{"description":"The event pertains to file open activity (the file is opened if it exists and is created if it doesn't).","caption":"SMB Activity: File Open If"},"400605":{"description":"The event pertains to file overwrite activity (the file is opened in a truncated form if it exists and fails if it doesn't).","caption":"SMB Activity: File Overwrite"},"400606":{"description":"The event pertains to file overwrite activity (the file is opened in a truncated form if it exists and created otherwise)","caption":"SMB Activity: File Overwrite If"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"command":{"type":"string_t","description":"The command name (e.g. SMB2_COMMAND_CREATE, SMB1_COMMAND_WRITE_ANDX).","group":"primary","requirement":"recommended","caption":"Command","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"share_type_id":{"type":"integer_t","enum":{"3":{"caption":"Print"},"0":{"description":"The share type is unknown.","caption":"Unknown"},"1":{"caption":"File"},"2":{"caption":"Pipe"},"99":{"description":"The share type is not mapped. See the share_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the SMB share type.","group":"primary","requirement":"recommended","caption":"Share Type ID","sibling":"share_type","type_name":"Integer"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"tree_uid":{"type":"string_t","description":"The tree id is a unique SMB identifier which represents an open connection to a share.","group":"primary","requirement":"recommended","caption":"Tree UID","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"dialect":{"type":"string_t","description":"The negotiated protocol dialect.","group":"context","requirement":"recommended","caption":"Dialect","type_name":"String"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: SMB Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the SMB activity.","group":"primary","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"smb_activity","description":"Server Message Block (SMB) Protocol Activity events report client/server connections sharing resources within the network.","uid":4006,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:SMBEvent","url":"https://d3fend.mitre.org/event/d3f:SMBEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"SMB Activity","category_uid":4},"cloud_resources_inventory_info":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Cloud Resources","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5023":{"description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","caption":"Cloud Resources Inventory Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process.","group":"primary","requirement":"recommended","profiles":null,"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"container":{"type":"object_t","description":"A cloud-based container image or running container discovered by an inventory process.","group":"primary","requirement":"recommended","profiles":null,"object_type":"container","caption":"Container","object_name":"Container"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"idp":{"type":"object_t","description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process.","group":"primary","requirement":"recommended","object_type":"idp","caption":"Identity Provider","object_name":"Identity Provider"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"databucket":{"type":"object_t","description":"A cloud-based data bucket or other object storage discovered by an inventory process.","group":"primary","requirement":"recommended","object_type":"databucket","caption":"Databucket","object_name":"Databucket"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"database":{"type":"object_t","description":"A cloud-based database discovered by an inventory process.","group":"primary","requirement":"recommended","object_type":"database","caption":"Database","object_name":"Database"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"502300":{"caption":"Cloud Resources Inventory Info: Unknown"},"502399":{"caption":"Cloud Resources Inventory Info: Other"},"502301":{"description":"The discovered information is via a log.","caption":"Cloud Resources Inventory Info: Log"},"502302":{"description":"The discovered information is via a collection process.","caption":"Cloud Resources Inventory Info: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"table":{"type":"object_t","description":"A cloud-based database table discovered by an inventory process.","group":"primary","requirement":"recommended","object_type":"table","caption":"Table","object_name":"Table"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Cloud Resources Inventory Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"region":{"type":"string_t","description":"The cloud region where the resource is located, e.g., us-isof-south-1, eastus2, us-central1, etc.","group":"context","requirement":"recommended","profiles":null,"caption":"Region","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"cloud_resources_inventory_info","description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","uid":5023,"extends":"discovery","category":"discovery","constraints":{"at_least_one":["cloud","container","database","databucket","idp","resources","table"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Cloud Resources Inventory Info","category_uid":5},"kernel_object_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5006":{"description":"Kernel Object Query events report information about discovered kernel resources.","caption":"Kernel Object Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"kernel":{"type":"object_t","description":"The kernel object that pertains to the event.","group":"primary","requirement":"required","object_type":"kernel","caption":"Kernel","object_name":"Kernel Resource"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500600":{"caption":"Kernel Object Query: Unknown"},"500699":{"caption":"Kernel Object Query: Other"},"500601":{"description":"The discovered results are via a query request.","caption":"Kernel Object Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Kernel Object Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"kernel_object_query","description":"Kernel Object Query events report information about discovered kernel resources.","uid":5006,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Kernel Object Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"memory_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1004":{"description":"Memory Activity events report when a process has memory allocated, read/modified, or other manipulation activities - such as a buffer overflow or turning off data execution protection (DEP).","caption":"Memory Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"caption":"Delete Page"},"6":{"description":"Data Execution Permission","caption":"Enable DEP"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Allocate Page"},"2":{"caption":"Modify Page"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Buffer Overflow"},"5":{"description":"Data Execution Permission","caption":"Disable DEP"},"7":{"description":"Read (Example: ReadProcessMemory)","caption":"Read"},"8":{"description":"Write (Example: WriteProcessMemory)","caption":"Write"},"9":{"description":"Map View (Example: MapViewOfFile2)","caption":"Map View"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100400":{"caption":"Memory Activity: Unknown"},"100499":{"caption":"Memory Activity: Other"},"100401":{"caption":"Memory Activity: Allocate Page"},"100402":{"caption":"Memory Activity: Modify Page"},"100403":{"caption":"Memory Activity: Delete Page"},"100404":{"caption":"Memory Activity: Buffer Overflow"},"100405":{"description":"Data Execution Permission","caption":"Memory Activity: Disable DEP"},"100406":{"description":"Data Execution Permission","caption":"Memory Activity: Enable DEP"},"100407":{"description":"Read (Example: ReadProcessMemory)","caption":"Memory Activity: Read"},"100408":{"description":"Write (Example: WriteProcessMemory)","caption":"Memory Activity: Write"},"100409":{"description":"Map View (Example: MapViewOfFile2)","caption":"Memory Activity: Map View"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"actual_permissions":{"type":"integer_t","description":"The permissions that were granted to access memory.","group":"primary","requirement":"recommended","caption":"Actual Permissions","type_name":"Integer"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"size":{"type":"long_t","description":"The memory size that was access or requested.","group":"primary","requirement":"recommended","caption":"Size","type_name":"Long"},"process":{"type":"object_t","description":"The process that had memory allocated, read/written, or had other manipulation activities performed on it.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"requested_permissions":{"type":"integer_t","description":"The permissions mask that was requested to access memory.","group":"primary","requirement":"recommended","caption":"Requested Permissions","type_name":"Integer"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Memory Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"base_address":{"type":"string_t","description":"The memory address that was access or requested.","group":"primary","requirement":"recommended","caption":"Base Address","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"memory_activity","description":"Memory Activity events report when a process has memory allocated, read/modified, or other manipulation activities - such as a buffer overflow or turning off data execution protection (DEP).","uid":1004,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:MemoryEvent","url":"https://d3fend.mitre.org/event/d3f:MemoryEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Memory Activity","category_uid":1},"file_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5007":{"description":"File Query events report information about files that are present on the system.","caption":"File Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500700":{"caption":"File Query: Unknown"},"500799":{"caption":"File Query: Other"},"500701":{"description":"The discovered results are via a query request.","caption":"File Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: File Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the query.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"file_query","description":"File Query events report information about files that are present on the system.","uid":5007,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"File Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"application_error":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"6008":{"description":"Application Error events describe issues with an applications. The error message should be put in the event's message attribute. The metadata.product attribute can be used to capture the originating application information. The host profile can used to include the generating device information. This class is helpful for applications that generate or handle OCSF events and can also be used for errors in upstream products and services.","caption":"Application Error"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The application has experienced an error.","caption":"General Error"},"2":{"description":"The application has experienced an error translating (mapping) a raw event to OCSF. Including the original raw event in the raw_data field is highly recommended.","caption":"Translation Error"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600800":{"caption":"Application Error: Unknown"},"600899":{"caption":"Application Error: Other"},"600801":{"description":"The application has experienced an error.","caption":"Application Error: General Error"},"600802":{"description":"The application has experienced an error translating (mapping) a raw event to OCSF. Including the original raw event in the raw_data field is highly recommended.","caption":"Application Error: Translation Error"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The error message as reported by the application.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Application Error.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"application_error","description":"Application Error events describe issues with an applications. The error message should be put in the event's message attribute. The metadata.product attribute can be used to capture the originating application information. The host profile can used to include the generating device information. This class is helpful for applications that generate or handle OCSF events and can also be used for errors in upstream products and services.","uid":6008,"extends":"application","category":"application","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Application Activity","caption":"Application Error","category_uid":6},"win/windows_service_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"201004":{"description":"Windows Service Activity events report when a process interacts with the Service Control Manager.","caption":"Windows Service Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A stopped service is started, for example by calling StartService. Refer to the service attribute for details.","caption":"Start"},"6":{"description":"A paused service is continued, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Continue"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A service is created, for example by calling CreateService. Refer to the win_service attribute for details.","caption":"Create"},"2":{"description":"A service is reconfigured, for example by calling ChangeServiceConfig or ChangeServiceConfig2. Refer to the win_service attribute for details.","caption":"Reconfigure"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A running or paused service is stopped, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Stop"},"5":{"description":"A running service is paused, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Pause"},"7":{"description":"A service is deleted, for example by calling DeleteService. Refer to the win_service attribute for details.","caption":"Delete"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"win_service":{"type":"object_t","description":"The Windows service.","group":"primary","extension":"win","requirement":"required","extension_id":2,"object_type":"win/win_service","caption":"Windows Service","object_name":"Windows Service"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20100400":{"caption":"Windows Service Activity: Unknown"},"20100499":{"caption":"Windows Service Activity: Other"},"20100401":{"description":"A service is created, for example by calling CreateService. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Create"},"20100402":{"description":"A service is reconfigured, for example by calling ChangeServiceConfig or ChangeServiceConfig2. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Reconfigure"},"20100403":{"description":"A stopped service is started, for example by calling StartService. Refer to the service attribute for details.","caption":"Windows Service Activity: Start"},"20100404":{"description":"A running or paused service is stopped, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Stop"},"20100405":{"description":"A running service is paused, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Pause"},"20100406":{"description":"A paused service is continued, for example by calling ControlService or ControlServiceEx. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Continue"},"20100407":{"description":"A service is deleted, for example by calling DeleteService. Refer to the win_service attribute for details.","caption":"Windows Service Activity: Delete"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Windows Service Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"windows_service_activity","description":"Windows Service Activity events report when a process interacts with the Service Control Manager.","extension":"win","uid":201004,"extends":"system","category":"system","extension_id":2,"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Windows Service Activity","category_uid":1},"process_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5015":{"description":"Process Query events report information about running processes.","caption":"Process Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501500":{"caption":"Process Query: Unknown"},"501599":{"caption":"Process Query: Other"},"501501":{"description":"The discovered results are via a query request.","caption":"Process Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process object.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Process Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"process_query","description":"Process Query events report information about running processes.","uid":5015,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Process Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"module_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5011":{"description":"Module Query events report information about loaded modules.","caption":"Module Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"module":{"type":"object_t","description":"The module that pertains to the event.","group":"primary","requirement":"required","object_type":"module","caption":"Module","object_name":"Module"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501100":{"caption":"Module Query: Unknown"},"501199":{"caption":"Module Query: Other"},"501101":{"description":"The discovered results are via a query request.","caption":"Module Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process that loaded the module.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Module Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"module_query","description":"Module Query events report information about loaded modules.","uid":5011,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Module Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"vulnerability_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"vulnerabilities":{"type":"object_t","description":"This object describes vulnerabilities reported in a security finding.","group":"primary","is_array":true,"requirement":"required","object_type":"vulnerability","caption":"Vulnerabilities","object_name":"Vulnerability Details"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Affected Resources","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2002":{"description":"The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"Vulnerability Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A finding was created.","caption":"Create"},"2":{"description":"A finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"resource":{"type":"object_t","description":"Describes details about the resource that is affected by the vulnerability/vulnerabilities.","group":"primary","requirement":"recommended","object_type":"resource_details","caption":"Resource","@deprecated":{"message":"Use the resources attribute instead.","since":"1.3.0"},"object_name":"Resource Details"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the affected device/host. If applicable, it can be used in conjunction with Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

","group":"context","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200200":{"caption":"Vulnerability Finding: Unknown"},"200299":{"caption":"Vulnerability Finding: Other"},"200201":{"description":"A finding was created.","caption":"Vulnerability Finding: Create"},"200202":{"description":"A finding was updated.","caption":"Vulnerability Finding: Update"},"200203":{"description":"A finding was closed.","caption":"Vulnerability Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","profiles":["incident"],"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Vulnerability Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"vulnerability_finding","description":"The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2002,"extends":"finding","category":"findings","profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Vulnerability Finding","category_uid":2},"network_file_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"expiration_time":{"type":"timestamp_t","description":"The share expiration time.","group":"context","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4010":{"description":"Network File Activity events report file activities traversing the network, including file storage services such as Box, MS OneDrive, or Google Drive.","caption":"Network File Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Update a file.","caption":"Update"},"6":{"description":"Copy a file.","caption":"Copy"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Upload a file.","caption":"Upload"},"2":{"description":"Download a file.","caption":"Download"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Delete a file.","caption":"Delete"},"5":{"description":"Rename a file.","caption":"Rename"},"7":{"description":"Move a file.","caption":"Move"},"8":{"description":"Restore a file.","caption":"Restore"},"9":{"description":"Preview a file.","caption":"Preview"},"10":{"description":"Lock a file.","caption":"Lock"},"11":{"description":"Unlock a file.","caption":"Unlock"},"12":{"description":"Share a file.","caption":"Share"},"14":{"description":"Open a file.","caption":"Open"},"15":{"description":"Mark a file or folder to sync with a computer.","caption":"Sync"},"16":{"description":"Mark a file or folder to not sync with a computer.","caption":"Unsync"},"13":{"description":"Unshare a file.","caption":"Unshare"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor that performed the activity on the target file.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"401000":{"caption":"Network File Activity: Unknown"},"401099":{"caption":"Network File Activity: Other"},"401001":{"description":"Upload a file.","caption":"Network File Activity: Upload"},"401002":{"description":"Download a file.","caption":"Network File Activity: Download"},"401003":{"description":"Update a file.","caption":"Network File Activity: Update"},"401004":{"description":"Delete a file.","caption":"Network File Activity: Delete"},"401005":{"description":"Rename a file.","caption":"Network File Activity: Rename"},"401006":{"description":"Copy a file.","caption":"Network File Activity: Copy"},"401007":{"description":"Move a file.","caption":"Network File Activity: Move"},"401008":{"description":"Restore a file.","caption":"Network File Activity: Restore"},"401009":{"description":"Preview a file.","caption":"Network File Activity: Preview"},"401010":{"description":"Lock a file.","caption":"Network File Activity: Lock"},"401011":{"description":"Unlock a file.","caption":"Network File Activity: Unlock"},"401012":{"description":"Share a file.","caption":"Network File Activity: Share"},"401013":{"description":"Unshare a file.","caption":"Network File Activity: Unshare"},"401014":{"description":"Open a file.","caption":"Network File Activity: Open"},"401015":{"description":"Mark a file or folder to sync with a computer.","caption":"Network File Activity: Sync"},"401016":{"description":"Mark a file or folder to not sync with a computer.","caption":"Network File Activity: Unsync"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The endpoint that performed the activity on the target file.","group":"primary","requirement":"required","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"context","requirement":"optional","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Network File Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The endpoint that received the activity on the target file.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"expiration_time_dt":{"type":"datetime_t","description":"The share expiration time.","group":"context","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the activity.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"network_file_activity","description":"Network File Activity events report file activities traversing the network, including file storage services such as Box, MS OneDrive, or Google Drive.","uid":4010,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:NetworkEvent","url":"https://d3fend.mitre.org/event/d3f:NetworkEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"Network File Activity","@deprecated":{"message":"Use the new class: 'File Hosting Activity' in the 'Application' category.","since":"1.1.0"},"category_uid":4},"inventory_info":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5001":{"description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","caption":"Device Inventory Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"The device that is being discovered by an inventory process.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500100":{"caption":"Device Inventory Info: Unknown"},"500199":{"caption":"Device Inventory Info: Other"},"500101":{"description":"The discovered information is via a log.","caption":"Device Inventory Info: Log"},"500102":{"description":"The discovered information is via a collection process.","caption":"Device Inventory Info: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Device Inventory Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"inventory_info","description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","uid":5001,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Device Inventory Info","category_uid":5},"folder_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"folder":{"type":"object_t","description":"The folder that is the target of the query.","group":"primary","requirement":"required","object_type":"file","caption":"Folder","object_name":"File"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5008":{"description":"Folder Query events report information about folders that are present on the system.","caption":"Folder Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500800":{"caption":"Folder Query: Unknown"},"500899":{"caption":"Folder Query: Other"},"500801":{"description":"The discovered results are via a query request.","caption":"Folder Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Folder Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"folder_query","description":"Folder Query events report information about folders that are present on the system.","uid":5008,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Folder Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"event_log_actvity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1008":{"description":"Event Log Activity events report actions pertaining to the system's event logging service(s), such as disabling logging or clearing the log data.","caption":"Event Log Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Export the event log database, file, or cache.","caption":"Export"},"6":{"description":"Start the event logging service.","caption":"Start"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Clear the event log database, file, or cache.","caption":"Clear"},"2":{"description":"Delete the event log database, file, or cache.","caption":"Delete"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Archive the event log database, file, or cache.","caption":"Archive"},"5":{"description":"Rotate the event log database, file, or cache.","caption":"Rotate"},"7":{"description":"Stop the event logging service.","caption":"Stop"},"8":{"description":"Restart the event logging service.","caption":"Restart"},"9":{"description":"Enable the event logging service.","caption":"Enable"},"10":{"description":"Disable the event logging service.","caption":"Disable"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"The device that reported the event.","group":"primary","requirement":"recommended","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"log_type_id":{"type":"integer_t","enum":{"0":{"description":"The log type is unknown.","caption":"Unknown"},"1":{"description":"The log type is an Operating System log.","caption":"OS"},"2":{"description":"The log type is an Application log.","caption":"Application"},"99":{"description":"The log type is not mapped. See the log_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized log type identifier.","group":"primary","requirement":"recommended","caption":"Log Type ID","sibling":"log_type","type_name":"Integer"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity.","group":"primary","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100800":{"caption":"Event Log Activity: Unknown"},"100899":{"caption":"Event Log Activity: Other"},"100801":{"description":"Clear the event log database, file, or cache.","caption":"Event Log Activity: Clear"},"100802":{"description":"Delete the event log database, file, or cache.","caption":"Event Log Activity: Delete"},"100803":{"description":"Export the event log database, file, or cache.","caption":"Event Log Activity: Export"},"100804":{"description":"Archive the event log database, file, or cache.","caption":"Event Log Activity: Archive"},"100805":{"description":"Rotate the event log database, file, or cache.","caption":"Event Log Activity: Rotate"},"100806":{"description":"Start the event logging service.","caption":"Event Log Activity: Start"},"100807":{"description":"Stop the event logging service.","caption":"Event Log Activity: Stop"},"100808":{"description":"Restart the event logging service.","caption":"Event Log Activity: Restart"},"100809":{"description":"Enable the event logging service.","caption":"Event Log Activity: Enable"},"100810":{"description":"Disable the event logging service.","caption":"Event Log Activity: Disable"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The source endpoint for the event log activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"log_provider":{"type":"string_t","description":"The logging provider or logging service

targeted by

the activity.
Example: Microsoft-Windows-Security-Auditing, Auditd, or Syslog.","group":"primary","requirement":"recommended","caption":"Log Provider","type_name":"String"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Event Log Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The

targeted

endpoint for the event log activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.
Example: 0, 8, or 21 for Windows ClearEventLog.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"log_type":{"type":"string_t","description":"The log type, normalized to the caption of the log_type_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Log Type","type_name":"String"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event outcome.
Example: Success, Privilege Missing, or Invalid Parameter for Windows ClearEventLog.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"log_name":{"type":"string_t","description":"The name of the event log

targeted by

the activity. Example: Windows Security.","group":"primary","requirement":"recommended","caption":"Log Name","type_name":"String"},"file":{"type":"object_t","description":"The file

targeted by

the activity. Example: /var/log/audit.log","group":"primary","requirement":"recommended","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"event_log_actvity","description":"Event Log Activity events report actions pertaining to the system's event logging service(s), such as disabling logging or clearing the log data.","uid":1008,"extends":"system","category":"system","constraints":{"at_least_one":["log_file","log_name","log_provider","log_type","log_type_id"]},"references":[{"description":"D3FEND™ Ontology d3f:EventLogEvent","url":"https://d3fend.mitre.org/event/d3f:EventLogEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Event Log Activity","category_uid":1},"http_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"The HTTP Response from a web server to a requester.","group":"primary","requirement":"recommended","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"4002":{"description":"HTTP Activity events report HTTP connection and traffic information.","caption":"HTTP Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.","caption":"Get"},"6":{"description":"The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.","caption":"Post"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The CONNECT method establishes a tunnel to the server identified by the target resource.","caption":"Connect"},"2":{"description":"The DELETE method deletes the specified resource.","caption":"Delete"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The HEAD method asks for a response identical to a GET request, but without the response body.","caption":"Head"},"5":{"description":"The OPTIONS method describes the communication options for the target resource.","caption":"Options"},"7":{"description":"The PUT method replaces all current representations of the target resource with the request payload.","caption":"Put"},"8":{"description":"The TRACE method performs a message loop-back test along the path to the target resource.","caption":"Trace"},"9":{"description":"The PATCH method applies partial modifications to a resource.","caption":"Patch"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400200":{"caption":"HTTP Activity: Unknown"},"400299":{"caption":"HTTP Activity: Other"},"400201":{"description":"The CONNECT method establishes a tunnel to the server identified by the target resource.","caption":"HTTP Activity: Connect"},"400202":{"description":"The DELETE method deletes the specified resource.","caption":"HTTP Activity: Delete"},"400203":{"description":"The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.","caption":"HTTP Activity: Get"},"400204":{"description":"The HEAD method asks for a response identical to a GET request, but without the response body.","caption":"HTTP Activity: Head"},"400205":{"description":"The OPTIONS method describes the communication options for the target resource.","caption":"HTTP Activity: Options"},"400206":{"description":"The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.","caption":"HTTP Activity: Post"},"400207":{"description":"The PUT method replaces all current representations of the target resource with the request payload.","caption":"HTTP Activity: Put"},"400208":{"description":"The TRACE method performs a message loop-back test along the path to the target resource.","caption":"HTTP Activity: Trace"},"400209":{"description":"The PATCH method applies partial modifications to a resource.","caption":"HTTP Activity: Patch"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"http_status":{"type":"integer_t","description":"The Hypertext Transfer Protocol (HTTP) status code returned to the client.","group":"primary","requirement":"recommended","caption":"HTTP Status","type_name":"Integer","@deprecated":{"message":"Use the http_response.code attribute instead.","since":"1.1.0"}},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"trace":{"type":"object_t","description":"The trace object contains information about distributed traces which are critical to observability and describe how requests move through a system, capturing each step's timing and status.","group":"primary","requirement":"recommended","profiles":["trace"],"object_type":"trace","caption":"Trace","object_name":"Trace"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"The HTTP Request Object documents attributes of a request made to a web server.","group":"primary","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"http_cookies":{"type":"object_t","description":"The cookies object describes details about HTTP cookies","group":"primary","is_array":true,"requirement":"recommended","object_type":"http_cookie","caption":"HTTP Cookies","object_name":"HTTP Cookie"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: HTTP Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the HTTP activity.","group":"context","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"http_activity","description":"HTTP Activity events report HTTP connection and traffic information.","uid":4002,"extends":"network","category":"network","constraints":{"at_least_one":["http_request","http_response"]},"references":[{"description":"D3FEND™ Ontology d3f:HTTPEvent","url":"https://d3fend.mitre.org/event/d3f:HTTPEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control","trace"],"category_name":"Network Activity","caption":"HTTP Activity","category_uid":4},"detection_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"vulnerabilities":{"type":"object_t","description":"Describes vulnerabilities reported in a Detection Finding.","group":"context","is_array":true,"requirement":"optional","object_type":"vulnerability","caption":"Vulnerabilities","object_name":"Vulnerability Details"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Describes details about resources that were the target of the activity that triggered the finding.","group":"context","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Affected Resources","object_name":"Resource Details"},"malware":{"type":"object_t","description":"Describes malware reported in a Detection Finding.","group":"context","is_array":true,"requirement":"optional","profiles":null,"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2004":{"description":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"Detection Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"anomaly_analyses":{"type":"object_t","description":"Describes baseline information about normal activity patterns, along with any detected deviations or anomalies that triggered this finding.","group":"context","is_array":true,"requirement":"optional","object_type":"anomaly_analysis","caption":"Anomaly Analyses","object_name":"Anomaly Analysis"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A finding was created.","caption":"Create"},"2":{"description":"A finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Details","type_name":"String"},"evidences":{"type":"object_t","description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection.","group":"primary","is_array":true,"requirement":"recommended","object_type":"evidences","caption":"Evidence Artifacts","object_name":"Evidence Artifacts"},"malware_scan_info":{"type":"object_t","description":"Describes details about malware scan job that triggered this Detection Finding.","group":"context","requirement":"optional","profiles":null,"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the affected device/host. If applicable, it can be used in conjunction with Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

","group":"context","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200400":{"caption":"Detection Finding: Unknown"},"200499":{"caption":"Detection Finding: Other"},"200401":{"description":"A finding was created.","caption":"Detection Finding: Create"},"200402":{"description":"A finding was updated.","caption":"Detection Finding: Update"},"200403":{"description":"A finding was closed.","caption":"Detection Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"context","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"optional","profiles":null,"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. For example, an activity_id of 'Create' could constitute an alertable signal and the value would be true, while 'Close' likely would not and either omit the attribute or set its value to false. Note that other events with the security_control profile may also be deemed alertable signals and may also carry is_alert = true attributes.","group":"primary","requirement":"recommended","profiles":null,"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":null,"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Detection Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"context","requirement":"optional","profiles":null,"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"detection_finding","description":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2004,"extends":"finding","category":"findings","profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Detection Finding","category_uid":2},"startup_item_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"startup_item":{"type":"object_t","description":"The startup item object describes an application component that has associated startup criteria and configurations.","group":"primary","requirement":"required","object_type":"startup_item","caption":"Startup Item","object_name":"Startup Item"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5022":{"description":"Startup Item Query events report information about discovered items, e.g., application components that are generally configured to run automatically.","caption":"Startup Item Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"502200":{"caption":"Startup Item Query: Unknown"},"502299":{"caption":"Startup Item Query: Other"},"502201":{"description":"The discovered results are via a query request.","caption":"Startup Item Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Startup Item Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"startup_item_query","description":"Startup Item Query events report information about discovered items, e.g., application components that are generally configured to run automatically.","uid":5022,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Startup Item Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"ssh_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"client_hassh":{"type":"object_t","description":"The Client HASSH fingerprinting object.","group":"primary","requirement":"recommended","object_type":"hassh","caption":"Client HASSH","object_name":"HASSH"},"class_uid":{"type":"integer_t","enum":{"4007":{"description":"SSH Activity events report remote client connections to a server using the Secure Shell (SSH) Protocol.","caption":"SSH Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The network connection was abnormally terminated or closed by a middle device like firewalls.","caption":"Reset"},"6":{"description":"Network traffic report.","caption":"Traffic"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A new network connection was opened.","caption":"Open"},"2":{"description":"The network connection was closed.","caption":"Close"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The network connection failed. For example a connection timeout or no route to host.","caption":"Fail"},"5":{"description":"The network connection was refused. For example an attempt to connect to a server port which is not open.","caption":"Refuse"},"7":{"description":"A network endpoint began listening for new network connections.","caption":"Listen"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"auth_type_id":{"type":"integer_t","enum":{"3":{"description":"Authentication based on the client host's identity.","caption":"Host Based"},"6":{"description":"Paired public key authentication.","caption":"Public Key"},"0":{"description":"The authentication type is unknown.","caption":"Unknown"},"1":{"description":"Authentication using digital certificates.","caption":"Certificate Based"},"2":{"description":"GSSAPI for centralized authentication.","caption":"GSSAPI"},"99":{"description":"The authentication type is not mapped. See the auth_type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Multi-step, interactive authentication.","caption":"Keyboard Interactive"},"5":{"description":"Password Authentication.","caption":"Password"}},"description":"The normalized identifier of the SSH authentication type.","group":"primary","requirement":"recommended","caption":"Authentication Type ID","sibling":"auth_type","type_name":"Integer"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"server_hassh":{"type":"object_t","description":"The Server HASSH fingerprinting object.","group":"primary","requirement":"recommended","object_type":"hassh","caption":"Server HASSH","object_name":"HASSH"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400700":{"caption":"SSH Activity: Unknown"},"400799":{"caption":"SSH Activity: Other"},"400701":{"description":"A new network connection was opened.","caption":"SSH Activity: Open"},"400702":{"description":"The network connection was closed.","caption":"SSH Activity: Close"},"400703":{"description":"The network connection was abnormally terminated or closed by a middle device like firewalls.","caption":"SSH Activity: Reset"},"400704":{"description":"The network connection failed. For example a connection timeout or no route to host.","caption":"SSH Activity: Fail"},"400705":{"description":"The network connection was refused. For example an attempt to connect to a server port which is not open.","caption":"SSH Activity: Refuse"},"400706":{"description":"Network traffic report.","caption":"SSH Activity: Traffic"},"400707":{"description":"A network endpoint began listening for new network connections.","caption":"SSH Activity: Listen"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"auth_type":{"type":"string_t","description":"The SSH authentication type, normalized to the caption of 'auth_type_id'. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Authentication Type","type_name":"String"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: SSH Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"protocol_ver":{"type":"string_t","description":"The Secure Shell Protocol version.","group":"context","requirement":"recommended","caption":"SSH Version","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that is the target of the SSH activity.","group":"context","requirement":"optional","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"ssh_activity","description":"SSH Activity events report remote client connections to a server using the Secure Shell (SSH) Protocol.","uid":4007,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:SSHEvent","url":"https://d3fend.mitre.org/event/d3f:SSHEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"SSH Activity","category_uid":4},"web_resource_access_activity":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the HTTP response, if available.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"6004":{"description":"Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP.","caption":"Web Resource Access Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The incoming request's access has been revoked due to security policy enforcements.","caption":"Access Revoke"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The incoming request has permission to the web resource.","caption":"Access Grant"},"2":{"description":"The incoming request does not have permission to the web resource.","caption":"Access Deny"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"An error occurred during processing the request.","caption":"Access Error"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes, if available.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600400":{"caption":"Web Resource Access Activity: Unknown"},"600499":{"caption":"Web Resource Access Activity: Other"},"600401":{"description":"The incoming request has permission to the web resource.","caption":"Web Resource Access Activity: Access Grant"},"600402":{"description":"The incoming request does not have permission to the web resource.","caption":"Web Resource Access Activity: Access Deny"},"600403":{"description":"The incoming request's access has been revoked due to security policy enforcements.","caption":"Web Resource Access Activity: Access Revoke"},"600404":{"description":"An error occurred during processing the request.","caption":"Web Resource Access Activity: Access Error"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source endpoint of the request.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"required","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Web Resource Access Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"Details about the proxy service, if available.","group":"context","requirement":"optional","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"web_resources":{"type":"object_t","description":"Details about the resource that is the target of the activity.","group":"primary","is_array":true,"requirement":"required","object_type":"web_resource","caption":"Web Resources","object_name":"Web Resource"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"web_resource_access_activity","description":"Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP.","uid":6004,"extends":"application","category":"application","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Application Activity","caption":"Web Resource Access Activity","@deprecated":{"message":"Use the Web Resources Activity class with the Security Control and/or Network Proxy profile instead.","since":"1.1.0"},"category_uid":6},"script_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"script":{"type":"object_t","description":"The script that was the target of the activity.","group":"primary","requirement":"required","object_type":"script","caption":"Script","object_name":"Script"},"class_uid":{"type":"integer_t","enum":{"1009":{"description":"Script Activity events report when a process executes a script.","caption":"Script Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Execute"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100900":{"caption":"Script Activity: Unknown"},"100999":{"caption":"Script Activity: Other"},"100901":{"caption":"Script Activity: Execute"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Script Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"script_activity","description":"Script Activity events report when a process executes a script.","uid":1009,"extends":"system","category":"system","associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Script Activity","category_uid":1},"entity_management":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the underlying HTTP response.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"3004":{"description":"Entity Management events report activity by a managed client, a micro service, or a user at a management console. The activity can be a create, read, update, and delete operation on a managed entity.","caption":"Entity Management"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"entity_result":{"type":"object_t","description":"The updated managed entity.","group":"primary","requirement":"recommended","object_type":"managed_entity","caption":"Entity Result","object_name":"Managed Entity"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Update an existing managed entity.","caption":"Update"},"6":{"description":"Enroll an existing managed entity.","caption":"Enroll"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Create a new managed entity.","caption":"Create"},"2":{"description":"Read an existing managed entity.","caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Delete a managed entity.","caption":"Delete"},"5":{"description":"Move or rename an existing managed entity.","caption":"Move"},"7":{"description":"Unenroll an existing managed entity.","caption":"Unenroll"},"8":{"description":"Enable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.","caption":"Enable"},"9":{"description":"Disable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.","caption":"Disable"},"10":{"description":"Activate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.","caption":"Activate"},"11":{"description":"Deactivate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.","caption":"Deactivate"},"12":{"description":"Suspend an existing managed entity.","caption":"Suspend"},"13":{"description":"Resume (unsuspend) an existing managed entity.","caption":"Resume"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"access_list":{"type":"string_t","description":"The list of requested access rights.","group":"context","is_array":true,"requirement":"optional","caption":"Access List","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"3":{"description":"Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.","uid":3,"caption":"Identity & Access Management"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"recommended","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"300400":{"caption":"Entity Management: Unknown"},"300499":{"caption":"Entity Management: Other"},"300401":{"description":"Create a new managed entity.","caption":"Entity Management: Create"},"300402":{"description":"Read an existing managed entity.","caption":"Entity Management: Read"},"300403":{"description":"Update an existing managed entity.","caption":"Entity Management: Update"},"300404":{"description":"Delete a managed entity.","caption":"Entity Management: Delete"},"300405":{"description":"Move or rename an existing managed entity.","caption":"Entity Management: Move"},"300406":{"description":"Enroll an existing managed entity.","caption":"Entity Management: Enroll"},"300407":{"description":"Unenroll an existing managed entity.","caption":"Entity Management: Unenroll"},"300408":{"description":"Enable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.","caption":"Entity Management: Enable"},"300409":{"description":"Disable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.","caption":"Entity Management: Disable"},"300410":{"description":"Activate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.","caption":"Entity Management: Activate"},"300411":{"description":"Deactivate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.","caption":"Entity Management: Deactivate"},"300412":{"description":"Suspend an existing managed entity.","caption":"Entity Management: Suspend"},"300413":{"description":"Resume (unsuspend) an existing managed entity.","caption":"Entity Management: Resume"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"access_mask":{"type":"integer_t","description":"The access mask in a platform-native format.","group":"context","requirement":"optional","caption":"Access Mask","type_name":"Integer"},"entity":{"type":"object_t","description":"The managed entity that is being acted upon.","group":"primary","requirement":"required","object_type":"managed_entity","caption":"Entity","object_name":"Managed Entity"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the source of the IAM activity.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Identity & Access Management.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"optional","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"The user provided comment about why the entity was changed.","group":"primary","requirement":"recommended","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Entity Management.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"entity_management","description":"Entity Management events report activity by a managed client, a micro service, or a user at a management console. The activity can be a create, read, update, and delete operation on a managed entity.","uid":3004,"extends":"iam","category":"iam","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Identity & Access Management","caption":"Entity Management","category_uid":3},"web_resources_activity":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the HTTP response, if available.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"6001":{"description":"Web Resources Activity events describe actions executed on a set of Web Resources.","caption":"Web Resources Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"One or more web resources were updated.","caption":"Update"},"6":{"description":"One or more web resources were imported into an Application.","caption":"Import"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"One or more web resources were created.","caption":"Create"},"2":{"description":"One or more web resources were read / viewed.","caption":"Read"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"One or more web resources were deleted.","caption":"Delete"},"5":{"description":"A search was performed on one or more web resources.","caption":"Search"},"7":{"description":"One or more web resources were exported from an Application.","caption":"Export"},"8":{"description":"One or more web resources were shared.","caption":"Share"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes, if available.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"web_resources_result":{"type":"object_t","description":"The results of the activity on web resources. It should contain the new values of the changed attributes of the web resources.","group":"primary","is_array":true,"requirement":"recommended","object_type":"web_resource","caption":"Web Resources Result","object_name":"Web Resource"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600100":{"caption":"Web Resources Activity: Unknown"},"600199":{"caption":"Web Resources Activity: Other"},"600101":{"description":"One or more web resources were created.","caption":"Web Resources Activity: Create"},"600102":{"description":"One or more web resources were read / viewed.","caption":"Web Resources Activity: Read"},"600103":{"description":"One or more web resources were updated.","caption":"Web Resources Activity: Update"},"600104":{"description":"One or more web resources were deleted.","caption":"Web Resources Activity: Delete"},"600105":{"description":"A search was performed on one or more web resources.","caption":"Web Resources Activity: Search"},"600106":{"description":"One or more web resources were imported into an Application.","caption":"Web Resources Activity: Import"},"600107":{"description":"One or more web resources were exported from an Application.","caption":"Web Resources Activity: Export"},"600108":{"description":"One or more web resources were shared.","caption":"Web Resources Activity: Share"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"Details about the endpoint from which the request originated.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Web Resources Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"Details about server providing the web resources.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"web_resources":{"type":"object_t","description":"Describes details about web resources that were affected by an activity/event.","group":"primary","is_array":true,"requirement":"required","object_type":"web_resource","caption":"Web Resources","object_name":"Web Resource"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"web_resources_activity","description":"Web Resources Activity events describe actions executed on a set of Web Resources.","uid":6001,"extends":"application","category":"application","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Application Activity","caption":"Web Resources Activity","category_uid":6},"email_url_activity":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4012":{"description":"Email URL Activity events report URLs within an email.","caption":"Email URL Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Email URL being scanned (example: security scanning).","caption":"Scan"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Send"},"2":{"caption":"Receive"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"email_uid":{"type":"string_t","description":"The unique identifier of the email, used to correlate related email alert and activity events.","group":"primary","requirement":"required","caption":"Email UID","type_name":"String","@deprecated":{"message":"Use the email.uid attribute instead.","since":"1.4.0"}},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"url":{"type":"object_t","description":"The URL included in the email content.","group":"primary","requirement":"required","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"401200":{"caption":"Email URL Activity: Unknown"},"401299":{"caption":"Email URL Activity: Other"},"401201":{"caption":"Email URL Activity: Send"},"401202":{"caption":"Email URL Activity: Receive"},"401203":{"description":"Email URL being scanned (example: security scanning).","caption":"Email URL Activity: Scan"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Email URL Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"email_url_activity","description":"Email URL Activity events report URLs within an email.","uid":4012,"extends":"base_event","category":"network","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Network Activity","caption":"Email URL Activity","@deprecated":{"message":"Use the Email Activity class with the email.urls[] array instead.","since":"1.3.0"},"category_uid":4},"network_connection_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"state_id":{"type":"integer_t","enum":{"3":{"description":"The socket has passively received a connection request from a remote peer.","caption":"SYN_RECV"},"6":{"description":"The socket connection has been closed by the local application, the remote peer has closed its half of the connection, and the system is waiting to be sure that the remote peer received the last acknowledgement.","caption":"TIME_WAIT"},"0":{"description":"The socket state is unknown.","caption":"Unknown"},"1":{"description":"The socket has an established connection between a local application and a remote peer.","caption":"ESTABLISHED"},"2":{"description":"The socket is actively trying to establish a connection to a remote peer.","caption":"SYN_SENT"},"99":{"description":"The state is not mapped. See the state attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The socket connection has been closed by the local application, the remote peer has not yet acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN_WAIT1"},"5":{"description":"The socket connection has been closed by the local application, the remote peer has acknowledged the close, and the system is waiting for it to close its half of the connection.","caption":"FIN_WAIT2"},"7":{"description":"The socket is not in use.","caption":"CLOSED"},"8":{"description":"The socket connection has been closed by the remote peer, and the system is waiting for the local application to close its half of the connection.","caption":"CLOSE_WAIT"},"9":{"description":"The socket connection has been closed by the remote peer, the local application has closed its half of the connection, and the system is waiting for the remote peer to acknowledge the close.","caption":"LAST_ACK"},"10":{"description":"The socket is listening for incoming connections.","caption":"LISTEN"},"11":{"description":"The socket connection has been closed by the local application and the remote peer simultaneously, and the remote peer has not yet acknowledged the close attempt of the local application.","caption":"CLOSING"}},"description":"The state of the socket.","group":"primary","requirement":"required","caption":"State ID","sibling":"state","type_name":"Integer"},"state":{"type":"string_t","description":"The state of the socket, normalized to the caption of the state_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"State","type_name":"String"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5012":{"description":"Network Connection Query events report information about active network connections.","caption":"Network Connection Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501200":{"caption":"Network Connection Query: Unknown"},"501299":{"caption":"Network Connection Query: Other"},"501201":{"description":"The discovered results are via a query request.","caption":"Network Connection Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process that owns the socket.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"required","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Network Connection Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"network_connection_query","description":"Network Connection Query events report information about active network connections.","uid":5012,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Network Connection Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"iam_analysis_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","group":"context","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"resources":{"type":"object_t","description":"Details about resources involved in the IAM analysis. For identity-centric analysis, this represents resources the identity can access. For resource-centric analysis, this represents the resource being analyzed and related resources in the access chain.","group":"primary","is_array":true,"requirement":"recommended","object_type":"resource_details","caption":"Resources Array","object_name":"Resource Details"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2008":{"description":"This finding represents an IAM analysis result, which evaluates IAM policies, access patterns, and IAM configurations for potential security risks. The analysis can focus on either an identity (user, role, service account) or a resource to assess permissions, access patterns, and security posture within the IAM domain.
Note: Use permission_analysis_results for identity-centric analysis (evaluating what an identity can do) and access_analysis_result for resource-centric analysis (evaluating who can access a resource). These complement each other for comprehensive IAM security assessment.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","caption":"IAM Analysis Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"Details about the identity (user, role, service account, or other principal) that is the subject of the IAM analysis. This provides context about the identity being evaluated for security risks and access patterns.","group":"primary","requirement":"recommended","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"A finding was closed.","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A finding was created.","caption":"Create"},"2":{"description":"A finding was updated.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the finding activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Verdict","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","profiles":["incident"],"caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"permission_analysis_results":{"type":"object_t","description":"Describes analysis results of permissions, policies directly associated with an identity (user, role, or service account). This evaluates what permissions an identity has been granted through attached policies, which privileges are actively used versus unused, and identifies potential over-privileged access. Use this for identity-centric security assessments such as privilege audits, dormant permission discovery, and least-privilege compliance analysis.","group":"primary","is_array":true,"requirement":"recommended","object_type":"permission_analysis_result","caption":"Permission Analysis Results","object_name":"Permission Analysis Result"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"Describes the affected device/host. If applicable, it can be used in conjunction with Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

","group":"context","requirement":"optional","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200800":{"caption":"IAM Analysis Finding: Unknown"},"200899":{"caption":"IAM Analysis Finding: Other"},"200801":{"description":"A finding was created.","caption":"IAM Analysis Finding: Create"},"200802":{"description":"A finding was updated.","caption":"IAM Analysis Finding: Update"},"200803":{"description":"A finding was closed.","caption":"IAM Analysis Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"access_analysis_result":{"type":"object_t","description":"Describes access relationships and pathways between identities, resources, focusing on who can access what and through which mechanisms. This evaluates access levels (read/write/admin), access types (direct, cross-account, public, federated), and the conditions under which access is granted. Use this for resource-centric security assessments such as external access discovery, public exposure analysis, etc.","group":"context","requirement":"optional","object_type":"access_analysis_result","caption":"Access Analysis Result","object_name":"Access Analysis Result"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"applications":{"type":"object_t","description":"Details about applications, services, or systems that are accessible based on the IAM analysis. For identity-centric analysis, this represents applications the identity can access. For resource-centric analysis, this represents applications that can access the resource.","group":"primary","is_array":true,"requirement":"recommended","object_type":"application","caption":"Applications","object_name":"Application"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The finding activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"finding_info":{"type":"object_t","description":"Describes the supporting information about a generated finding.","group":"primary","requirement":"required","object_type":"finding_info","caption":"Finding Information","object_name":"Finding Information"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","profiles":["incident"],"caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"A user provided comment about the finding.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the finding.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: IAM Analysis Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","profiles":["incident"],"caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"identity_activity_metrics":{"type":"object_t","description":"Describes usage activity and other metrics of an Identity i.e. AWS IAM User, GCP IAM Principal, etc.","group":"primary","requirement":"recommended","object_type":"identity_activity_metrics","caption":"Identity Activity Metrics","object_name":"Identity Activity Metrics"},"status":{"type":"string_t","description":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Finding was reviewed, determined to be benign or a false positive and is now suppressed.","caption":"Suppressed"},"6":{"description":"The Finding was deleted. For example, it might have been created in error.","caption":"Deleted"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The Finding is new and yet to be reviewed.","caption":"New"},"2":{"description":"The Finding is under review.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Finding was reviewed, remediated and is now considered resolved.","caption":"Resolved"},"5":{"description":"The Finding was archived.","caption":"Archived"}},"description":"The normalized status identifier of the Finding, set by the consumer.","group":"context","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","profiles":["incident"],"object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","profiles":["incident"],"caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the finding.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"iam_analysis_finding","description":"This finding represents an IAM analysis result, which evaluates IAM policies, access patterns, and IAM configurations for potential security risks. The analysis can focus on either an identity (user, role, service account) or a resource to assess permissions, access patterns, and security posture within the IAM domain.
Note: Use permission_analysis_results for identity-centric analysis (evaluating what an identity can do) and access_analysis_result for resource-centric analysis (evaluating who can access a resource). These complement each other for comprehensive IAM security assessment.
Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.","uid":2008,"extends":"finding","category":"findings","constraints":{"at_least_one":["access_analysis_result","applications","identity_activity_metrics","permission_analysis_results"]},"profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"IAM Analysis Finding","category_uid":2},"ntp_activity":{"attributes":{"dispersion":{"type":"integer_t","description":"The dispersion in the NTP protocol is the estimated time error or uncertainty relative to the reference clock in milliseconds.","group":"primary","requirement":"recommended","caption":"Root Dispersion","type_name":"Integer"},"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4013":{"description":"The Network Time Protocol (NTP) Activity events report instances of remote clients synchronizing their clocks with an NTP server, as observed on the network.","caption":"NTP Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"NTP client, syncs with servers.","caption":"Client Synchronization"},"6":{"description":"Monitoring and control messaging.","caption":"Control"},"0":{"description":"Not used in standard NTP implementations.","caption":"Unknown"},"1":{"description":"Bidirectional time exchange between devices.","caption":"Symmetric Active Exchange"},"2":{"description":"Device responds as a server to peers in symmetric active mode.","caption":"Symmetric Passive Response"},"99":{"description":"The event activity is not mapped.","caption":"Other"},"4":{"description":"Dedicated NTP time server, responds to clients.","caption":"Server Response"},"5":{"description":"Broadcast time info to network devices.","caption":"Broadcast"},"7":{"description":"Reserved - Not defined in standard NTP specifications.","caption":"Private Use Case"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"stratum_id":{"type":"integer_t","enum":{"0":{"description":"Unspecified or invalid.","caption":"Unknown"},"1":{"description":"The highest precision primary server (e.g atomic clock or GPS).","caption":"Primary Server"},"2":{"description":"A secondary level server (possible values: 2-15).","caption":"Secondary Server"},"99":{"description":"The stratum level is not mapped. See the stratum attribute, which contains a data source specific value.","caption":"Other"},"16":{"caption":"Unsynchronized"},"17":{"description":"Reserved stratum (possible values: 17-255).","caption":"Reserved"}},"description":"The normalized identifier of the stratum level, as defined in RFC-5905.","group":"primary","requirement":"recommended","caption":"Stratum ID","sibling":"stratum","type_name":"Integer"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"401300":{"caption":"NTP Activity: Unknown"},"401399":{"description":"The event activity is not mapped.","caption":"NTP Activity: Other"},"401301":{"description":"Bidirectional time exchange between devices.","caption":"NTP Activity: Symmetric Active Exchange"},"401302":{"description":"Device responds as a server to peers in symmetric active mode.","caption":"NTP Activity: Symmetric Passive Response"},"401303":{"description":"NTP client, syncs with servers.","caption":"NTP Activity: Client Synchronization"},"401304":{"description":"Dedicated NTP time server, responds to clients.","caption":"NTP Activity: Server Response"},"401305":{"description":"Broadcast time info to network devices.","caption":"NTP Activity: Broadcast"},"401306":{"description":"Monitoring and control messaging.","caption":"NTP Activity: Control"},"401307":{"description":"Reserved - Not defined in standard NTP specifications.","caption":"NTP Activity: Private Use Case"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"version":{"type":"string_t","description":"The version number of the NTP protocol.","group":"context","requirement":"required","caption":"Version","type_name":"String"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"precision":{"type":"integer_t","description":"The NTP precision quantifies a clock's accuracy and stability in log2 seconds, as defined in RFC-5905.","group":"primary","requirement":"recommended","caption":"Precision","type_name":"Integer"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"delay":{"type":"integer_t","description":"The total round-trip delay to the reference clock in milliseconds.","group":"primary","requirement":"recommended","caption":"Root Delay","type_name":"Integer"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"stratum":{"type":"string_t","description":"The stratum level of the NTP server's time source, normalized to the caption of the stratum_id value.","group":"primary","requirement":"recommended","caption":"Stratum","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: NTP Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"ntp_activity","description":"The Network Time Protocol (NTP) Activity events report instances of remote clients synchronizing their clocks with an NTP server, as observed on the network.","uid":4013,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:NTPEvent","url":"https://d3fend.mitre.org/event/d3f:NTPEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"NTP Activity","category_uid":4},"file_hosting":{"attributes":{"expiration_time":{"type":"timestamp_t","description":"The share expiration time.","group":"context","requirement":"optional","caption":"Expiration Time","type_name":"Timestamp"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"http_response":{"type":"object_t","description":"Details about the HTTP response, if available.","group":"context","requirement":"optional","object_type":"http_response","caption":"HTTP Response","object_name":"HTTP Response"},"class_uid":{"type":"integer_t","enum":{"6006":{"description":"File Hosting Activity events report the actions taken by file management applications, including file sharing servers like Sharepoint and services such as Box, MS OneDrive, Google Drive, or network file share services.","caption":"File Hosting Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Update a file.","caption":"Update"},"6":{"description":"Copy a file.","caption":"Copy"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Upload a file.","caption":"Upload"},"2":{"description":"Download a file.","caption":"Download"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Delete a file.","caption":"Delete"},"5":{"description":"Rename a file.","caption":"Rename"},"7":{"description":"Move a file.","caption":"Move"},"8":{"description":"Restore a file.","caption":"Restore"},"9":{"description":"Preview a file.","caption":"Preview"},"10":{"description":"Lock a file.","caption":"Lock"},"11":{"description":"Unlock a file.","caption":"Unlock"},"12":{"description":"Share a file.","caption":"Share"},"14":{"description":"Open a file.","caption":"Open"},"15":{"description":"Mark a file or folder to sync with a computer.","caption":"Sync"},"16":{"description":"Mark a file or folder to not sync with a computer.","caption":"Unsync"},"17":{"description":"Access check for a file. The security_control profile can be used to add the access check results.","caption":"Access Check"},"13":{"description":"Unshare a file.","caption":"Unshare"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"share":{"type":"string_t","description":"The share name.","group":"context","requirement":"optional","caption":"Share","type_name":"String"},"access_list":{"type":"string_t","description":"The list of requested access rights.","group":"context","is_array":true,"requirement":"optional","caption":"Access List","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"6":{"description":"Application Activity events report detailed information about the behavior of applications and services.","uid":6,"caption":"Application Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"access_result":{"type":"json_t","description":"The list of access check results.","group":"context","requirement":"optional","caption":"Access Check Result","type_name":"JSON"},"share_type":{"type":"string_t","description":"The share type, normalized to the caption of the share_type_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","caption":"Share Type","type_name":"String"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the target file.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"600600":{"caption":"File Hosting Activity: Unknown"},"600699":{"caption":"File Hosting Activity: Other"},"600601":{"description":"Upload a file.","caption":"File Hosting Activity: Upload"},"600602":{"description":"Download a file.","caption":"File Hosting Activity: Download"},"600603":{"description":"Update a file.","caption":"File Hosting Activity: Update"},"600604":{"description":"Delete a file.","caption":"File Hosting Activity: Delete"},"600605":{"description":"Rename a file.","caption":"File Hosting Activity: Rename"},"600606":{"description":"Copy a file.","caption":"File Hosting Activity: Copy"},"600607":{"description":"Move a file.","caption":"File Hosting Activity: Move"},"600608":{"description":"Restore a file.","caption":"File Hosting Activity: Restore"},"600609":{"description":"Preview a file.","caption":"File Hosting Activity: Preview"},"600610":{"description":"Lock a file.","caption":"File Hosting Activity: Lock"},"600611":{"description":"Unlock a file.","caption":"File Hosting Activity: Unlock"},"600612":{"description":"Share a file.","caption":"File Hosting Activity: Share"},"600613":{"description":"Unshare a file.","caption":"File Hosting Activity: Unshare"},"600614":{"description":"Open a file.","caption":"File Hosting Activity: Open"},"600615":{"description":"Mark a file or folder to sync with a computer.","caption":"File Hosting Activity: Sync"},"600616":{"description":"Mark a file or folder to not sync with a computer.","caption":"File Hosting Activity: Unsync"},"600617":{"description":"Access check for a file. The security_control profile can be used to add the access check results.","caption":"File Hosting Activity: Access Check"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"access_mask":{"type":"integer_t","description":"The sum of hexadecimal values of requested access rights.","group":"context","requirement":"optional","caption":"Access Mask","type_name":"Integer"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The endpoint that performed the activity on the target file.","group":"primary","requirement":"required","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Application Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"share_type_id":{"type":"integer_t","enum":{"3":{"caption":"Print"},"0":{"description":"The share type is unknown.","caption":"Unknown"},"1":{"caption":"File"},"2":{"caption":"Pipe"},"99":{"description":"The share type is not mapped. See the share_type attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the share type.","group":"context","requirement":"optional","caption":"Share Type ID","sibling":"share_type","type_name":"Integer"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"http_request":{"type":"object_t","description":"Details about the underlying HTTP request.","group":"context","requirement":"recommended","object_type":"http_request","caption":"HTTP Request","object_name":"HTTP Request"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"context","requirement":"optional","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: File Hosting Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The endpoint that received the activity on the target file.","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"expiration_time_dt":{"type":"datetime_t","description":"The share expiration time.","group":"context","requirement":"optional","profiles":["datetime"],"caption":"Expiration Time","type_name":"Datetime"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file_result":{"type":"object_t","description":"The resulting file object when the activity was allowed and successful.","group":"context","requirement":"optional","object_type":"file","caption":"File Result","object_name":"File"},"file":{"type":"object_t","description":"The file that is the target of the activity.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"file_hosting","description":"File Hosting Activity events report the actions taken by file management applications, including file sharing servers like Sharepoint and services such as Box, MS OneDrive, Google Drive, or network file share services.","uid":6006,"extends":"application","category":"application","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Application Activity","caption":"File Hosting Activity","category_uid":6},"osint_inventory_info":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5021":{"description":"OSINT Inventory Info events report open source intelligence or threat intelligence inventory data that is either logged or proactively collected. For example, when collecting OSINT information from Threat Intelligence Platforms (TIPs) or Extended Detection and Response (XDR) platforms, or collecting data from OSINT or other generic threat intelligence and enrichment feeds such as APIs and datastores.","caption":"OSINT Inventory Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT that is being discovered by an inventory process.","group":"primary","is_array":true,"requirement":"required","profiles":null,"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor describes the process that was the source of the inventory activity. In the case of OSINT inventory data, that could be a particular process or script that is run to scrape the OSINT or threat intelligence data. For example, it could be a Python process that runs to pull data from a MISP or Shodan API.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"502100":{"caption":"OSINT Inventory Info: Unknown"},"502199":{"caption":"OSINT Inventory Info: Other"},"502101":{"description":"The discovered information is via a log.","caption":"OSINT Inventory Info: Log"},"502102":{"description":"The discovered information is via a collection process.","caption":"OSINT Inventory Info: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: OSINT Inventory Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"osint_inventory_info","description":"OSINT Inventory Info events report open source intelligence or threat intelligence inventory data that is either logged or proactively collected. For example, when collecting OSINT information from Threat Intelligence Platforms (TIPs) or Extended Detection and Response (XDR) platforms, or collecting data from OSINT or other generic threat intelligence and enrichment feeds such as APIs and datastores.","uid":5021,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"OSINT Inventory Info","category_uid":5},"incident_finding":{"attributes":{"vendor_attributes":{"type":"object_t","description":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like severity_id.
The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability.","requirement":"optional","object_type":"vendor_attributes","caption":"Vendor Attributes","object_name":"Vendor Attributes"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"priority":{"type":"string_t","description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","caption":"Priority","type_name":"String"},"verdict_id":{"type":"integer_t","enum":{"3":{"description":"The incident can be disregarded as it is unimportant, an error or accident.","caption":"Disregard"},"6":{"description":"The incident is a test.","caption":"Test"},"0":{"description":"The type is unknown.","caption":"Unknown"},"1":{"description":"The incident is a false positive.","caption":"False Positive"},"2":{"description":"The incident is a true positive.","caption":"True Positive"},"99":{"description":"The type is not mapped. See the type attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The incident is suspicious.","caption":"Suspicious"},"5":{"description":"The incident is benign.","caption":"Benign"},"7":{"description":"The incident has insufficient data to make a verdict.","caption":"Insufficient Data"},"8":{"description":"The incident is a security risk.","caption":"Security Risk"},"9":{"description":"The incident remediation or required actions are managed externally.","caption":"Managed Externally"},"10":{"description":"The incident is a duplicate.","caption":"Duplicate"}},"description":"The normalized verdict of an Incident.","group":"primary","requirement":"recommended","caption":"Verdict ID","sibling":"verdict","type_name":"Integer"},"class_uid":{"type":"integer_t","enum":{"2005":{"description":"An Incident Finding reports the creation, update, or closure of security incidents as a result of detections and/or analytics.
Note: Incident Finding implicitly includes the incident profile and it should be added to the metadata.profiles[] array.","caption":"Incident Finding"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Reports closure of an Incident .","caption":"Close"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Reports the creation of an Incident.","caption":"Create"},"2":{"description":"Reports updates to an Incident.","caption":"Update"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the Incident activity.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"verdict":{"type":"string_t","description":"The verdict assigned to an Incident finding.","group":"primary","requirement":"recommended","caption":"Verdict","type_name":"String"},"finding_info_list":{"type":"object_t","description":"A list of finding_info objects associated to an incident.","group":"primary","is_array":true,"requirement":"required","object_type":"finding_info","caption":"Finding Information List","object_name":"Finding Information"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"2":{"description":"Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.","uid":2,"caption":"Findings"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"is_suspected_breach":{"type":"boolean_t","description":"A determination based on analytics as to whether a potential breach was found.","group":"context","requirement":"optional","caption":"Suspected Breach","type_name":"Boolean"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":null,"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The time of the least recent event included in the incident.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing the tactics, techniques & sub-techniques associated to the Incident.","group":"context","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":null,"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"desc":{"type":"string_t","description":"The short description of the Incident.","group":"primary","requirement":"recommended","caption":"Description","type_name":"String"},"src_url":{"type":"url_t","description":"A Url link used to access the original incident.","group":"primary","requirement":"recommended","caption":"Source URL","type_name":"URL String"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"200500":{"caption":"Incident Finding: Unknown"},"200599":{"caption":"Incident Finding: Other"},"200501":{"description":"Reports the creation of an Incident.","caption":"Incident Finding: Create"},"200502":{"description":"Reports updates to an Incident.","caption":"Incident Finding: Update"},"200503":{"description":"Reports closure of an Incident .","caption":"Incident Finding: Close"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"tickets":{"type":"object_t","description":"The associated ticket(s) in the ticketing system. Each ticket contains details like ticket ID, status, etc.","group":"context","is_array":true,"requirement":"optional","object_type":"ticket","caption":"Tickets","object_name":"Ticket"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The time of the most recent event included in the incident.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"assignee_group":{"type":"object_t","description":"The details of the group assigned to an Incident.","group":"context","requirement":"optional","object_type":"group","caption":"Assignee Group","object_name":"Group"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The Incident activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"ticket":{"type":"object_t","description":"The linked ticket in the ticketing system.","group":"context","requirement":"optional","object_type":"ticket","caption":"Ticket","@deprecated":{"message":"Use tickets instead.","since":"1.5.0"},"object_name":"Ticket"},"impact_id":{"type":"integer_t","enum":{"3":{"description":"The magnitude of harm is high.","caption":"High"},"0":{"description":"The normalized impact is unknown.","caption":"Unknown"},"1":{"description":"The magnitude of harm is low.","caption":"Low"},"2":{"description":"The magnitude of harm is moderate.","caption":"Medium"},"99":{"description":"The impact is not mapped. See the impact attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The magnitude of harm is high and the scope is widespread.","caption":"Critical"}},"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability.","group":"primary","source":"impact value; impact level","references":[{"description":"NIST SP 800-172 from FIPS 199","url":"https://doi.org/10.6028/NIST.FIPS.199"},{"description":"NIST Computer Security Resource Center","url":"https://doi.org/10.6028/NIST.FIPS.199"}],"requirement":"recommended","caption":"Impact ID","sibling":"impact","type_name":"Integer"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Findings.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":null,"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"Additional user supplied details for updating or closing the incident.","group":"context","requirement":"optional","caption":"Comment","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The time of the most recent event included in the incident.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Incident Finding.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"impact":{"type":"string_t","description":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Impact","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"priority_id":{"type":"integer_t","enum":{"3":{"description":"Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.","caption":"High"},"0":{"description":"No priority is assigned.","caption":"Unknown"},"1":{"description":"Application or personal procedure is unusable, where a workaround is available or a repair is possible.","caption":"Low"},"2":{"description":"Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.","caption":"Medium"},"99":{"description":"The priority is not normalized.","caption":"Other"},"4":{"description":"Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.","caption":"Critical"}},"description":"The normalized priority. Priority identifies the relative importance of the incident or finding. It is a measurement of urgency.","group":"context","requirement":"recommended","caption":"Priority ID","sibling":"priority","type_name":"Integer"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized status of the Incident normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The incident requires some information or response from the user or from a third party.","caption":"On Hold"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The service desk has received the incident but has not assigned it to an agent.","caption":"New"},"2":{"description":"The incident has been assigned to an agent but has not been resolved. The agent is actively working with the user to diagnose and resolve the incident.","caption":"In Progress"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The service desk has confirmed that the incident is resolved.","caption":"Resolved"},"5":{"description":"The incident is resolved and no further action is necessary.","caption":"Closed"}},"description":"The normalized status identifier of the Incident.","group":"primary","requirement":"required","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"assignee":{"type":"object_t","description":"The details of the user assigned to an Incident.","group":"context","requirement":"optional","object_type":"user","caption":"Assignee","object_name":"User"},"impact_score":{"type":"integer_t","description":"The impact as an integer value of the finding, valid range 0-100.","group":"primary","requirement":"recommended","caption":"Impact Score","type_name":"Integer"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The time of the least recent event included in the incident.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"incident_finding","description":"An Incident Finding reports the creation, update, or closure of security incidents as a result of detections and/or analytics.
Note: Incident Finding implicitly includes the incident profile and it should be added to the metadata.profiles[] array.","uid":2005,"extends":"base_event","category":"findings","constraints":{"at_least_one":["assignee","assignee_group"]},"profiles":["cloud","container","data_classification","datetime","host","incident","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Findings","caption":"Incident Finding","category_uid":2},"device_config_state_change":{"attributes":{"state_id":{"type":"integer_t","enum":{"0":{"description":"The Config Change state is unknown.","caption":"Unknown"},"1":{"description":"Config State Changed to Disabled.","caption":"Disabled"},"2":{"description":"Config State Changed to Enabled.","caption":"Enabled"},"99":{"description":"The Config Change is not mapped. See the state attribute, which contains data source specific values.","caption":"Other"}},"description":"The Config Change State of the managed entity.","requirement":"recommended","caption":"Config Change State ID","sibling":"state","type_name":"Integer"},"security_level_id":{"type":"integer_t","enum":{"3":{"caption":"Compromised"},"0":{"caption":"Unknown"},"1":{"caption":"Secure"},"2":{"caption":"At Risk"},"99":{"description":"The security level is not mapped. See the security_level attribute, which contains data source specific values.","caption":"Other"}},"description":"The current security level of the entity","group":"primary","requirement":"recommended","caption":"Security Level ID","sibling":"security_level","type_name":"Integer"},"state":{"type":"string_t","description":"The Config Change Stat, normalized to the caption of the state_id value. In the case of 'Other', it is defined by the source.","requirement":"optional","caption":"Config Change State","type_name":"String"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"prev_security_level":{"type":"string_t","description":"The previous security level of the entity","group":"primary","requirement":"recommended","caption":"Previous Security Level","type_name":"String"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5019":{"description":"Device Config State Change events report state changes that impact the security of the device.","caption":"Device Config State Change"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"prev_security_level_id":{"type":"integer_t","enum":{"3":{"caption":"Compromised"},"0":{"caption":"Unknown"},"1":{"caption":"Secure"},"2":{"caption":"At Risk"},"99":{"description":"The security level is not mapped. See the prev_security_level attribute, which contains data source specific values.","caption":"Other"}},"description":"The previous security level of the entity","group":"primary","requirement":"recommended","caption":"Previous Security Level ID","sibling":"prev_security_level","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"security_states":{"type":"object_t","description":"The current security states of the device.","group":"primary","is_array":true,"requirement":"recommended","object_type":"security_state","caption":"Security States","object_name":"Security State"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"prev_security_states":{"type":"object_t","description":"The previous security states of the device.","group":"primary","is_array":true,"requirement":"recommended","object_type":"security_state","caption":"Previous Security States","object_name":"Security State"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"security_level":{"type":"string_t","description":"The current security level of the entity","group":"primary","requirement":"recommended","caption":"Security Level","type_name":"String"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"The device that is impacted by the state change.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501900":{"caption":"Device Config State Change: Unknown"},"501999":{"caption":"Device Config State Change: Other"},"501901":{"description":"The discovered information is via a log.","caption":"Device Config State Change: Log"},"501902":{"description":"The discovered information is via a collection process.","caption":"Device Config State Change: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Device Config State Change.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"device_config_state_change","description":"Device Config State Change events report state changes that impact the security of the device.","uid":5019,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Device Config State Change","category_uid":5},"software_info":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5020":{"description":"Software Inventory Info events report device software inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","caption":"Software Inventory Info"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"sbom":{"type":"object_t","description":"The Software Bill of Materials (SBOM) of the device software that is being discovered by an inventory process.","group":"primary","requirement":"recommended","object_type":"sbom","caption":"Software Bill Of Materials","object_name":"Software Bill of Materials"},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"product":{"type":"object_t","description":"Additional product attributes that have been discovered or enriched from a catalog or other external source.","group":"context","requirement":"optional","object_type":"product","caption":"Product","object_name":"Product"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"The device that is being discovered by an inventory process.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"502000":{"caption":"Software Inventory Info: Unknown"},"502099":{"caption":"Software Inventory Info: Other"},"502001":{"description":"The discovered information is via a log.","caption":"Software Inventory Info: Log"},"502002":{"description":"The discovered information is via a collection process.","caption":"Software Inventory Info: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"package":{"type":"object_t","description":"The device software that is being discovered by an inventory process.","group":"primary","references":[{"description":"D3FEND™ Ontology d3f:SoftwarePackage.","url":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}],"requirement":"recommended","object_type":"package","caption":"Software Package","@deprecated":{"message":"Use the sbom attribute instead.","since":"1.4.0"},"object_name":"Software Package"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Software Inventory Info.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"software_info","description":"Software Inventory Info events report device software inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","uid":5020,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Software Inventory Info","category_uid":5},"file_remediation_activity":{"attributes":{"scan":{"type":"object_t","description":"The remediation scan that pertains to this event.","group":"context","requirement":"optional","object_type":"scan","caption":"Scan","object_name":"Scan"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"7002":{"description":"File Remediation Activity events report on attempts at remediating files. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Sub-techniques will include File, such as File Removal or Restore File.","caption":"File Remediation Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Restore"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Isolate"},"2":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Evict"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Harden"},"5":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Detect"}},"description":"Matches the MITRE D3FEND™ Tactic. Note: the Model and Detect Tactics are not supported as remediations by the OCSF Remediation event class.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"7":{"description":"Remediation events report the results of remediation commands targeting files, processes, and other objects.","uid":7,"caption":"Remediation"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"700200":{"caption":"File Remediation Activity: Unknown"},"700299":{"caption":"File Remediation Activity: Other"},"700201":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"File Remediation Activity: Isolate"},"700202":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"File Remediation Activity: Evict"},"700203":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"File Remediation Activity: Restore"},"700204":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"File Remediation Activity: Harden"},"700205":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"File Remediation Activity: Detect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"command_uid":{"type":"string_t","description":"The unique identifier of the remediation command that pertains to this event.","group":"primary","requirement":"required","caption":"Command UID","type_name":"String"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Remediation.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"countermeasures":{"type":"object_t","description":"The MITRE D3FEND™ Matrix Countermeasures associated with a remediation.","group":"primary","is_array":true,"requirement":"recommended","object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: File Remediation Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The target of the remediation does not exist.","caption":"Does Not Exist"},"6":{"description":"There was an error during the remediation process.","caption":"Error"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The remediation was partially completed.","caption":"Partial"},"5":{"description":"The remediation was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"file":{"type":"object_t","description":"The file that pertains to the remediation event.","group":"primary","requirement":"required","object_type":"file","caption":"File","object_name":"File"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"file_remediation_activity","description":"File Remediation Activity events report on attempts at remediating files. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Sub-techniques will include File, such as File Removal or Restore File.","uid":7002,"extends":"remediation_activity","category":"remediation","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Remediation","caption":"File Remediation Activity","category_uid":7},"kernel_extension_activity":{"attributes":{"driver":{"type":"object_t","description":"The driver that was loaded/unloaded into the kernel","group":"primary","requirement":"required","object_type":"kernel_driver","caption":"Kernel Driver","object_name":"Kernel Extension"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"1002":{"description":"Kernel Extension events report when a driver/extension is loaded or unloaded into the kernel","caption":"Kernel Extension Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A driver/extension was loaded into the kernel","caption":"Load"},"2":{"description":"A driver/extension was unloaded (removed) from the kernel","caption":"Unload"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor process that loaded or unloaded the driver/extension.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"100200":{"caption":"Kernel Extension Activity: Unknown"},"100299":{"caption":"Kernel Extension Activity: Other"},"100201":{"description":"A driver/extension was loaded into the kernel","caption":"Kernel Extension Activity: Load"},"100202":{"description":"A driver/extension was unloaded (removed) from the kernel","caption":"Kernel Extension Activity: Unload"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Kernel Extension Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"kernel_extension_activity","description":"Kernel Extension events report when a driver/extension is loaded or unloaded into the kernel","uid":1002,"extends":"system","category":"system","references":[{"description":"D3FEND™ Ontology d3f:KernelModuleEvent","url":"https://d3fend.mitre.org/event/d3f:KernelModuleEvent/"}],"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Kernel Extension Activity","category_uid":1},"network_activity":{"attributes":{"is_src_dst_assignment_known":{"type":"boolean_t","description":"true denotes that src_endpoint and dst_endpoint correctly identify the initiator and responder respectively. false denotes that the event source has arbitrarily assigned one peer to src_endpoint and the other to dst_endpoint, in other words that initiator and responder are not being asserted. This can occur, for example, when the event source is a network appliance that has not observed the initiation of a given connection. In the absence of this attribute, interpretation of the initiator and responder is implementation-specific.","group":"primary","requirement":"recommended","caption":"Source/Destination Assignment Known","type_name":"Boolean"},"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4001":{"description":"Network Activity events report network connection and traffic activity.","caption":"Network Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"The network connection was abnormally terminated or closed by a middle device like firewalls.","caption":"Reset"},"6":{"description":"Network traffic report.","caption":"Traffic"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"A new network connection was opened.","caption":"Open"},"2":{"description":"The network connection was closed.","caption":"Close"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The network connection failed. For example a connection timeout or no route to host.","caption":"Fail"},"5":{"description":"The network connection was refused. For example an attempt to connect to a server port which is not open.","caption":"Refuse"},"7":{"description":"A network endpoint began listening for new network connections.","caption":"Listen"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"url":{"type":"object_t","description":"The URL details relevant to the network traffic.","group":"primary","requirement":"recommended","object_type":"url","caption":"URL","object_name":"Uniform Resource Locator"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"400100":{"caption":"Network Activity: Unknown"},"400199":{"caption":"Network Activity: Other"},"400101":{"description":"A new network connection was opened.","caption":"Network Activity: Open"},"400102":{"description":"The network connection was closed.","caption":"Network Activity: Close"},"400103":{"description":"The network connection was abnormally terminated or closed by a middle device like firewalls.","caption":"Network Activity: Reset"},"400104":{"description":"The network connection failed. For example a connection timeout or no route to host.","caption":"Network Activity: Fail"},"400105":{"description":"The network connection was refused. For example an attempt to connect to a server port which is not open.","caption":"Network Activity: Refuse"},"400106":{"description":"Network traffic report.","caption":"Network Activity: Traffic"},"400107":{"description":"A network endpoint began listening for new network connections.","caption":"Network Activity: Listen"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":" The initiator of the network connection. In some contexts an event source cannot correctly identify the initiator. Refer to is_src_dst_assignment_known for certainty.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"primary","requirement":"recommended","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"primary","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder of the network connection. In some contexts an event source cannot correctly identify the responder. Refer to is_src_dst_assignment_known for certainty.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"network_activity","description":"Network Activity events report network connection and traffic activity.","uid":4001,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:NetworkConnectionEvent","url":"https://d3fend.mitre.org/event/d3f:NetworkConnectionEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"Network Activity","category_uid":4},"user_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5018":{"description":"User Query events report user data that have been discovered, queried, polled or searched. This event differs from User Inventory as it describes the result of a targeted search by filtering a subset of user attributes.","caption":"User Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"user":{"type":"object_t","description":"The user that pertains to the event or object.","group":"primary","requirement":"required","object_type":"user","caption":"User","object_name":"User"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501800":{"caption":"User Query: Unknown"},"501899":{"caption":"User Query: Other"},"501801":{"description":"The discovered results are via a query request.","caption":"User Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: User Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"user_query","description":"User Query events report user data that have been discovered, queried, polled or searched. This event differs from User Inventory as it describes the result of a targeted search by filtering a subset of user attributes.","uid":5018,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"User Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"dns_activity":{"attributes":{"app_protocol_name":{"type":"string_t","description":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., https, quic, ssh, dns), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry.\n\n

Note: Port numbers alone are not always a reliable indicator of the actual application protocol in use.

","group":"context","references":[{"description":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"}],"requirement":"optional","caption":"Application Protocol Name","type_name":"String"},"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"observation_point_id":{"type":"integer_t","enum":{"3":{"description":"Neither the source nor destination network endpoint is the observation point. Refer to the network_observation_point attribute for details.","caption":"Neither"},"0":{"description":"The observation point is unknown.","caption":"Unknown"},"1":{"description":"The source network endpoint is the observation point.","caption":"Source"},"2":{"description":"The destination network endpoint is the observation point.","caption":"Destination"},"99":{"description":"The observation point is not mapped. See the observation_point attribute for a data source specific value.","caption":"Other"},"4":{"description":"Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a connection_info.direction of Local.","caption":"Both"}},"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity.","requirement":"optional","caption":"Observation Point ID","sibling":"observation_point","type_name":"Integer"},"response_time_dt":{"type":"datetime_t","description":"The Domain Name System (DNS) response time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Response Time","type_name":"Datetime"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"proxy_http_request":{"type":"object_t","description":"The HTTP Request from the proxy server to the remote server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_request","caption":"Proxy HTTP Request","object_name":"HTTP Request"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"4003":{"description":"DNS Activity events report DNS queries and answers as seen on the network.","caption":"DNS Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"query_time_dt":{"type":"datetime_t","description":"The Domain Name System (DNS) query time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Query Time","type_name":"Datetime"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"query_time":{"type":"timestamp_t","description":"The Domain Name System (DNS) query time.","group":"occurrence","requirement":"recommended","caption":"Query Time","type_name":"Timestamp"},"activity_id":{"type":"integer_t","enum":{"6":{"description":"Bidirectional DNS request and response traffic.","caption":"Traffic"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The DNS query request.","caption":"Query"},"2":{"description":"The DNS query response.","caption":"Response"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"rcode_id":{"type":"integer_t","enum":{"3":{"description":"Non-Existent Domain.","caption":"NXDomain"},"6":{"description":"Name Exists when it should not.","caption":"YXDomain"},"0":{"description":"No Error.","caption":"NoError"},"1":{"description":"Format Error.","caption":"FormError"},"2":{"description":"Server Failure.","caption":"ServError"},"99":{"description":"The dns response code is not defined by the RFC.","caption":"Other"},"4":{"description":"Not Implemented.","caption":"NotImp"},"5":{"description":"Query Refused.","caption":"Refused"},"7":{"description":"RR Set Exists when it should not.","caption":"YXRRSet"},"8":{"description":"RR Set that should exist does not.","caption":"NXRRSet"},"9":{"description":"Not Authorized or Server Not Authoritative for zone.","caption":"NotAuth"},"10":{"description":"Name not contained in zone.","caption":"NotZone"},"11":{"description":"DSO-TYPE Not Implemented.","caption":"DSOTYPENI"},"16":{"description":"TSIG Signature Failure or Bad OPT Version.","caption":"BADSIG_VERS"},"17":{"description":"Key not recognized.","caption":"BADKEY"},"18":{"description":"Signature out of time window.","caption":"BADTIME"},"20":{"description":"Duplicate key name.","caption":"BADNAME"},"21":{"description":"Algorithm not supported.","caption":"BADALG"},"22":{"description":"Bad Truncation.","caption":"BADTRUNC"},"23":{"description":"Bad/missing Server Cookie.","caption":"BADCOOKIE"},"24":{"description":"The codes deemed to be unassigned by the RFC (unassigned codes: 12-15, 24-3840, 4096-65534).","caption":"Unassigned"},"25":{"description":"The codes deemed to be reserved by the RFC (codes: 3841-4095, 65535).","caption":"Reserved"},"19":{"description":"Bad TKEY Mode.","caption":"BADMODE"}},"description":"The normalized identifier of the DNS server response code. See RFC-6895.","group":"primary","requirement":"recommended","caption":"Response Code ID","sibling":"rcode","type_name":"Integer"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"4":{"description":"Network Activity events.","uid":4,"caption":"Network Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"load_balancer":{"type":"object_t","description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.","group":"primary","requirement":"recommended","profiles":["load_balancer"],"object_type":"load_balancer","caption":"Load Balancer","object_name":"Load Balancer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"observation_point":{"type":"string_t","description":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the observation_point_id.","requirement":"optional","caption":"Observation Point","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"answers":{"type":"object_t","description":"The Domain Name System (DNS) answers.","group":"primary","is_array":true,"requirement":"recommended","object_type":"dns_answer","caption":"DNS Answer","object_name":"DNS Answer"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"rcode":{"type":"string_t","description":"The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Response Code","type_name":"String"},"network_observation_point":{"type":"object_t","description":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when observation_point_id = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Network Observation Point","object_name":"Network Endpoint"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"query":{"type":"object_t","description":"The Domain Name System (DNS) query.","group":"primary","requirement":"recommended","object_type":"dns_query","caption":"DNS Query","object_name":"DNS Query"},"type_uid":{"type":"long_t","enum":{"400300":{"caption":"DNS Activity: Unknown"},"400399":{"caption":"DNS Activity: Other"},"400301":{"description":"The DNS query request.","caption":"DNS Activity: Query"},"400302":{"description":"The DNS query response.","caption":"DNS Activity: Response"},"400306":{"description":"Bidirectional DNS request and response traffic.","caption":"DNS Activity: Traffic"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"proxy_traffic":{"type":"object_t","description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_traffic","caption":"Proxy Traffic","object_name":"Network Traffic"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"ja4_fingerprint_list":{"type":"object_t","description":"A list of the JA4+ network fingerprints.","group":"context","is_array":true,"requirement":"optional","object_type":"ja4_fingerprint","caption":"JA4+ Fingerprints","object_name":"JA4+ Fingerprint"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The initiator (client) of the network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"proxy_connection_info":{"type":"object_t","description":"The connection information from the proxy server to the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"network_connection_info","caption":"Proxy Connection Info","object_name":"Network Connection Information"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"packet_list":{"type":"object_t","description":"The list of packet objects describing captured network packets.","group":"context","is_array":true,"requirement":"optional","object_type":"packet","caption":"Packets","object_name":"Packet"},"proxy_tls":{"type":"object_t","description":"The TLS protocol negotiated between the proxy server and the remote server.","group":"context","requirement":"recommended","profiles":["network_proxy"],"object_type":"tls","caption":"Proxy TLS","object_name":"Transport Layer Security (TLS)"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Network Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"response_time":{"type":"timestamp_t","description":"The Domain Name System (DNS) response time.","group":"occurrence","requirement":"recommended","caption":"Response Time","type_name":"Timestamp"},"traffic":{"type":"object_t","description":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use cumulative_traffic instead.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"context","requirement":"optional","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"proxy_http_response":{"type":"object_t","description":"The HTTP Response from the remote server to the proxy server.","group":"context","requirement":"optional","profiles":["network_proxy"],"object_type":"http_response","caption":"Proxy HTTP Response","object_name":"HTTP Response"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: DNS Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The responder (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"cumulative_traffic":{"type":"object_t","description":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both traffic for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Cumulative Traffic","object_name":"Network Traffic"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"app_name":{"type":"string_t","description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service.","group":"context","requirement":"optional","caption":"Application Name","type_name":"String"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"proxy":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"primary","requirement":"recommended","object_type":"network_proxy","caption":"Proxy","@deprecated":{"message":"Use the proxy_endpoint attribute instead.","since":"1.1.0"},"object_name":"Network Proxy Endpoint"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"dns_activity","description":"DNS Activity events report DNS queries and answers as seen on the network.","uid":4003,"extends":"network","category":"network","constraints":{"at_least_one":["dst_endpoint","src_endpoint"]},"references":[{"description":"D3FEND™ Ontology d3f:DNSEvent","url":"https://d3fend.mitre.org/event/d3f:DNSEvent/"}],"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","load_balancer","macos/macos_users","network_proxy","osint","security_control"],"category_name":"Network Activity","caption":"DNS Activity","category_uid":4},"remediation_activity":{"attributes":{"scan":{"type":"object_t","description":"The remediation scan that pertains to this event.","group":"context","requirement":"optional","object_type":"scan","caption":"Scan","object_name":"Scan"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"7001":{"description":"Remediation Activity events report on attempts at remediating a compromised device or computer network. It follows the MITRE countermeasures defined by the D3FEND™ Matrix.","caption":"Remediation Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Restore"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Isolate"},"2":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Evict"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Harden"},"5":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Detect"}},"description":"Matches the MITRE D3FEND™ Tactic. Note: the Model and Detect Tactics are not supported as remediations by the OCSF Remediation event class.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"7":{"description":"Remediation events report the results of remediation commands targeting files, processes, and other objects.","uid":7,"caption":"Remediation"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"700100":{"caption":"Remediation Activity: Unknown"},"700199":{"caption":"Remediation Activity: Other"},"700101":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Remediation Activity: Isolate"},"700102":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Remediation Activity: Evict"},"700103":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Remediation Activity: Restore"},"700104":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Remediation Activity: Harden"},"700105":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Remediation Activity: Detect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"command_uid":{"type":"string_t","description":"The unique identifier of the remediation command that pertains to this event.","group":"primary","requirement":"required","caption":"Command UID","type_name":"String"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Remediation.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"countermeasures":{"type":"object_t","description":"The MITRE D3FEND™ Matrix Countermeasures associated with a remediation.","group":"primary","is_array":true,"requirement":"recommended","object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Remediation Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The target of the remediation does not exist.","caption":"Does Not Exist"},"6":{"description":"There was an error during the remediation process.","caption":"Error"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The remediation was partially completed.","caption":"Partial"},"5":{"description":"The remediation was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"remediation_activity","description":"Remediation Activity events report on attempts at remediating a compromised device or computer network. It follows the MITRE countermeasures defined by the D3FEND™ Matrix.","uid":7001,"extends":"base_event","category":"remediation","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Remediation","caption":"Remediation Activity","category_uid":7},"service_query":{"attributes":{"query_info":{"type":"object_t","description":"The search details associated with the query request.","group":"primary","requirement":"recommended","object_type":"query_info","caption":"Query Info","object_name":"Query Information"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"query_result":{"type":"string_t","description":"The result of the query.","group":"primary","requirement":"recommended","caption":"Query Result","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"5016":{"description":"Service Query events report information about running services.","caption":"Service Query"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered results are via a query request.","caption":"Query"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"query_result_id":{"type":"integer_t","enum":{"3":{"description":"The target was not found.","caption":"Does not exist"},"0":{"description":"The query result is unknown.","caption":"Unknown"},"1":{"description":"The target was found.","caption":"Exists"},"2":{"description":"The target was partially found.","caption":"Partial"},"99":{"description":"The query result is not mapped. See the query_result attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The discovery attempt failed.","caption":"Error"},"5":{"description":"Discovery of the target was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the query result.","group":"primary","requirement":"required","caption":"Query Result ID","sibling":"query_result","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"service":{"type":"object_t","description":"The service that pertains to the event.","group":"primary","requirement":"required","object_type":"service","caption":"Service","object_name":"Service"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"501600":{"caption":"Service Query: Unknown"},"501699":{"caption":"Service Query: Other"},"501601":{"description":"The discovered results are via a query request.","caption":"Service Query: Query"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Service Query.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"service_query","description":"Service Query events report information about running services.","uid":5016,"extends":"discovery_result","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Service Query","@deprecated":{"message":"Use the Live Evidence Info class.","since":"1.5.0"},"category_uid":5},"win/registry_value_activity":{"attributes":{"prev_reg_value":{"type":"object_t","description":"The registry value before the mutation","extension":"win","requirement":"optional","extension_id":2,"object_type":"win/reg_value","caption":"Previous Registry Value","object_name":"Registry Value"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"201002":{"description":"Registry Value Activity events reports when a process performs an action on a Windows registry value.","caption":"Registry Value Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"caption":"Modify"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"caption":"Get"},"2":{"caption":"Set"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Delete"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"reg_value":{"type":"object_t","description":"The registry value.","extension":"win","requirement":"required","extension_id":2,"object_type":"win/reg_value","caption":"Registry Value","object_name":"Registry Value"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"1":{"description":"System Activity events.","uid":1,"caption":"System Activity"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor that performed the activity on the reg_value object.","group":"primary","requirement":"required","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"20100200":{"caption":"Registry Value Activity: Unknown"},"20100299":{"caption":"Registry Value Activity: Other"},"20100201":{"caption":"Registry Value Activity: Get"},"20100202":{"caption":"Registry Value Activity: Set"},"20100203":{"caption":"Registry Value Activity: Modify"},"20100204":{"caption":"Registry Value Activity: Delete"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: System Activity.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Registry Value Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"registry_value_activity","description":"Registry Value Activity events reports when a process performs an action on a Windows registry value.","extension":"win","uid":201002,"extends":"system","category":"system","extension_id":2,"associations":{"device":["actor.user"],"actor.user":["device"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"System Activity","caption":"Registry Value Activity","category_uid":1},"process_remediation_activity":{"attributes":{"scan":{"type":"object_t","description":"The remediation scan that pertains to this event.","group":"context","requirement":"optional","object_type":"scan","caption":"Scan","object_name":"Scan"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"7003":{"description":"Process Remediation Activity events report on attempts at remediating processes. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Sub-techniques will include Process, such as Process Termination or Kernel-based Process Isolation.","caption":"Process Remediation Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"3":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Restore"},"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Isolate"},"2":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Evict"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Harden"},"5":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Detect"}},"description":"Matches the MITRE D3FEND™ Tactic. Note: the Model and Detect Tactics are not supported as remediations by the OCSF Remediation event class.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"7":{"description":"Remediation events report the results of remediation commands targeting files, processes, and other objects.","uid":7,"caption":"Remediation"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"700300":{"caption":"Process Remediation Activity: Unknown"},"700399":{"caption":"Process Remediation Activity: Other"},"700301":{"description":"Creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses. Defined by D3FEND™ d3f:Isolate.","caption":"Process Remediation Activity: Isolate"},"700302":{"description":"Removes an adversary or malicious resource from a device or computer network. Defined by D3FEND™ d3f:Evict.","caption":"Process Remediation Activity: Evict"},"700303":{"description":"Returns the system to a better state. Defined by D3FEND™ d3f:Restore.","caption":"Process Remediation Activity: Restore"},"700304":{"description":"Increases the opportunity cost of computer network exploitation. Defined by D3FEND™ d3f:Harden.","caption":"Process Remediation Activity: Harden"},"700305":{"description":"Further identify adversary access to or unauthorized activity on computer networks. Defined by D3FEND™ d3f:Detect.","caption":"Process Remediation Activity: Detect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"command_uid":{"type":"string_t","description":"The unique identifier of the remediation command that pertains to this event.","group":"primary","requirement":"required","caption":"Command UID","type_name":"String"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Remediation.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"process":{"type":"object_t","description":"The process that pertains to the remediation event.","group":"primary","requirement":"required","object_type":"process","caption":"Process","object_name":"Process"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"countermeasures":{"type":"object_t","description":"The MITRE D3FEND™ Matrix Countermeasures associated with a remediation.","group":"primary","is_array":true,"requirement":"recommended","object_type":"d3fend","caption":"Countermeasures","object_name":"MITRE D3FEND™"},"remediation":{"type":"object_t","description":"Describes the recommended remediation steps to address identified issue(s).","group":"context","requirement":"optional","object_type":"remediation","caption":"Remediation Guidance","object_name":"Remediation"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Process Remediation Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The target of the remediation does not exist.","caption":"Does Not Exist"},"6":{"description":"There was an error during the remediation process.","caption":"Error"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The remediation was partially completed.","caption":"Partial"},"5":{"description":"The remediation was not supported.","caption":"Unsupported"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"process_remediation_activity","description":"Process Remediation Activity events report on attempts at remediating processes. It follows the MITRE countermeasures defined by the D3FEND™ Matrix. Sub-techniques will include Process, such as Process Termination or Kernel-based Process Isolation.","uid":7003,"extends":"remediation_activity","category":"remediation","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Remediation","caption":"Process Remediation Activity","category_uid":7},"config_state":{"attributes":{"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"assessments":{"type":"object_t","description":"A list of assessments associated with the device.","group":"context","is_array":true,"requirement":"optional","object_type":"assessment","caption":"Related Assessments","object_name":"Assessment"},"class_uid":{"type":"integer_t","enum":{"5002":{"description":"Device Config State events report device configuration data, device assessments, and/or CIS Benchmark results.","caption":"Device Config State"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"The discovered information is via a log.","caption":"Log"},"2":{"description":"The discovered information is via a collection process.","caption":"Collect"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"classification","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"5":{"description":"Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.","uid":5,"caption":"Discovery"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"The device that is being discovered by an inventory process.","group":"primary","requirement":"required","profiles":null,"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"context","requirement":"optional","profiles":null,"object_type":"actor","caption":"Actor","object_name":"Actor"},"cis_benchmark_result":{"type":"object_t","description":"The CIS Benchmark Result object captures results generated from benchmark evaluations as defined by the Center for Internet Security (CIS).","group":"primary","requirement":"recommended","object_type":"cis_benchmark_result","caption":"CIS Benchmark Result","@deprecated":{"message":"Use Compliance object with Check object instead.","since":"1.5.0"},"object_name":"CIS Benchmark Result"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"500200":{"caption":"Device Config State: Unknown"},"500299":{"caption":"Device Config State: Other"},"500201":{"description":"The discovered information is via a log.","caption":"Device Config State: Log"},"500202":{"description":"The discovered information is via a collection process.","caption":"Device Config State: Collect"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Discovery.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Device Config State.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"recommended","caption":"Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"caption":"Success"},"2":{"caption":"Failure"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the event status.","group":"primary","requirement":"recommended","caption":"Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"config_state","description":"Device Config State events report device configuration data, device assessments, and/or CIS Benchmark results.","uid":5002,"extends":"discovery","category":"discovery","profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Discovery","caption":"Device Config State","@deprecated":{"message":"Use Compliance Finding class.","since":"1.5.0"},"category_uid":5},"drone_flights_activity":{"attributes":{"proxy_endpoint":{"type":"object_t","description":"The proxy (server) in a network connection.","group":"context","requirement":"recommended","object_type":"network_proxy","caption":"Proxy Endpoint","object_name":"Network Proxy Endpoint"},"time":{"type":"timestamp_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"required","caption":"Event Time","type_name":"Timestamp"},"firewall_rule":{"type":"object_t","description":"The firewall rule that pertains to the control that triggered the event, if applicable.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"firewall_rule","caption":"Firewall Rule","object_name":"Firewall Rule"},"malware":{"type":"object_t","description":"A list of Malware objects, describing details about the identified malware.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"malware","caption":"Malware","object_name":"Malware"},"type_name":{"type":"string_t","description":"The event/finding type name, as defined by the type_uid.","group":"classification","requirement":"optional","caption":"Type Name","type_name":"String"},"class_uid":{"type":"integer_t","enum":{"8001":{"description":"Drone Flights Activity events report the activity of Unmanned Aerial Systems (UAS), their Operators, and mission-planning and authorization metadata as reported by the UAS platforms themselves, by Counter-UAS (CUAS) systems, or other remote monitoring or sensing infrastructure. Based on the Remote ID defined in Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a","caption":"Drone Flights Activity"}},"description":"The unique identifier of a class. A class describes the attributes available in an event.","group":"classification","requirement":"required","caption":"Class ID","sibling":"class_name","type_name":"Integer"},"cloud":{"type":"object_t","description":"Describes details about the Cloud environment where the event or finding was created.","group":"primary","requirement":"required","profiles":["cloud"],"object_type":"cloud","caption":"Cloud","object_name":"Cloud"},"activity_id":{"type":"integer_t","enum":{"0":{"description":"The event activity is unknown.","caption":"Unknown"},"1":{"description":"Remote ID information from an Unmanned System is being captured (collected).","caption":"Capture"},"2":{"description":"Unmanned System activity is being recorded.","caption":"Record"},"99":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized identifier of the activity that triggered the event.","group":"primary","requirement":"required","caption":"Activity ID","sibling":"activity_name","type_name":"Integer","suppress_checks":["sibling_convention"]},"raw_data_hash":{"type":"object_t","description":"The hash, which describes the content of the raw_data field.","group":"context","requirement":"optional","object_type":"fingerprint","caption":"Raw Data Hash","object_name":"Fingerprint"},"risk_details":{"type":"string_t","description":"Describes the risk associated with the finding.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Details","type_name":"String"},"malware_scan_info":{"type":"object_t","description":"Describes details about the scan job that identified malware on the target system.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"malware_scan_info","caption":"Malware Scan Info","object_name":"Malware Scan Info"},"auth_protocol":{"type":"string_t","description":"The authentication type as defined by the caption of auth_protocol_id. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","caption":"Authentication Type","type_name":"String"},"timezone_offset":{"type":"integer_t","description":"The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.","group":"occurrence","requirement":"recommended","caption":"Timezone Offset","type_name":"Integer"},"disposition_id":{"type":"integer_t","enum":{"3":{"description":"A suspicious file or other content was moved to a benign location.","caption":"Quarantined"},"6":{"description":"The request was detected as a threat and resulted in the connection being dropped.","caption":"Dropped"},"0":{"description":"The disposition is unknown.","caption":"Unknown"},"1":{"description":"Granted access or allowed the action to the protected resource.","caption":"Allowed"},"2":{"description":"Denied access or blocked the action to the protected resource.","caption":"Blocked"},"99":{"description":"The disposition is not mapped. See the disposition attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"A session was isolated on the network or within a browser.","caption":"Isolated"},"5":{"description":"A file or other content was deleted.","caption":"Deleted"},"7":{"description":"A custom action was executed such as running of a command script. Use the message attribute of the base class for details.","caption":"Custom Action"},"8":{"description":"A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'.","caption":"Approved"},"9":{"description":"A quarantined file or other content was restored to its original location.","caption":"Restored"},"10":{"description":"A suspicious or risky entity was deemed to no longer be suspicious (re-scored).","caption":"Exonerated"},"11":{"description":"A corrupt file or configuration was corrected.","caption":"Corrected"},"12":{"description":"A corrupt file or configuration was partially corrected.","caption":"Partially Corrected"},"14":{"description":"An operation was delayed, for example if a restart was required to finish the operation.","caption":"Delayed"},"15":{"description":"Suspicious activity or a policy violation was detected without further action.","caption":"Detected"},"16":{"description":"The outcome of an operation had no action taken.","caption":"No Action"},"17":{"description":"The operation or action was logged without further action.","caption":"Logged"},"18":{"description":"A file or other entity was marked with extended attributes.","caption":"Tagged"},"20":{"description":"Counted the request or activity but did not determine whether to allow it or block it.","caption":"Count"},"21":{"description":"The request was detected as a threat and resulted in the connection being reset.","caption":"Reset"},"22":{"description":"Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.","caption":"Captcha"},"23":{"description":"Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.","caption":"Challenge"},"24":{"description":"The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class.","caption":"Access Revoked"},"25":{"description":"A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'.","caption":"Rejected"},"26":{"description":"An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail.","caption":"Unauthorized"},"27":{"description":"An error occurred during the processing of the activity or request. Use the message attribute of the base class for details.","caption":"Error"},"13":{"description":"A corrupt file or configuration was not corrected.","caption":"Uncorrected"},"19":{"description":"The request or activity was detected as a threat and resulted in a notification but request was not blocked.","caption":"Alert"}},"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Disposition ID","sibling":"disposition","type_name":"Integer"},"category_uid":{"type":"integer_t","enum":{"8":{"description":"Unmanned Systems events report the activity, existence, and/or state of unmanned systems for tracking, mission planning, and other related activities.","uid":8,"caption":"Unmanned Systems"}},"description":"The category unique identifier of the event.","group":"classification","requirement":"required","caption":"Category ID","sibling":"category_name","type_name":"Integer"},"metadata":{"type":"object_t","description":"The metadata associated with the event or a finding.","group":"context","requirement":"required","object_type":"metadata","caption":"Metadata","object_name":"Metadata"},"action_id":{"type":"integer_t","enum":{"3":{"description":"The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The disposition_id attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.","caption":"Observed"},"0":{"description":"The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.","caption":"Unknown"},"1":{"description":"The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.","caption":"Allowed"},"2":{"description":"The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.","caption":"Denied"},"99":{"description":"The action is not mapped. See the action attribute which contains a data source specific value.","caption":"Other"},"4":{"description":"The activity was modified, adjusted, or corrected. The disposition_id attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.","caption":"Modified"}},"description":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Action ID","sibling":"action","type_name":"Integer"},"confidence_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"description":"The normalized confidence is unknown.","caption":"Unknown"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.","caption":"Other"}},"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.","group":"context","requirement":"recommended","profiles":["security_control"],"caption":"Confidence ID","sibling":"confidence","type_name":"Integer"},"start_time":{"type":"timestamp_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"Start Time","type_name":"Timestamp"},"auth_protocol_id":{"type":"integer_t","enum":{"3":{"caption":"Operator ID Signature"},"6":{"caption":"Specific Authentication Method"},"0":{"description":"The authentication type is unknown.","caption":"Unknown"},"1":{"caption":"None"},"2":{"caption":"UAS ID Signature"},"99":{"description":"The authentication type is not mapped. See the auth_protocol attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Message Set Signature"},"5":{"caption":"Authentication Provided by Network Remote ID"},"7":{"caption":"Reserved"},"8":{"caption":"Private User"},"9":{"caption":"EAP"},"10":{"caption":"RADIUS"},"11":{"caption":"Basic Authentication"},"12":{"caption":"LDAP"}},"description":"The normalized identifier of the authentication type used to authorize a flight plan or mission.","group":"context","requirement":"optional","caption":"Authentication Type ID","sibling":"auth_protocol","type_name":"Integer"},"attacks":{"type":"object_t","description":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques.","group":"primary","is_array":true,"references":[{"description":"MITRE ATT&CK®","url":"https://attack.mitre.org"},{"description":"MITRE ATLAS","url":"https://atlas.mitre.org/matrices/ATLAS"}],"requirement":"optional","profiles":["security_control"],"object_type":"attack","caption":"MITRE ATT&CK® and ATLAS™ Details","object_name":"MITRE ATT&CK® & ATLAS™"},"unmanned_system_operator":{"type":"object_t","description":"The human or machine operator of an Unmanned System.","group":"primary","requirement":"required","object_type":"user","caption":"Unmanned Systems Operator","object_name":"User"},"risk_level":{"type":"string_t","description":"The risk level, normalized to the caption of the risk_level_id value.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level","type_name":"String"},"device":{"type":"object_t","description":"An addressable device, computer system or host.","group":"primary","requirement":"recommended","profiles":["host"],"object_type":"device","caption":"Device","object_name":"Device"},"osint":{"type":"object_t","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","group":"primary","is_array":true,"requirement":"required","profiles":["osint"],"object_type":"osint","caption":"OSINT","object_name":"OSINT"},"tls":{"type":"object_t","description":"The Transport Layer Security (TLS) attributes.","group":"context","requirement":"optional","object_type":"tls","caption":"TLS","object_name":"Transport Layer Security (TLS)"},"actor":{"type":"object_t","description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.","group":"primary","requirement":"optional","profiles":["host"],"object_type":"actor","caption":"Actor","object_name":"Actor"},"disposition":{"type":"string_t","description":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Disposition","type_name":"String"},"type_uid":{"type":"long_t","enum":{"800100":{"caption":"Drone Flights Activity: Unknown"},"800199":{"description":"The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.","caption":"Drone Flights Activity: Other"},"800101":{"description":"Remote ID information from an Unmanned System is being captured (collected).","caption":"Drone Flights Activity: Capture"},"800102":{"description":"Unmanned System activity is being recorded.","caption":"Drone Flights Activity: Record"}},"description":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.","group":"classification","requirement":"required","caption":"Type ID","sibling":"type_name","type_name":"Long"},"risk_score":{"type":"integer_t","description":"The risk score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Score","type_name":"Integer"},"action":{"type":"string_t","description":"The normalized caption of action_id.","group":"primary","requirement":"optional","profiles":["security_control"],"caption":"Action","type_name":"String"},"unmapped":{"type":"object_t","description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.","group":"context","requirement":"optional","object_type":"object","caption":"Unmapped Data","object_name":"Object"},"authorizations":{"type":"object_t","description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.","group":"primary","is_array":true,"requirement":"optional","profiles":["security_control"],"object_type":"authorization","caption":"Authorization Information","object_name":"Authorization Result"},"confidence_score":{"type":"integer_t","description":"The confidence score as reported by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence Score","type_name":"Integer"},"unmanned_aerial_system":{"type":"object_t","description":"The Unmanned Aerial System object describes the characteristics, Position Location Information (PLI), and other metadata of Unmanned Aerial Systems (UAS) and other unmanned and drone systems used in Remote ID. Remote ID is defined in the Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a.","group":"primary","requirement":"required","object_type":"unmanned_aerial_system","caption":"Unmanned Aerial System","object_name":"Unmanned Aerial System"},"end_time_dt":{"type":"datetime_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"End Time","type_name":"Datetime"},"observables":{"type":"object_t","description":"The observables associated with the event or a finding.","group":"primary","is_array":true,"references":[{"description":"OCSF Observables FAQ","url":"https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"}],"requirement":"recommended","object_type":"observable","caption":"Observables","object_name":"Observable"},"src_endpoint":{"type":"object_t","description":"The source network endpoint of the Unmanned Aerial System (UAS), Counter Unmanned Aerial System (CUAS) platform, or other unmanned systems monitoring and/or sensing infrastructure.","group":"context","requirement":"optional","object_type":"network_endpoint","caption":"Source Endpoint","object_name":"Network Endpoint"},"message":{"type":"string_t","description":"The description of the event/finding, as defined by the source.","group":"primary","requirement":"recommended","caption":"Message","type_name":"String"},"activity_name":{"type":"string_t","description":"The event activity name, as defined by the activity_id.","group":"classification","requirement":"optional","caption":"Activity","type_name":"String"},"is_alert":{"type":"boolean_t","description":"Indicates that the event is considered to be an alertable signal. Should be set to true if disposition_id = Alert among other dispositions, and/or risk_level_id or severity_id of the event is elevated. Not all control events will be alertable, for example if disposition_id = Exonerated or disposition_id = Allowed.","group":"primary","requirement":"recommended","profiles":["security_control"],"caption":"Alert","type_name":"Boolean"},"api":{"type":"object_t","description":"Describes details about a typical API (Application Programming Interface) call.","group":"context","requirement":"optional","profiles":["cloud"],"object_type":"api","caption":"API Details","object_name":"API"},"category_name":{"type":"string_t","description":"The event category name, as defined by category_uid value: Unmanned Systems.","group":"classification","requirement":"optional","caption":"Category","type_name":"String"},"policy":{"type":"object_t","description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.","group":"primary","requirement":"optional","profiles":["security_control"],"object_type":"policy","caption":"Policy","object_name":"Policy"},"confidence":{"type":"string_t","description":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Confidence","type_name":"String"},"count":{"type":"integer_t","description":"The number of times that events in the same logical group occurred during the event Start Time to End Time period.","group":"occurrence","requirement":"optional","caption":"Count","type_name":"Integer"},"unmanned_system_operating_area":{"type":"object_t","description":"The UAS Operating Area object describes details about a precise area of operations for a UAS flight or mission.","group":"primary","requirement":"recommended","object_type":"unmanned_system_operating_area","caption":"UAS Operating Area","object_name":"Unmanned System Operating Area"},"traffic":{"type":"object_t","description":"Traffic refers to the amount of data transmitted from a Unmanned Aerial System (UAS) or Counter Unmanned Aerial System (UAS) (CUAS) system at a given point of time. Ex: bytes_in and bytes_out.","group":"context","requirement":"optional","object_type":"network_traffic","caption":"Traffic","object_name":"Network Traffic"},"risk_level_id":{"type":"integer_t","enum":{"3":{"caption":"High"},"0":{"caption":"Info"},"1":{"caption":"Low"},"2":{"caption":"Medium"},"99":{"description":"The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.","caption":"Other"},"4":{"caption":"Critical"}},"description":"The normalized risk level id.","group":"context","requirement":"optional","profiles":["security_control"],"caption":"Risk Level ID","sibling":"risk_level","type_name":"Integer","suppress_checks":["enum_convention"]},"comment":{"type":"string_t","description":"This optional, free-text field enables the operator to describe the purpose of a flight, if so desired.","group":"context","requirement":"optional","caption":"Operation Description","type_name":"String"},"end_time":{"type":"timestamp_t","description":"The end time of a time period, or the time of the most recent event included in the aggregate event.","group":"occurrence","requirement":"optional","caption":"End Time","type_name":"Timestamp"},"protocol_name":{"type":"string_t","description":"The networking protocol associated with the Remote ID device or beacon. E.g. BLE, LTE, 802.11.","group":"context","requirement":"optional","caption":"Remote ID Protocol","type_name":"String"},"connection_info":{"type":"object_t","description":"The network connection information.","group":"context","requirement":"recommended","object_type":"network_connection_info","caption":"Connection Info","object_name":"Network Connection Information"},"enrichments":{"type":"object_t","description":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]","group":"context","is_array":true,"requirement":"optional","object_type":"enrichment","caption":"Enrichments","object_name":"Enrichment"},"class_name":{"type":"string_t","description":"The event class name, as defined by class_uid value: Drone Flights Activity.","group":"classification","requirement":"optional","caption":"Class","type_name":"String"},"dst_endpoint":{"type":"object_t","description":"The destination network endpoint of the Unmanned Aerial System (UAS), Counter Unmanned Aerial System (CUAS) platform, or other unmanned systems monitoring and/or sensing infrastructure.","group":"context","requirement":"required","object_type":"network_endpoint","caption":"Destination Endpoint","object_name":"Network Endpoint"},"status_code":{"type":"string_t","description":"The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.","group":"primary","requirement":"recommended","caption":"Status Code","type_name":"String"},"raw_data_size":{"type":"long_t","description":"The size of the raw data which was transformed into an OCSF event, in bytes.","group":"context","requirement":"optional","caption":"Raw Data Size","type_name":"Long"},"status":{"type":"string_t","description":"The normalized Operational status for the Unmanned Aerial System (UAS) normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.","group":"context","requirement":"optional","caption":"Operational Status","type_name":"String"},"raw_data":{"type":"string_t","description":"The raw event/finding data as received from the source.","group":"context","requirement":"optional","caption":"Raw Data","type_name":"String"},"status_id":{"type":"integer_t","enum":{"3":{"description":"The Unmanned Aerial System (UAS) is airborne.","caption":"Airborne"},"6":{"description":"An ASTM Reserved status is reported.","caption":"Reserved"},"0":{"description":"The status is unknown.","caption":"Unknown"},"1":{"description":"The operational status is not reported.","caption":"Undeclared"},"2":{"description":"The Unmanned Aerial System (UAS) is grounded.","caption":"Ground"},"99":{"description":"The status is not mapped. See the status attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"The Unmanned Aerial System (UAS) is reporting an emergency status.","caption":"Emergency"},"5":{"description":"The Unmanned Aerial System (UAS) is reporting the Remote ID beacon or device is malfunctioning or has failed.","caption":"Remote ID System Failure"}},"description":"The normalized Operational status identifier for the Unmanned Aerial System (UAS).","group":"primary","requirement":"recommended","caption":"Operational Status ID","sibling":"status","type_name":"Integer"},"time_dt":{"type":"datetime_t","description":"The normalized event occurrence time or the finding creation time.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Event Time","type_name":"Datetime"},"status_detail":{"type":"string_t","description":"The status detail contains additional information about the event/finding outcome.","group":"primary","requirement":"recommended","caption":"Status Detail","type_name":"String"},"duration":{"type":"long_t","description":"The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.","group":"occurrence","requirement":"optional","caption":"Duration Milliseconds","type_name":"Long"},"classification":{"type":"string_t","description":"UA Classification - Allows a region to classify UAS in a regional specific manner. The format may differ from region to region.","group":"context","requirement":"optional","caption":"Classification Type","type_name":"String"},"severity":{"type":"string_t","description":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.","group":"classification","requirement":"optional","caption":"Severity","type_name":"String"},"start_time_dt":{"type":"datetime_t","description":"The start time of a time period, or the time of the least recent event included in the aggregate event.","group":"occurrence","requirement":"optional","profiles":["datetime"],"caption":"Start Time","type_name":"Datetime"},"severity_id":{"type":"integer_t","enum":{"3":{"description":"Action is required but the situation is not serious at this time.","caption":"Medium"},"6":{"description":"An error occurred but it is too late to take remedial action.","caption":"Fatal"},"0":{"description":"The event/finding severity is unknown.","caption":"Unknown"},"1":{"description":"Informational message. No action required.","caption":"Informational"},"2":{"description":"The user decides if action is needed.","caption":"Low"},"99":{"description":"The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.","caption":"Other"},"4":{"description":"Action is required immediately.","caption":"High"},"5":{"description":"Action is required immediately and the scope is broad.","caption":"Critical"}},"description":"

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.","group":"classification","requirement":"required","caption":"Severity ID","sibling":"severity","type_name":"Integer"}},"name":"drone_flights_activity","description":"Drone Flights Activity events report the activity of Unmanned Aerial Systems (UAS), their Operators, and mission-planning and authorization metadata as reported by the UAS platforms themselves, by Counter-UAS (CUAS) systems, or other remote monitoring or sensing infrastructure. Based on the Remote ID defined in Standard Specification for Remote ID and Tracking (ASTM Designation: F3411-22a) ASTM F3411-22a","uid":8001,"extends":"unmanned_systems","category":"unmanned_systems","constraints":{"at_least_one":["src_endpoint","unmanned_aerial_system","unmanned_system_operator","unmanned_system_operating_area"]},"profiles":["cloud","container","data_classification","datetime","host","linux/linux_users","macos/macos_users","osint","security_control"],"category_name":"Unmanned Systems","caption":"Drone Flights Activity","category_uid":8}},"profiles":{"trace":{"meta":"profile","name":"trace","description":"The Trace Profile extends the OCSF framework to capture and standardize observability events, specifically targeting trace-level data. This profile enables integration and normalization of distributed tracing information, allowing OCSF events to retain essential trace context such as trace IDs, span relationships, and service dependencies.","caption":"Trace","annotations":{"group":"primary"}},"host":{"meta":"profile","name":"host","description":"The attributes that identify host/device attributes.","caption":"Host","annotations":{"group":"primary"}},"datetime":{"meta":"profile","name":"datetime","description":"This profile defines date/time attributes as defined in RFC-3339. For example 1985-04-12T23:20:50.52Z.","caption":"Date/Time"},"cloud":{"meta":"profile","name":"cloud","description":"The attributes that describe information specific to Cloud services/applications.","caption":"Cloud"},"container":{"meta":"profile","name":"container","description":"The container context for a process.","caption":"Container"},"data_classification":{"meta":"profile","name":"data_classification","description":"The Data Classification profile adds attributes to specific resource objects, allowing users to describe information about classifiers & data classification results.","caption":"Data Classification"},"load_balancer":{"meta":"profile","name":"load_balancer","description":"The attributes that describe information specific to load balancers.","caption":"Load Balancer","annotations":{"group":"primary"}},"osint":{"meta":"profile","name":"osint","description":"The OSINT (Open Source Intelligence) profile contains one or more indicators and associated analysis and details, such as registrar (WHOIS) information and commentary about a hostname, or information about a digital certificate and its usage within a campaign. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers within the profile itself.","caption":"OSINT"},"network_proxy":{"meta":"profile","name":"network_proxy","description":"The attributes that identify network proxy attributes.","caption":"Network Proxy","annotations":{"group":"context"}},"security_control":{"meta":"profile","name":"security_control","description":"The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, intrusion detection, firewall, or data control. The profile is intended to augment activities or findings with an outcome when a security control has observed or intervened. If the control detected a security violation, and the disposition_id or action_id is an alertable outcome or action, the is_alert flag may be set to true.","caption":"Security Control","annotations":{"group":"primary"}},"incident":{"meta":"profile","name":"incident","description":"The attributes that add incident handling semantics to a Finding.","caption":"Incident","annotations":{"group":"primary"}},"ai_operation":{"meta":"profile","name":"ai_operation","description":"AI-specific attributes for model operations, retrieval systems, and agent activities. e.g. model_name, total_token_counts etc.","caption":"AI Operation"},"linux/linux_users":{"meta":"profile","name":"linux_users","description":"The attributes that Linux uses to identify user information.","extension":"linux","extension_id":1,"caption":"Linux Users"},"macos/macos_users":{"meta":"profile","name":"macos_users","description":"The attributes that macOS uses to identify user information.","extension":"macos","extension_id":3,"caption":"macOS Users"}},"compile_version":1} \ No newline at end of file From ab9788d273edb06fd4f76b087d6b4361e47c4e43 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:08:38 +0200 Subject: [PATCH 02/26] feat(ocsf): map OCSF types and enums to proto3 OCSF *_t types resolve via their base chain (timestamp_t->int64, float_t->double, json_t->google.protobuf.Value, string-derived->string). Enums reuse OCSF 0=Unknown as the proto zero value, prefix value names to avoid collisions, guard against int32 overflow, and fall back to a string field for string-keyed enums. Dispatch sentinels are grouped constants. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/internal/ocsf/gen/mapenum.go | 195 +++++++++++++++++ ocsf/internal/ocsf/gen/mapenum_test.go | 215 ++++++++++++++++++ ocsf/internal/ocsf/gen/maptype.go | 156 ++++++++++++++ ocsf/internal/ocsf/gen/maptype_test.go | 288 +++++++++++++++++++++++++ 4 files changed, 854 insertions(+) create mode 100644 ocsf/internal/ocsf/gen/mapenum.go create mode 100644 ocsf/internal/ocsf/gen/mapenum_test.go create mode 100644 ocsf/internal/ocsf/gen/maptype.go create mode 100644 ocsf/internal/ocsf/gen/maptype_test.go diff --git a/ocsf/internal/ocsf/gen/mapenum.go b/ocsf/internal/ocsf/gen/mapenum.go new file mode 100644 index 0000000..bc24ff4 --- /dev/null +++ b/ocsf/internal/ocsf/gen/mapenum.go @@ -0,0 +1,195 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen + +import ( + "fmt" + "math" + "sort" + "strings" + "unicode" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +// ProtoEnumValue is a single value in a generated proto3 enum declaration. +// +// Ident is the fully-qualified proto enum value identifier, prefixed with the +// enum type name in UPPER_SNAKE form to avoid C++ scope collisions between +// enums that share common value names (e.g. UNKNOWN, OTHER). +// Number is the integer assigned to the value in the .proto file. +// +// The proto emitter iterates Values to write enum body lines. +type ProtoEnumValue struct { + Ident string + Number int32 +} + +// ProtoEnum is the proto3 representation of an OCSF integer-keyed enum. +// +// Name holds the proto enum type name as supplied by the caller (e.g. +// "SeverityId"). Values is sorted ascending by Number with the zero value +// always first. +// +// SynthesizedZero is true when the OCSF source enum had no key-0 member and +// MapEnum prepended a synthetic _UNKNOWN = 0 entry. Callers should +// surface this so reviewers know the zero value was invented rather than taken +// from the schema. +// +// OCSF enums have a sibling free-text string field (e.g. severity_id int + +// severity string). That sibling field is retained as a plain proto string +// field alongside the enum field; it is not modelled here because it is a +// field-emission concern, not an enum-mapping concern. +type ProtoEnum struct { + Name string + Values []ProtoEnumValue + SynthesizedZero bool +} + +// MapEnum maps an OCSF enum (expressed as the ordered []schema.EnumMember +// slice from schema.Attribute.Enum) to a proto3 ProtoEnum descriptor. +// +// typeName is the proto enum type name the caller has already determined (e.g. +// "SeverityId"). MapEnum uses it as-is for ProtoEnum.Name and derives the +// value-identifier prefix from its UPPER_SNAKE form. +// +// Returns: +// - pe, true, nil — integer-keyed enum; pe is ready for emission. +// - zero, false, nil — string-keyed enum; the caller should represent the +// field as a plain proto string instead. +// - zero, false, err — any member has a negative key (OCSF doesn't use +// negative values; surfacing is preferable to silently emitting a 10-byte +// varint). +// +// Zero value: if no member with Key==0 exists, a synthetic entry named +// _UNKNOWN = 0 is prepended and SynthesizedZero is set. +// +// Value identifiers follow the rule: _. +// Caption sanitization: uppercase, replace runs of non-alphanumeric characters +// with a single "_", trim leading/trailing "_", collapse repeated "_". +// Duplicate resulting identifiers are resolved deterministically by appending +// "_2", "_3", … to the later colliding entry (later = higher key number). +func MapEnum(typeName string, members []schema.EnumMember) (pe ProtoEnum, isProtoEnum bool, err error) { + if len(members) == 0 { + // Empty enum is technically valid; treat as int-keyed since there is + // nothing to distinguish it as string-keyed. + return ProtoEnum{Name: typeName}, true, nil + } + + // Determine key kind from the first member (schema guarantees homogeneous keys). + if !members[0].IntKey { + return ProtoEnum{}, false, nil + } + + prefix := toUpperSnake(typeName) + + // Validate keys and build values. + values := make([]ProtoEnumValue, 0, len(members)) + for _, m := range members { + if m.Key < 0 { + return ProtoEnum{}, false, fmt.Errorf( + "ocsf gen: enum %q: negative key %d is not allowed in proto3", + typeName, m.Key, + ) + } + if m.Key > math.MaxInt32 { + return ProtoEnum{}, false, fmt.Errorf( + "ocsf gen: enum %q: key %d overflows int32", + typeName, m.Key, + ) + } + ident := prefix + "_" + sanitizeCaption(m.Caption) + values = append(values, ProtoEnumValue{ + Ident: ident, + Number: int32(m.Key), + }) + } + + // Sort ascending by number (schema.sortedEnumMembers already does this, but + // the caller might pass an unsorted slice, so be defensive). + sort.Slice(values, func(i, j int) bool { + return values[i].Number < values[j].Number + }) + + // Synthesize a zero value if needed. + synthesized := false + if len(values) == 0 || values[0].Number != 0 { + zero := ProtoEnumValue{Ident: prefix + "_UNKNOWN", Number: 0} + values = append([]ProtoEnumValue{zero}, values...) + synthesized = true + } + + // De-duplicate identical idents deterministically. Values are already in + // ascending key order; the first occurrence of an ident keeps its name, each + // subsequent collision gets a numeric suffix (_2, _3, …). + seen := make(map[string]int, len(values)) // ident -> next suffix + for i, v := range values { + base := v.Ident + if _, exists := seen[base]; !exists { + seen[base] = 2 + continue + } + // Collision: find a free suffixed ident. + suffix := seen[base] + for { + candidate := fmt.Sprintf("%s_%d", base, suffix) + if _, used := seen[candidate]; !used { + values[i].Ident = candidate + seen[base] = suffix + 1 + seen[candidate] = 2 + break + } + suffix++ + } + } + + return ProtoEnum{ + Name: typeName, + Values: values, + SynthesizedZero: synthesized, + }, true, nil +} + +// toUpperSnake converts a camelCase or PascalCase identifier to UPPER_SNAKE. +// "SeverityId" -> "SEVERITY_ID", "ActivityId" -> "ACTIVITY_ID". +func toUpperSnake(s string) string { + var b strings.Builder + runes := []rune(s) + for i, r := range runes { + if i > 0 && unicode.IsUpper(r) && !unicode.IsUpper(runes[i-1]) { + b.WriteRune('_') + } + b.WriteRune(unicode.ToUpper(r)) + } + return b.String() +} + +// sanitizeCaption converts a human-readable caption to an UPPER_SNAKE +// identifier fragment suitable for use in a proto enum value name. +// +// Rules: +// 1. Uppercase all letters. +// 2. Replace any run of non-alphanumeric characters with a single "_". +// 3. Trim leading and trailing "_". +func sanitizeCaption(caption string) string { + var b strings.Builder + inRun := false + for _, r := range caption { + if unicode.IsLetter(r) || unicode.IsDigit(r) { + b.WriteRune(unicode.ToUpper(r)) + inRun = false + } else if !inRun { + b.WriteRune('_') + inRun = true + } + } + result := strings.Trim(b.String(), "_") + return result +} diff --git a/ocsf/internal/ocsf/gen/mapenum_test.go b/ocsf/internal/ocsf/gen/mapenum_test.go new file mode 100644 index 0000000..17e55c4 --- /dev/null +++ b/ocsf/internal/ocsf/gen/mapenum_test.go @@ -0,0 +1,215 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +// synEnum builds a synthetic schema.Attribute with an inline enum for tests +// that do not need a real fixture attribute. +func synEnum(members []schema.EnumMember) []schema.EnumMember { + return members +} + +// TestMapEnum_SeverityID verifies the severity_id enum from the base event +// fixture. Expected values: +// +// 0 Unknown +// 1 Informational +// 2 Low +// 3 Medium +// 4 High +// 5 Critical +// 6 Fatal +// 99 Other +func TestMapEnum_SeverityID(t *testing.T) { + s := loadFixture(t) + + attr, ok := s.BaseEvent.Attributes["severity_id"] + require.True(t, ok, "severity_id must exist on base_event") + require.NotEmpty(t, attr.Enum, "severity_id must have enum members") + + pe, isProto, err := gen.MapEnum("SeverityId", attr.Enum) + require.NoError(t, err) + require.True(t, isProto, "severity_id is integer-keyed so must be a proto enum") + require.False(t, pe.SynthesizedZero, "severity_id has a 0 member so no synthesized zero") + require.Equal(t, "SeverityId", pe.Name) + + // Zero value must be first. + require.Equal(t, int32(0), pe.Values[0].Number) + require.Equal(t, "SEVERITY_ID_UNKNOWN", pe.Values[0].Ident) + + // Other must be present at 99. + last := pe.Values[len(pe.Values)-1] + require.Equal(t, int32(99), last.Number) + require.Equal(t, "SEVERITY_ID_OTHER", last.Ident) + + // Strictly ascending order. + for i := 1; i < len(pe.Values); i++ { + require.Greater(t, pe.Values[i].Number, pe.Values[i-1].Number, + "values must be in ascending order") + } + + // isProtoEnum=true assertion already done above. + + // Check a mid-range value. + found := false + for _, v := range pe.Values { + if v.Number == 4 { + require.Equal(t, "SEVERITY_ID_HIGH", v.Ident) + found = true + } + } + require.True(t, found, "SEVERITY_ID_HIGH (4) must be present") +} + +// TestMapEnum_ActivityID verifies the activity_id enum from api_activity. +// Expected values: 0 Unknown, 1 Create, 2 Read, 3 Update, 4 Delete, 99 Other. +func TestMapEnum_ActivityID(t *testing.T) { + s := loadFixture(t) + + cls, ok := s.Classes["api_activity"] + require.True(t, ok, "api_activity must exist") + + attr, ok := cls.Attributes["activity_id"] + require.True(t, ok, "activity_id must exist on api_activity") + require.NotEmpty(t, attr.Enum, "activity_id must have enum members") + + pe, isProto, err := gen.MapEnum("ActivityId", attr.Enum) + require.NoError(t, err) + require.True(t, isProto) + require.False(t, pe.SynthesizedZero) + require.Equal(t, "ActivityId", pe.Name) + + // Verify all expected idents are present with correct numbers. + want := map[int32]string{ + 0: "ACTIVITY_ID_UNKNOWN", + 1: "ACTIVITY_ID_CREATE", + 2: "ACTIVITY_ID_READ", + 3: "ACTIVITY_ID_UPDATE", + 4: "ACTIVITY_ID_DELETE", + 99: "ACTIVITY_ID_OTHER", + } + require.Len(t, pe.Values, len(want)) + + got := make(map[int32]string, len(pe.Values)) + for _, v := range pe.Values { + got[v.Number] = v.Ident + } + require.Equal(t, want, got) + + // Ascending order. + for i := 1; i < len(pe.Values); i++ { + require.Greater(t, pe.Values[i].Number, pe.Values[i-1].Number) + } +} + +// TestMapEnum_StringKeyed verifies that a string-keyed enum returns +// isProtoEnum=false and no error. +func TestMapEnum_StringKeyed(t *testing.T) { + members := synEnum([]schema.EnumMember{ + {StrKey: "GREEN", Caption: "Green", IntKey: false}, + {StrKey: "AMBER", Caption: "Amber", IntKey: false}, + {StrKey: "RED", Caption: "Red", IntKey: false}, + }) + + pe, isProto, err := gen.MapEnum("Tlp", members) + require.NoError(t, err) + require.False(t, isProto, "string-keyed enum must not be a proto enum") + require.Zero(t, pe, "ProtoEnum must be zero value when isProtoEnum=false") +} + +// TestMapEnum_SynthesizedZero verifies that when an integer-keyed enum has no +// 0 member, a zero value named _UNKNOWN is prepended and +// SynthesizedZero is set. +func TestMapEnum_SynthesizedZero(t *testing.T) { + members := synEnum([]schema.EnumMember{ + {Key: 1, Caption: "Alpha", IntKey: true}, + {Key: 2, Caption: "Beta", IntKey: true}, + {Key: 99, Caption: "Other", IntKey: true}, + }) + + pe, isProto, err := gen.MapEnum("MyEnum", members) + require.NoError(t, err) + require.True(t, isProto) + require.True(t, pe.SynthesizedZero, "must synthesize a zero value when none exists") + + // Zero value must be first. + require.Equal(t, int32(0), pe.Values[0].Number) + require.Equal(t, "MY_ENUM_UNKNOWN", pe.Values[0].Ident) + + // Rest in ascending order following the synthesized zero. + require.Equal(t, int32(1), pe.Values[1].Number) + require.Equal(t, int32(2), pe.Values[2].Number) + require.Equal(t, int32(99), pe.Values[3].Number) +} + +// TestMapEnum_DuplicateIdents verifies deterministic de-duplication when two +// captions sanitize to the same identifier. "Alpha-1" and "Alpha 1" both +// sanitize to "ALPHA_1", so the second must become "ALPHA_1_2". +func TestMapEnum_DuplicateIdents(t *testing.T) { + members := synEnum([]schema.EnumMember{ + {Key: 0, Caption: "Unknown", IntKey: true}, + {Key: 1, Caption: "Alpha-1", IntKey: true}, + {Key: 2, Caption: "Alpha 1", IntKey: true}, + }) + + pe, isProto, err := gen.MapEnum("Thing", members) + require.NoError(t, err) + require.True(t, isProto) + require.False(t, pe.SynthesizedZero) + + identsByNumber := make(map[int32]string, len(pe.Values)) + for _, v := range pe.Values { + identsByNumber[v.Number] = v.Ident + } + + // Both must have distinct idents. + i1 := identsByNumber[1] + i2 := identsByNumber[2] + require.NotEqual(t, i1, i2, "duplicate captions must produce distinct idents") + + // The earlier one (lower key, processed first in ascending order) keeps the + // base ident; the collision gets the suffix. + require.Equal(t, "THING_ALPHA_1", i1) + require.Equal(t, "THING_ALPHA_1_2", i2) +} + +// TestMapEnum_NegativeKey verifies that a negative integer key causes an error. +func TestMapEnum_NegativeKey(t *testing.T) { + members := synEnum([]schema.EnumMember{ + {Key: -1, Caption: "Negative", IntKey: true}, + {Key: 0, Caption: "Unknown", IntKey: true}, + }) + + _, _, err := gen.MapEnum("Bad", members) + require.Error(t, err, "negative enum key must produce an error") +} + +// TestMapEnum_Int32Overflow verifies that a key exceeding math.MaxInt32 causes +// an error instead of silently truncating (Fix 3). OCSF key values come from +// long_t attributes which can technically exceed the int32 range. +func TestMapEnum_Int32Overflow(t *testing.T) { + const overflowKey = int(1<<32 + 1) // 4_294_967_297 — well above MaxInt32 + members := synEnum([]schema.EnumMember{ + {Key: 0, Caption: "Unknown", IntKey: true}, + {Key: overflowKey, Caption: "TooBig", IntKey: true}, + }) + + _, _, err := gen.MapEnum("Overflow", members) + require.Error(t, err, "key > math.MaxInt32 must produce an error") + require.Contains(t, err.Error(), "overflows int32") +} diff --git a/ocsf/internal/ocsf/gen/maptype.go b/ocsf/internal/ocsf/gen/maptype.go new file mode 100644 index 0000000..708d74f --- /dev/null +++ b/ocsf/internal/ocsf/gen/maptype.go @@ -0,0 +1,156 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package gen provides code-generation helpers that consume the loaded OCSF +// schema model and produce proto3 type descriptors for use by the proto emitter. +package gen + +import ( + "fmt" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +// ProtoType describes the proto3 type of a single generated field. +// +// Exactly one of Scalar, Message, or WellKnown is non-empty: +// +// - Scalar holds a proto3 primitive keyword: "string", "int32", "int64", +// "double", or "bool". +// - Message holds the OCSF object name (a key in Schema.Objects) when the +// attribute references a complex type. The emitter turns this into a +// message reference. +// - WellKnown holds a fully-qualified well-known type name, currently only +// "google.protobuf.Value" for json_t and the generic OCSF "object" type. +// +// Repeated mirrors Attribute.IsArray and signals that the field must be +// declared as a repeated proto3 field. +type ProtoType struct { + Scalar string + Message string + WellKnown string + Repeated bool +} + +// baseMapping maps OCSF base primitive type names to proto3 scalar keywords. +// Only the six true base types are listed here; derived types are resolved +// transitively via the Types chain before this table is consulted. +var baseMapping = map[string]string{ + "string_t": "string", + "integer_t": "int32", + "long_t": "int64", + "float_t": "double", + "boolean_t": "bool", +} + +// These sentinels drive the dispatch branches in MapType and resolveProtoType. +// Each name matches an exact OCSF schema string or the proto well-known type it maps to. +const ( + // objectTypeName is the OCSF attribute type string for complex object references. + objectTypeName = "object_t" + + // genericObject is the OCSF object name for the unstructured bag type. + // It has no schema-defined attributes; we map it to google.protobuf.Value. + genericObject = "object" + + // wellKnownType is the OCSF type name for embedded JSON values. + wellKnownType = "json_t" + + // wellKnownValueType is the fully-qualified proto well-known type used for + // json_t and the generic "object" type. + wellKnownValueType = "google.protobuf.Value" +) + +// MapType maps an OCSF Attribute to a ProtoType by resolving the attribute's +// OCSF type against the schema's types map (for scalar/derived types) or +// objects map (for complex types). +// +// Type resolution follows this order: +// 1. If attr.Type is "object_t", attr.ObjectType names a complex object. +// The special object name "object" (the OCSF generic bag type) maps to +// google.protobuf.Value instead of a message reference. +// 2. If attr.Type is "json_t", the result is WellKnown google.protobuf.Value. +// 3. Otherwise attr.Type must be a key in s.Types. The type chain is walked +// (via TypeDef.Type) until a base type with no parent is reached, then the +// base-mapping table is consulted. Cycles are detected and cause an error. +// +// attr.IsArray maps directly to Repeated. +// An unresolvable type (absent from both types and objects, or a cycle in the +// type chain) returns a non-nil error. +func MapType(s *schema.Schema, attr schema.Attribute) (ProtoType, error) { + var pt ProtoType + pt.Repeated = attr.IsArray + + typeName := attr.Type + + // object_t — the attribute holds a complex OCSF object. + if typeName == objectTypeName { + objectName := attr.ObjectType + if objectName == genericObject { + // The generic OCSF "object" is an unstructured bag; map to Value. + pt.WellKnown = wellKnownValueType + return pt, nil + } + // Verify the object actually exists in the schema. + if _, ok := s.Objects[objectName]; !ok { + return ProtoType{}, fmt.Errorf("ocsf gen: attribute references unknown object %q", objectName) + } + pt.Message = objectName + return pt, nil + } + + // json_t — embedded JSON value. + if typeName == wellKnownType { + pt.WellKnown = wellKnownValueType + return pt, nil + } + + // Primitive or derived type — walk the base chain. + scalar, err := resolveScalar(s, typeName) + if err != nil { + return ProtoType{}, err + } + pt.Scalar = scalar + return pt, nil +} + +// resolveScalar walks the TypeDef chain from typeName up to a base type and +// returns the corresponding proto3 scalar keyword. +// +// Cycles are detected by limiting traversal to len(s.Types)+1 steps. +func resolveScalar(s *schema.Schema, typeName string) (string, error) { + // Maximum chain depth: one more than the number of registered types, + // which is a safe bound for detecting cycles. + const maxDepth = 64 + + current := typeName + for i := 0; i < maxDepth; i++ { + // Check whether this is a base type. + if scalar, ok := baseMapping[current]; ok { + return scalar, nil + } + + // Not a base type — look it up in the types map and follow the chain. + td, ok := s.Types[current] + if !ok { + return "", fmt.Errorf("ocsf gen: unknown type %q (not in schema types map)", typeName) + } + + if td.Type == "" { + // No parent but also not a known base — the type exists in the + // schema but we have no mapping for it (e.g. json_t was handled + // above; an exotic future base type). + return "", fmt.Errorf("ocsf gen: type %q has no base mapping and no parent type", typeName) + } + + current = td.Type + } + + return "", fmt.Errorf("ocsf gen: type chain from %q exceeds max depth (possible cycle)", typeName) +} diff --git a/ocsf/internal/ocsf/gen/maptype_test.go b/ocsf/internal/ocsf/gen/maptype_test.go new file mode 100644 index 0000000..9b0fed7 --- /dev/null +++ b/ocsf/internal/ocsf/gen/maptype_test.go @@ -0,0 +1,288 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "os" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +const fixtureFile = "../schema/testdata/ocsf-1.8.0.json" + +func loadFixture(t *testing.T) *schema.Schema { + t.Helper() + f, err := os.Open(fixtureFile) + require.NoError(t, err) + t.Cleanup(func() { _ = f.Close() }) + s, err := schema.Load(f) + require.NoError(t, err) + return s +} + +// deref dereferences a *schema.Attribute map lookup, failing the test if absent. +func deref(t *testing.T, m map[string]*schema.Attribute, key string) schema.Attribute { + t.Helper() + a, ok := m[key] + require.True(t, ok, "attribute %q must exist", key) + return *a +} + +// syn builds a minimal synthetic Attribute for type-mapping tests. +// Used when a specific primitive isn't present on the classes under test. +func syn(typeName string, objectType string, isArray bool) schema.Attribute { + return schema.Attribute{ + Type: typeName, + ObjectType: objectType, + IsArray: isArray, + } +} + +// TestMapType is a table-driven test for MapType. +// +// Most cases are grounded in real OCSF 1.8.0 fixture attributes so that the +// mapping is verified against actual schema data. Synthetic attributes are +// used only where a specific primitive type does not appear directly on +// api_activity, entity_management, network_endpoint, or location — the four +// classes/objects inspected here — and where the attribute path is documented. +func TestMapType(t *testing.T) { + s := loadFixture(t) + + apiActivity := s.Classes["api_activity"].Attributes + networkEndpoint := s.Objects["network_endpoint"].Attributes + location := s.Objects["location"].Attributes + enrichment := s.Objects["enrichment"].Attributes + + tests := []struct { + name string + attr schema.Attribute + want gen.ProtoType + wantErr bool + }{ + // ---------------------------------------------------------------- + // timestamp_t -> int64 (base chain: timestamp_t -> long_t) + // Fixture: api_activity.time + // ---------------------------------------------------------------- + { + name: "timestamp_t -> int64", + attr: deref(t, apiActivity, "time"), + want: gen.ProtoType{Scalar: "int64"}, + }, + + // ---------------------------------------------------------------- + // string_t -> string (base type, no chain) + // Fixture: api_activity.action + // ---------------------------------------------------------------- + { + name: "string_t -> string", + attr: deref(t, apiActivity, "action"), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // integer_t -> int32 (base type) + // Fixture: api_activity.action_id + // ---------------------------------------------------------------- + { + name: "integer_t -> int32", + attr: deref(t, apiActivity, "action_id"), + want: gen.ProtoType{Scalar: "int32"}, + }, + + // ---------------------------------------------------------------- + // long_t -> int64 (base type) + // Fixture: api_activity.type_uid + // ---------------------------------------------------------------- + { + name: "long_t -> int64", + attr: deref(t, apiActivity, "type_uid"), + want: gen.ProtoType{Scalar: "int64"}, + }, + + // ---------------------------------------------------------------- + // boolean_t -> bool (base type) + // Fixture: api_activity.is_alert + // ---------------------------------------------------------------- + { + name: "boolean_t -> bool", + attr: deref(t, apiActivity, "is_alert"), + want: gen.ProtoType{Scalar: "bool"}, + }, + + // ---------------------------------------------------------------- + // datetime_t -> string (base chain: datetime_t -> string_t) + // Fixture: api_activity.end_time_dt + // ---------------------------------------------------------------- + { + name: "datetime_t -> string", + attr: deref(t, apiActivity, "end_time_dt"), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // object_t / object_type=actor -> Message "actor" + // Fixture: api_activity.actor + // ---------------------------------------------------------------- + { + name: "object_t/actor -> Message", + attr: deref(t, apiActivity, "actor"), + want: gen.ProtoType{Message: "actor"}, + }, + + // ---------------------------------------------------------------- + // object_t is_array=true -> Repeated Message + // Fixture: api_activity.authorizations + // ---------------------------------------------------------------- + { + name: "object_t is_array -> Repeated Message", + attr: deref(t, apiActivity, "authorizations"), + want: gen.ProtoType{Message: "authorization", Repeated: true}, + }, + + // ---------------------------------------------------------------- + // object_t is_array=true (another array case) + // Fixture: api_activity.observables + // ---------------------------------------------------------------- + { + name: "observables is_array -> Repeated Message", + attr: deref(t, apiActivity, "observables"), + want: gen.ProtoType{Message: "observable", Repeated: true}, + }, + + // ---------------------------------------------------------------- + // unmapped -> object_type="object" (the generic OCSF Object). + // The generic "object" type represents an unordered bag of arbitrary + // attributes — equivalent to a free-form JSON object. We map it to + // google.protobuf.Value so generated protos can hold arbitrary payloads. + // Fixture: api_activity.unmapped + // ---------------------------------------------------------------- + { + name: "unmapped generic object -> WellKnown Value", + attr: deref(t, apiActivity, "unmapped"), + want: gen.ProtoType{WellKnown: "google.protobuf.Value"}, + }, + + // ---------------------------------------------------------------- + // ip_t -> string (base chain: ip_t -> string_t) + // Fixture: network_endpoint.ip + // ---------------------------------------------------------------- + { + name: "ip_t -> string", + attr: deref(t, networkEndpoint, "ip"), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // mac_t -> string (base chain: mac_t -> string_t) + // Fixture: network_endpoint.mac + // ---------------------------------------------------------------- + { + name: "mac_t -> string", + attr: deref(t, networkEndpoint, "mac"), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // port_t -> int32 (base chain: port_t -> integer_t) + // Fixture: network_endpoint.port + // ---------------------------------------------------------------- + { + name: "port_t -> int32", + attr: deref(t, networkEndpoint, "port"), + want: gen.ProtoType{Scalar: "int32"}, + }, + + // ---------------------------------------------------------------- + // ip_t is_array=true -> Repeated string + // Fixture: network_endpoint.intermediate_ips + // ---------------------------------------------------------------- + { + name: "ip_t is_array -> Repeated string", + attr: deref(t, networkEndpoint, "intermediate_ips"), + want: gen.ProtoType{Scalar: "string", Repeated: true}, + }, + + // ---------------------------------------------------------------- + // hostname_t -> string (base chain: hostname_t -> string_t) + // Fixture: network_endpoint.hostname + // ---------------------------------------------------------------- + { + name: "hostname_t -> string", + attr: deref(t, networkEndpoint, "hostname"), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // float_t -> double (base type) + // Fixture: location.lat + // ---------------------------------------------------------------- + { + name: "float_t -> double", + attr: deref(t, location, "lat"), + want: gen.ProtoType{Scalar: "double"}, + }, + + // ---------------------------------------------------------------- + // float_t is_array=true -> Repeated double + // Fixture: location.coordinates + // ---------------------------------------------------------------- + { + name: "float_t is_array -> Repeated double", + attr: deref(t, location, "coordinates"), + want: gen.ProtoType{Scalar: "double", Repeated: true}, + }, + + // ---------------------------------------------------------------- + // json_t -> google.protobuf.Value (base type, no chain) + // Fixture: enrichment.data + // ---------------------------------------------------------------- + { + name: "json_t -> WellKnown Value", + attr: deref(t, enrichment, "data"), + want: gen.ProtoType{WellKnown: "google.protobuf.Value"}, + }, + + // ---------------------------------------------------------------- + // uuid_t -> string (base chain: uuid_t -> string_t) + // Synthetic: uuid_t does not appear on the classes above but is a + // common derived string type that must follow the chain rule. + // ---------------------------------------------------------------- + { + name: "uuid_t -> string (synthetic)", + attr: syn("uuid_t", "", false), + want: gen.ProtoType{Scalar: "string"}, + }, + + // ---------------------------------------------------------------- + // Error case: unknown type + // ---------------------------------------------------------------- + { + name: "unknown type -> error", + attr: syn("totally_unknown_t", "", false), + wantErr: true, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + got, err := gen.MapType(s, tc.attr) + if tc.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.Equal(t, tc.want, got) + }) + } +} From 52494fbb7ff0d61903e33278cd00aa815a58bee1 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:08:49 +0200 Subject: [PATCH 03/26] feat(ocsf): add stable proto field-number map with compat check Append-only (message,attribute)->tag map: lowest-free allocation skipping the 19000-19999 proto-reserved range, retire-to-reserved so tags are never reused, load-time validation (positive tags, no dupes, no reserved-range tags), and CheckCompat rejecting changed, dropped-unreserved, reused-reserved, or un-reserved tags. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/internal/ocsf/tagmap/tagmap.go | 485 ++++++++++++++++++++ ocsf/internal/ocsf/tagmap/tagmap_test.go | 557 +++++++++++++++++++++++ 2 files changed, 1042 insertions(+) create mode 100644 ocsf/internal/ocsf/tagmap/tagmap.go create mode 100644 ocsf/internal/ocsf/tagmap/tagmap_test.go diff --git a/ocsf/internal/ocsf/tagmap/tagmap.go b/ocsf/internal/ocsf/tagmap/tagmap.go new file mode 100644 index 0000000..19a9128 --- /dev/null +++ b/ocsf/internal/ocsf/tagmap/tagmap.go @@ -0,0 +1,485 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package tagmap maintains the stable (message, attribute) → proto field-number +// map that the OCSF-to-proto generator uses when emitting .proto files. +// +// # Why this matters +// +// Proto field numbers must never change once a schema is deployed: a renumbering +// silently corrupts every stored or in-flight record. OCSF carries no field +// numbers, so we maintain our own append-only map. The generator calls Assign +// for every field it emits; CI calls CheckCompat to reject any incompatible +// change before it merges. +// +// # On-disk format +// +// The map is a JSON file with deterministic (sorted) keys: +// +// { +// "ApiActivity": { +// "fields": {"action": 3, "class_uid": 2, "time": 1}, +// "reserved": [7, 9] +// }, +// "User": { +// "fields": {"name": 1}, +// "reserved": [] +// } +// } +// +// Message names are sorted lexicographically; within each message, attribute +// names in "fields" are sorted and "reserved" tags are sorted numerically. +// This guarantees that two Save calls on the same in-memory state produce +// byte-identical files. +// +// # Pre-seeding +// +// Hot base-event attributes can be pre-assigned to low tags (1–15) simply by +// loading a hand-crafted seed file before the generator runs. Assign returns +// the existing tag when the attr is already present, so the seed values are +// preserved. +// +// # Free-tag allocation +// +// Assign picks the lowest positive integer that is: +// - not already assigned to another attr in the same message, +// - not in the message's reserved list, and +// - not in the proto-reserved range [19000, 19999] inclusive. +// +// Tags start at 1. +package tagmap + +import ( + "encoding/json" + "errors" + "fmt" + "os" + "path/filepath" + "sort" + "strings" +) + +// protoReservedLo and protoReservedHi are the inclusive bounds of the range +// that proto3 reserves for its own extensions. Tags in this range must never +// be assigned. +const ( + protoReservedLo = int32(19000) + protoReservedHi = int32(19999) +) + +// MessageTags holds the tag assignments and retired-tag list for one proto message. +type MessageTags struct { + // Fields maps attribute name to its assigned proto field number. + Fields map[string]int32 `json:"fields"` + // Reserved holds retired tags that must never be re-assigned. + Reserved []int32 `json:"reserved"` +} + +// TagMap is the top-level map from proto message name to its tag assignments. +// It is the in-memory representation of the on-disk JSON file. +type TagMap struct { + messages map[string]*MessageTags +} + +// New returns an empty TagMap ready for use. +func New() *TagMap { + return &TagMap{messages: make(map[string]*MessageTags)} +} + +// --------------------------------------------------------------------------- +// Persistence +// --------------------------------------------------------------------------- + +// jsonTagMap is the wire type used for JSON serialisation. +type jsonTagMap map[string]*jsonMessageTags + +type jsonMessageTags struct { + Fields map[string]int32 `json:"fields"` + Reserved []int32 `json:"reserved"` +} + +// Load parses the tag-map JSON from path. +// +// A missing or empty file is not an error: it returns a new empty TagMap so +// that the first generator run bootstraps the map from scratch. +func Load(path string) (*TagMap, error) { + data, err := os.ReadFile(filepath.Clean(path)) + if err != nil { + if errors.Is(err, os.ErrNotExist) { + return New(), nil + } + return nil, fmt.Errorf("tagmap: read %q: %w", path, err) + } + if strings.TrimSpace(string(data)) == "" { + return New(), nil + } + + var wire jsonTagMap + if err := json.Unmarshal(data, &wire); err != nil { + return nil, fmt.Errorf("tagmap: decode %q: %w", path, err) + } + + tm := New() + for msg, wm := range wire { + mt := &MessageTags{ + Fields: make(map[string]int32, len(wm.Fields)), + Reserved: make([]int32, len(wm.Reserved)), + } + for attr, tag := range wm.Fields { + mt.Fields[attr] = tag + } + copy(mt.Reserved, wm.Reserved) + tm.messages[msg] = mt + } + + if err := tm.validate(); err != nil { + return nil, err + } + return tm, nil +} + +// Save writes the tag map to path with deterministic output. +func (tm *TagMap) Save(path string) error { + // Build a sorted list of message names. + msgNames := make([]string, 0, len(tm.messages)) + for name := range tm.messages { + msgNames = append(msgNames, name) + } + sort.Strings(msgNames) + + // Use an ordered encoding: encode each message in key order by building + // the JSON manually through encoding/json with sorted intermediaries. + // + // We use a two-pass approach: marshal into a plain map with sorted keys, + // relying on encoding/json's map key sorting (Go 1.12+: json.Marshal + // sorts map keys lexicographically), then do the same for fields. + wire := make(jsonTagMap, len(tm.messages)) + for _, name := range msgNames { + mt := tm.messages[name] + + // Sort reserved. + reserved := make([]int32, len(mt.Reserved)) + copy(reserved, mt.Reserved) + sort.Slice(reserved, func(i, j int) bool { return reserved[i] < reserved[j] }) + + // Fields map — encoding/json sorts string map keys, so just copy. + fields := make(map[string]int32, len(mt.Fields)) + for k, v := range mt.Fields { + fields[k] = v + } + + wire[name] = &jsonMessageTags{ + Fields: fields, + Reserved: reserved, + } + } + + // encoding/json sorts map[string]* keys, so the top-level message order + // is already lexicographic. Marshal with indent for human readability. + out, err := json.MarshalIndent(wire, "", " ") + if err != nil { + return fmt.Errorf("tagmap: marshal: %w", err) + } + out = append(out, '\n') + + if err := os.WriteFile(path, out, 0o600); err != nil { + return fmt.Errorf("tagmap: write %q: %w", path, err) + } + return nil +} + +// --------------------------------------------------------------------------- +// Tag lookup and allocation +// --------------------------------------------------------------------------- + +// Tag returns the assigned proto field number for (message, attr). +// The second return value is false if no tag has been assigned yet. +func (tm *TagMap) Tag(message, attr string) (int32, bool) { + mt, ok := tm.messages[message] + if !ok { + return 0, false + } + tag, ok := mt.Fields[attr] + return tag, ok +} + +// Assign returns the existing tag for (message, attr) if one is already +// recorded; otherwise it allocates the lowest free tag and records it. +// +// "Free" means the tag is not currently assigned to any attr in the message, +// not in the message's reserved list, and not in the proto-reserved range +// 19000–19999 inclusive. Tags start at 1. +func (tm *TagMap) Assign(message, attr string) (int32, error) { + mt := tm.getOrCreate(message) + + // Return existing tag if already assigned. + if tag, ok := mt.Fields[attr]; ok { + return tag, nil + } + + // Build a set of all occupied tags for this message. + occupied := make(map[int32]bool, len(mt.Fields)+len(mt.Reserved)) + for _, t := range mt.Fields { + occupied[t] = true + } + for _, t := range mt.Reserved { + occupied[t] = true + } + + // Find the lowest free tag starting at 1. + var tag int32 = 1 + for { + if tag >= protoReservedLo && tag <= protoReservedHi { + // Jump over the entire reserved range in one step. + tag = protoReservedHi + 1 + continue + } + if !occupied[tag] { + break + } + tag++ + } + + mt.Fields[attr] = tag + return tag, nil +} + +// Retire removes attr's assignment from (message) and adds its former tag to +// the message's reserved list so it can never be reused. +// +// Retire is idempotent: calling it on an already-retired or never-assigned +// attr is a no-op. +func (tm *TagMap) Retire(message, attr string) error { + mt, ok := tm.messages[message] + if !ok { + return nil + } + + tag, assigned := mt.Fields[attr] + if !assigned { + return nil + } + + // Remove from fields. + delete(mt.Fields, attr) + + // Add to reserved if not already there. + for _, r := range mt.Reserved { + if r == tag { + return nil + } + } + mt.Reserved = append(mt.Reserved, tag) + return nil +} + +// --------------------------------------------------------------------------- +// Compatibility check +// --------------------------------------------------------------------------- + +// CheckCompat reports every incompatibility between old and new TagMaps. +// +// Incompatibilities detected: +// +// 1. A (message, attr) whose tag changed between old and new. +// 2. A tag that was assigned in old but is neither assigned to the same attr +// nor reserved in new (silently dropped without reserving). +// 3. A tag that was listed in old.reserved but is now assigned to some attr +// in new (reserved tag reused). +// 4. A tag that was listed in old.reserved but is absent from new.reserved +// (reservation dropped — reopens the tag for reuse against old decoders). +// +// Compatible changes (new attrs, new messages, new reserved entries) do not +// produce errors. +func CheckCompat(old, next *TagMap) error { + var errs []string + + for msg, oldMT := range old.messages { + newMT, msgExists := next.messages[msg] + checkAttrTags(msg, oldMT, newMT, msgExists, &errs) + if msgExists { + checkReservedReuse(msg, oldMT, newMT, &errs) + checkUnreserved(msg, oldMT, newMT, &errs) + } + } + + if len(errs) == 0 { + return nil + } + sort.Strings(errs) // deterministic error order + return fmt.Errorf("tagmap: compatibility check failed:\n %s", strings.Join(errs, "\n ")) +} + +// checkAttrTags checks that no tag changed and no tag was dropped without reserving. +func checkAttrTags(msg string, oldMT, newMT *MessageTags, msgExists bool, errs *[]string) { + for attr, oldTag := range oldMT.Fields { + if !msgExists { + *errs = append(*errs, fmt.Sprintf( + "message %q attr %q had tag %d in old map but message is absent in new map (tag not reserved)", + msg, attr, oldTag)) + continue + } + + newTag, inNew := newMT.Fields[attr] + if inNew { + // Attr still assigned — tag must not have changed. + if newTag != oldTag { + *errs = append(*errs, fmt.Sprintf( + "message %q attr %q tag changed: old=%d new=%d", + msg, attr, oldTag, newTag)) + } + // No further check needed: tag is still owned by this attr. + continue + } + + // Attr is no longer assigned in new — the old tag must be reserved. + if !containsTag(newMT.Reserved, oldTag) { + *errs = append(*errs, fmt.Sprintf( + "message %q attr %q (tag %d) was dropped from new map without being reserved", + msg, attr, oldTag)) + } + } +} + +// checkReservedReuse checks that no reserved tag was reused for a new attr. +func checkReservedReuse(msg string, oldMT, newMT *MessageTags, errs *[]string) { + for _, oldReserved := range oldMT.Reserved { + for newAttr, newTag := range newMT.Fields { + if newTag == oldReserved { + *errs = append(*errs, fmt.Sprintf( + "message %q attr %q (tag %d) reuses a tag from old reserved list", + msg, newAttr, newTag)) + } + } + } +} + +// checkUnreserved checks that every tag in old.Reserved is still reserved in +// new. Dropping a reservation reopens the tag for allocation, which would +// silently reuse a wire number that old decoders still associate with a +// retired field. +func checkUnreserved(msg string, oldMT, newMT *MessageTags, errs *[]string) { + for _, oldReserved := range oldMT.Reserved { + if !containsTag(newMT.Reserved, oldReserved) { + *errs = append(*errs, fmt.Sprintf( + "message %q reserved tag %d was removed (must remain reserved forever)", + msg, oldReserved)) + } + } +} + +// --------------------------------------------------------------------------- +// Internal helpers +// --------------------------------------------------------------------------- + +// validate checks the in-memory state for structural violations and returns a +// combined error naming every offending (message, attr/tag) pair. +// +// Rules: +// - Every field tag must be > 0. +// - Every reserved tag must be > 0. +// - No two fields within the same message may share a tag. +// - A field's tag must not also appear in that message's reserved list. +func (tm *TagMap) validate() error { + var errs []string + + // Iterate in a deterministic order so error messages are stable. + msgNames := make([]string, 0, len(tm.messages)) + for name := range tm.messages { + msgNames = append(msgNames, name) + } + sort.Strings(msgNames) + + for _, msg := range msgNames { + mt := tm.messages[msg] + + // Build reserved set for quick lookup and validate reserved values. + reservedSet := make(map[int32]bool, len(mt.Reserved)) + for _, r := range mt.Reserved { + if r <= 0 { + errs = append(errs, fmt.Sprintf( + "message %q has invalid reserved tag %d (must be > 0)", msg, r)) + continue + } + if r >= protoReservedLo && r <= protoReservedHi { + errs = append(errs, fmt.Sprintf( + "message %q has reserved tag %d in proto-reserved range [%d, %d]", + msg, r, protoReservedLo, protoReservedHi)) + continue + } + reservedSet[r] = true + } + + // Track seen field tags to detect duplicates. + seenTags := make(map[int32]string, len(mt.Fields)) + + // Sort attr names for deterministic error output. + attrNames := make([]string, 0, len(mt.Fields)) + for attr := range mt.Fields { + attrNames = append(attrNames, attr) + } + sort.Strings(attrNames) + + for _, attr := range attrNames { + tag := mt.Fields[attr] + + if tag <= 0 { + errs = append(errs, fmt.Sprintf( + "message %q attr %q has invalid tag %d (must be > 0)", msg, attr, tag)) + continue + } + + if tag >= protoReservedLo && tag <= protoReservedHi { + errs = append(errs, fmt.Sprintf( + "message %q attr %q has tag %d in proto-reserved range [%d, %d]", + msg, attr, tag, protoReservedLo, protoReservedHi)) + continue + } + + if prev, dup := seenTags[tag]; dup { + errs = append(errs, fmt.Sprintf( + "message %q attrs %q and %q share tag %d (duplicate)", msg, prev, attr, tag)) + } else { + seenTags[tag] = attr + } + + if reservedSet[tag] { + errs = append(errs, fmt.Sprintf( + "message %q attr %q tag %d also appears in reserved list", msg, attr, tag)) + } + } + } + + if len(errs) == 0 { + return nil + } + sort.Strings(errs) + return fmt.Errorf("tagmap: invalid tag map:\n %s", strings.Join(errs, "\n ")) +} + +func (tm *TagMap) getOrCreate(message string) *MessageTags { + mt, ok := tm.messages[message] + if !ok { + mt = &MessageTags{ + Fields: make(map[string]int32), + Reserved: nil, + } + tm.messages[message] = mt + } + return mt +} + +func containsTag(reserved []int32, tag int32) bool { + for _, r := range reserved { + if r == tag { + return true + } + } + return false +} diff --git a/ocsf/internal/ocsf/tagmap/tagmap_test.go b/ocsf/internal/ocsf/tagmap/tagmap_test.go new file mode 100644 index 0000000..c75266c --- /dev/null +++ b/ocsf/internal/ocsf/tagmap/tagmap_test.go @@ -0,0 +1,557 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package tagmap_test + +import ( + "bytes" + "encoding/json" + "os" + "path/filepath" + "strconv" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// TestRoundTrip verifies that an existing attribute keeps its tag across a +// Save → Load cycle and that the loaded map equals the original. +func TestRoundTrip(t *testing.T) { + tm := tagmap.New() + + tag, err := tm.Assign("ApiActivity", "time") + require.NoError(t, err) + require.Equal(t, int32(1), tag) + + tag2, err := tm.Assign("ApiActivity", "class_uid") + require.NoError(t, err) + require.Equal(t, int32(2), tag2) + + dir := t.TempDir() + path := filepath.Join(dir, "tags.json") + + require.NoError(t, tm.Save(path)) + + loaded, err := tagmap.Load(path) + require.NoError(t, err) + + // Existing attr keeps its tag. + gotTime, ok := loaded.Tag("ApiActivity", "time") + require.True(t, ok) + require.Equal(t, int32(1), gotTime) + + gotUID, ok := loaded.Tag("ApiActivity", "class_uid") + require.True(t, ok) + require.Equal(t, int32(2), gotUID) + + // Assign on loaded map returns the same tag, not a new one. + reassigned, err := loaded.Assign("ApiActivity", "time") + require.NoError(t, err) + require.Equal(t, int32(1), reassigned) +} + +// TestLoadMissing verifies that Load of a missing file returns an empty map, +// not an error (bootstrap behaviour for first run). +func TestLoadMissing(t *testing.T) { + dir := t.TempDir() + tm, err := tagmap.Load(filepath.Join(dir, "nonexistent.json")) + require.NoError(t, err) + require.NotNil(t, tm) + + // Empty map — Tag returns not-found. + _, ok := tm.Tag("ApiActivity", "time") + require.False(t, ok) +} + +// TestAssignLowestFreeTag verifies that Assign returns the lowest free tag, +// skipping already-assigned tags and reserved tags. +func TestAssignLowestFreeTag(t *testing.T) { + tm := tagmap.New() + + // First assignment on an empty message gets tag 1. + tag, err := tm.Assign("Msg", "a") + require.NoError(t, err) + require.Equal(t, int32(1), tag) + + // Second gets tag 2. + tag, err = tm.Assign("Msg", "b") + require.NoError(t, err) + require.Equal(t, int32(2), tag) + + // Retire "a" (tag 1). Its tag moves to reserved. + require.NoError(t, tm.Retire("Msg", "a")) + + // Next new attr gets the lowest free, skipping reserved 1. + tag, err = tm.Assign("Msg", "c") + require.NoError(t, err) + require.Equal(t, int32(3), tag, "must skip reserved tag 1") +} + +// TestAssignSkipsReservedRange verifies that Assign skips the proto reserved +// range 19000–19999 (inclusive) and resumes at 20000. +// +// We pre-seed a map via Save→Load with tags 1..18999 already assigned, then +// ask for one more. This avoids 18999 individual Assign calls and keeps the +// test fast. +func TestAssignSkipsReservedRange(t *testing.T) { + // Build the seed JSON by hand: fields 1..18999. + // We marshal directly to avoid the slow iterative Assign path. + fields := make(map[string]int32, 18999) + for i := 1; i <= 18999; i++ { + fields["field_"+strconv.Itoa(i)] = int32(i) + } + + dir := t.TempDir() + path := filepath.Join(dir, "big.json") + + type msgJSON struct { + Fields map[string]int32 `json:"fields"` + Reserved []int32 `json:"reserved"` + } + seed := map[string]*msgJSON{ + "BigMsg": {Fields: fields, Reserved: nil}, + } + + enc, err := json.MarshalIndent(seed, "", " ") + require.NoError(t, err) + require.NoError(t, os.WriteFile(path, enc, 0o600)) + + tm, err := tagmap.Load(path) + require.NoError(t, err) + + // Verify a known tag loaded correctly. + lastTag, ok := tm.Tag("BigMsg", "field_18999") + require.True(t, ok) + require.Equal(t, int32(18999), lastTag) + + // The next assignment must skip 19000–19999 and land on 20000. + tag, err := tm.Assign("BigMsg", "field_after_range") + require.NoError(t, err) + require.Equal(t, int32(20000), tag, "must skip the proto reserved range 19000–19999") +} + +// TestRetireMovesToReserved verifies that Retire removes the attribute from +// the field map, adds its tag to reserved, and that a subsequent Assign of a +// new attribute does not reuse the retired tag. +func TestRetireMovesToReserved(t *testing.T) { + tm := tagmap.New() + + _, err := tm.Assign("Evt", "x") + require.NoError(t, err) // tag 1 + _, err = tm.Assign("Evt", "y") + require.NoError(t, err) // tag 2 + _, err = tm.Assign("Evt", "z") + require.NoError(t, err) // tag 3 + + // Retire y (tag 2). + require.NoError(t, tm.Retire("Evt", "y")) + + // y is gone from Tag lookups. + _, ok := tm.Tag("Evt", "y") + require.False(t, ok) + + // A new attr gets tag 4, not 2 (reserved). + tag, err := tm.Assign("Evt", "w") + require.NoError(t, err) + require.Equal(t, int32(4), tag) +} + +// TestRetireIdempotent verifies that Retire is idempotent: calling it on an +// already-retired (or never-assigned) attr is a no-op, not an error. +func TestRetireIdempotent(t *testing.T) { + tm := tagmap.New() + + _, err := tm.Assign("Msg", "a") + require.NoError(t, err) + + require.NoError(t, tm.Retire("Msg", "a")) + // Second Retire on same attr should not error. + require.NoError(t, tm.Retire("Msg", "a")) + // Retire on never-assigned attr. + require.NoError(t, tm.Retire("Msg", "never_assigned")) +} + +// TestCheckCompatTagChanged verifies that CheckCompat returns an error when a +// (message,attr) pair has a different tag in new vs old. +func TestCheckCompatTagChanged(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "time") + require.NoError(t, err) // tag 1 + + // Build a new map where "time" has tag 2 (simulating a renumbering bug). + newTM := tagmap.New() + _, err = newTM.Assign("Evt", "other") // tag 1 + require.NoError(t, err) + _, err = newTM.Assign("Evt", "time") // tag 2 — wrong + require.NoError(t, err) + + err = tagmap.CheckCompat(old, newTM) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + require.Contains(t, err.Error(), "time") +} + +// TestCheckCompatDroppedWithoutReserving verifies that CheckCompat returns an +// error when an old assigned tag is silently dropped (neither still assigned +// to the same attr nor reserved in new). +func TestCheckCompatDroppedWithoutReserving(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "action") + require.NoError(t, err) // tag 1 + + // New map omits "action" entirely and doesn't reserve tag 1. + newTM := tagmap.New() + _, err = newTM.Assign("Evt", "other_field") + require.NoError(t, err) // tag 1 reused — incompatible + + err = tagmap.CheckCompat(old, newTM) + require.Error(t, err) + require.Contains(t, err.Error(), "action") +} + +// TestCheckCompatReservedTagReused verifies that CheckCompat returns an error +// when a tag that was in old.reserved is now assigned to some attribute in new. +func TestCheckCompatReservedTagReused(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "gone") + require.NoError(t, err) // tag 1 + require.NoError(t, old.Retire("Evt", "gone")) + // Now tag 1 is in old.reserved. + + // New map re-assigns tag 1 to a different attr — incompatible. + newTM := tagmap.New() + _, err = newTM.Assign("Evt", "new_field") + require.NoError(t, err) // tag 1 — reuses reserved tag + + err = tagmap.CheckCompat(old, newTM) + require.Error(t, err) + require.Contains(t, err.Error(), "new_field") +} + +// TestCheckCompatAdditiveIsOK verifies that purely additive changes (new +// attributes, new messages, new reserved entries) are compatible. +func TestCheckCompatAdditiveIsOK(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "time") + require.NoError(t, err) // tag 1 + _, err = old.Assign("Evt", "action") + require.NoError(t, err) // tag 2 + + // New map keeps existing tags and adds more. + newTM := tagmap.New() + _, err = newTM.Assign("Evt", "time") + require.NoError(t, err) // tag 1 same + _, err = newTM.Assign("Evt", "action") + require.NoError(t, err) // tag 2 same + _, err = newTM.Assign("Evt", "severity_id") + require.NoError(t, err) // tag 3 — new attr + + // New message entirely. + _, err = newTM.Assign("User", "name") + require.NoError(t, err) + + require.NoError(t, tagmap.CheckCompat(old, newTM)) +} + +// TestCheckCompatNewReservedIsOK verifies that adding a new entry to reserved +// in new (without touching existing assignments) is a compatible change. +func TestCheckCompatNewReservedIsOK(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "time") + require.NoError(t, err) // tag 1 + _, err = old.Assign("Evt", "action") + require.NoError(t, err) // tag 2 + + // new retires "action" — adds 2 to reserved, removes it from fields. + newTM := tagmap.New() + _, err = newTM.Assign("Evt", "time") + require.NoError(t, err) // tag 1 same + _, err = newTM.Assign("Evt", "action") + require.NoError(t, err) // tag 2 + require.NoError(t, newTM.Retire("Evt", "action")) + + // "action" was in old assigned — it's now retired in new, which is + // compatible: the tag (2) is still tracked (reserved). + require.NoError(t, tagmap.CheckCompat(old, newTM)) +} + +// TestSaveDeterministic verifies that Save produces byte-identical output +// across two calls on the same map, including when reserved entries are present. +func TestSaveDeterministic(t *testing.T) { + tm := tagmap.New() + + // Add fields in non-alphabetical order to test sorting. + for _, attr := range []string{"zebra", "apple", "mango"} { + _, err := tm.Assign("Fruit", attr) + require.NoError(t, err) + } + for _, attr := range []string{"z_msg", "a_msg"} { + _, err := tm.Assign("Veggie", attr) + require.NoError(t, err) + } + + // Retire an attr so the sorted-reserved output path is exercised. + require.NoError(t, tm.Retire("Fruit", "zebra")) + require.NoError(t, tm.Retire("Veggie", "z_msg")) + + dir := t.TempDir() + path1 := filepath.Join(dir, "tags1.json") + path2 := filepath.Join(dir, "tags2.json") + + require.NoError(t, tm.Save(path1)) + require.NoError(t, tm.Save(path2)) + + b1, err := os.ReadFile(path1) + require.NoError(t, err) + b2, err := os.ReadFile(path2) + require.NoError(t, err) + + require.True(t, bytes.Equal(b1, b2), "Save output must be byte-deterministic") +} + +// TestMultipleMessages verifies that tag allocation is per-message: two +// different messages each start from tag 1 independently. +func TestMultipleMessages(t *testing.T) { + tm := tagmap.New() + + tag, err := tm.Assign("Msg1", "field") + require.NoError(t, err) + require.Equal(t, int32(1), tag) + + tag, err = tm.Assign("Msg2", "field") + require.NoError(t, err) + require.Equal(t, int32(1), tag, "each message has its own tag space") +} + +// TestLoadEmptyFile verifies that an existing but empty file is treated as an +// empty map, not an error. +func TestLoadEmptyFile(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "empty.json") + require.NoError(t, os.WriteFile(path, []byte(""), 0o600)) + + tm, err := tagmap.Load(path) + require.NoError(t, err) + require.NotNil(t, tm) +} + +// TestLoadRejectsZeroFieldTag verifies that Load returns a descriptive error +// when a field tag is 0 (or negative), naming the offending message and attr. +func TestLoadRejectsZeroFieldTag(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "bad.json") + + raw := `{ + "Evt": { + "fields": {"action": 0, "time": 1}, + "reserved": [] + } +}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + require.Contains(t, err.Error(), "action") +} + +// TestLoadRejectsDuplicateTag verifies that Load returns a descriptive error +// when two fields in the same message share the same tag. +func TestLoadRejectsDuplicateTag(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "dup.json") + + // JSON doesn't normally allow duplicate keys in a single object, but we can + // craft a collision via two different attr names pointing at the same number. + raw := `{ + "Evt": { + "fields": {"action": 2, "time": 2}, + "reserved": [] + } +}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + // The error must mention tag 2. + require.Contains(t, err.Error(), "2") +} + +// TestLoadRejectsFieldTagInReserved verifies that Load returns an error when a +// field's tag also appears in that message's reserved list. +func TestLoadRejectsFieldTagInReserved(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "conflict.json") + + raw := `{ + "Evt": { + "fields": {"action": 3}, + "reserved": [1, 3, 5] + } +}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + require.Contains(t, err.Error(), "action") +} + +// TestLoadRejectsZeroReservedTag verifies that Load returns an error when a +// reserved entry is <= 0, naming the offending message. +func TestLoadRejectsZeroReservedTag(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "badreserved.json") + + raw := `{ + "Evt": { + "fields": {"time": 1}, + "reserved": [0] + } +}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") +} + +// TestCheckCompatMultipleOffenders verifies that CheckCompat collects ALL +// incompatibilities and returns them in a single error rather than stopping +// at the first one found. +func TestCheckCompatMultipleOffenders(t *testing.T) { + old := tagmap.New() + _, err := old.Assign("Evt", "time") + require.NoError(t, err) // tag 1 + _, err = old.Assign("Evt", "action") + require.NoError(t, err) // tag 2 + // Also retire tag 5 so we can test reserved-tag reuse. + _, err = old.Assign("Evt", "gone") + require.NoError(t, err) // tag 3 + require.NoError(t, old.Retire("Evt", "gone")) + // Now old: fields={time:1, action:2}, reserved=[3] + + // Build a new map with two simultaneous incompatibilities: + // 1. "time" has tag 99 instead of 1 (tag changed). + // 2. "action" has tag 2 but a new attr "new_field" gets tag 3, + // reusing the reserved tag. + // We build the new map by direct JSON seed to control exact tag values. + var newTM *tagmap.TagMap + raw := `{ + "Evt": { + "fields": {"time": 99, "action": 2, "new_field": 3}, + "reserved": [] + } +}` + dir := t.TempDir() + seedPath := filepath.Join(dir, "seed.json") + require.NoError(t, os.WriteFile(seedPath, []byte(raw), 0o600)) + newTM, err = tagmap.Load(seedPath) + require.NoError(t, err) + + err = tagmap.CheckCompat(old, newTM) + require.Error(t, err) + + // Both offenders must appear in the single error string. + require.Contains(t, err.Error(), "time") // tag changed + require.Contains(t, err.Error(), "new_field") // reused reserved tag +} + +// TestLoadRejectsProtoReservedRangeTag verifies that Load returns an error when +// a field or reserved tag falls within the proto-reserved range 19000–19999. +func TestLoadRejectsProtoReservedRangeTag(t *testing.T) { + t.Run("field tag 19000", func(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "proto_range_field.json") + raw := `{"Evt":{"fields":{"bad":19000},"reserved":[]}}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + require.Contains(t, err.Error(), "19000") + }) + + t.Run("reserved tag 19500", func(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "proto_range_reserved.json") + raw := `{"Evt":{"fields":{},"reserved":[19500]}}` + require.NoError(t, os.WriteFile(path, []byte(raw), 0o600)) + + _, err := tagmap.Load(path) + require.Error(t, err) + require.Contains(t, err.Error(), "Evt") + require.Contains(t, err.Error(), "19500") + }) +} + +// TestCheckCompatUnreservedTagFails verifies that CheckCompat returns an error +// when a tag that was in old.Reserved is no longer reserved in new — even though +// no field was re-assigned to it yet. Removing a reservation reopens that tag +// for allocation, which would silently reuse a tag that old decoders still +// associate with a retired field. +func TestCheckCompatUnreservedTagFails(t *testing.T) { + // old: fields={a:1}, reserved=[2] + old := tagmap.New() + _, err := old.Assign("M", "a") + require.NoError(t, err) // tag 1 + _, err = old.Assign("M", "b") + require.NoError(t, err) // tag 2 + require.NoError(t, old.Retire("M", "b")) + // Now old: fields={a:1}, reserved=[2] + + // new: same fields, but reserved is empty — tag 2 reservation dropped. + newTM := tagmap.New() + _, err = newTM.Assign("M", "a") + require.NoError(t, err) // tag 1 + + err = tagmap.CheckCompat(old, newTM) + require.Error(t, err, "dropping a reservation must be an incompatibility") + // Error must name the message and the tag. + require.Contains(t, err.Error(), "M") + require.Contains(t, err.Error(), "2") +} + +// TestLoadSaveRoundTripByteIdentical verifies that Load → Save → Load → Save +// produces byte-identical output on both saves (no format drift). +func TestLoadSaveRoundTripByteIdentical(t *testing.T) { + // Build a map with fields and retired tags. + tm := tagmap.New() + _, err := tm.Assign("Evt", "time") + require.NoError(t, err) // tag 1 + _, err = tm.Assign("Evt", "action") + require.NoError(t, err) // tag 2 + _, err = tm.Assign("Evt", "gone") + require.NoError(t, err) // tag 3 + require.NoError(t, tm.Retire("Evt", "gone")) + _, err = tm.Assign("User", "name") + require.NoError(t, err) + + dir := t.TempDir() + pathA := filepath.Join(dir, "a.json") + pathB := filepath.Join(dir, "b.json") + + // First save. + require.NoError(t, tm.Save(pathA)) + + // Load it back, save to B. + loaded, err := tagmap.Load(pathA) + require.NoError(t, err) + require.NoError(t, loaded.Save(pathB)) + + bytesA, err := os.ReadFile(pathA) + require.NoError(t, err) + bytesB, err := os.ReadFile(pathB) + require.NoError(t, err) + + require.True(t, bytes.Equal(bytesA, bytesB), "Load→Save must be byte-identical to original Save") +} From 886e92d2931c3320e56d5b0401eb1b9bcbc4fb31 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:08:58 +0200 Subject: [PATCH 04/26] feat(ocsf): generate wire-stable proto3 from OCSF schema Deterministic proto3 emission: nested enums for int-keyed enums, stable field numbers via the tag map, protovalidate for required fields and at_least_one/just_one constraints, conditional well-known imports, and reporting of objects emitted as stubs. Unresolvable non-object types error rather than silently degrading. The proto package is the OCSF major version (ocsf.v1); minor bumps are additive within it. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/internal/ocsf/gen/emit.go | 543 +++ ocsf/internal/ocsf/gen/emit_test.go | 469 +++ .../ocsf/gen/testdata/golden/api_entity.proto | 3085 +++++++++++++++++ .../ocsf/gen/testdata/golden/buf.lock | 6 + .../ocsf/gen/testdata/golden/buf.yaml | 16 + 5 files changed, 4119 insertions(+) create mode 100644 ocsf/internal/ocsf/gen/emit.go create mode 100644 ocsf/internal/ocsf/gen/emit_test.go create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/buf.lock create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/buf.yaml diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go new file mode 100644 index 0000000..e939cb8 --- /dev/null +++ b/ocsf/internal/ocsf/gen/emit.go @@ -0,0 +1,543 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen + +import ( + "fmt" + "sort" + "strings" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// toPascalCase converts an OCSF snake_case name to PascalCase. +// "api_activity" → "ApiActivity", "user" → "User". +// +// Namespaced names (e.g. "win/win_service") have the namespace prefix stripped +// before conversion: "win/win_service" → "win_service" → "WinService". +// Slashes are not valid in proto message or enum names. +func toPascalCase(s string) string { + // Strip namespace prefix (everything up to and including the last '/'). + if idx := strings.LastIndex(s, "/"); idx >= 0 { + s = s[idx+1:] + } + parts := strings.Split(s, "_") + var b strings.Builder + for _, p := range parts { + if p == "" { + continue + } + b.WriteString(strings.ToUpper(p[:1]) + p[1:]) + } + return b.String() +} + +// SelectClosure returns the named classes (sorted by name) plus every object +// transitively referenced through attributes whose MapType yields a Message. +// +// Deterministic: classes and objects are each sorted by name. +// Returns an error if any named class does not exist in the schema. +func SelectClosure(s *schema.Schema, classNames []string) ([]schema.Class, []schema.Object, error) { + // Validate and collect requested classes. + classes := make([]schema.Class, 0, len(classNames)) + for _, name := range classNames { + cls, ok := s.Classes[name] + if !ok { + return nil, nil, fmt.Errorf("ocsf emit: class %q not found in schema", name) + } + classes = append(classes, *cls) + } + sort.Slice(classes, func(i, j int) bool { + return classes[i].Name < classes[j].Name + }) + + // Collect the transitive object closure using BFS. + visited := make(map[string]bool) + queue := []string{} + + // Seed with objects directly referenced by the selected classes. + for _, cls := range classes { + visitObjectAttrs(cls.Attributes, visited, &queue) + } + + // BFS over the object graph. + for len(queue) > 0 { + objName := queue[0] + queue = queue[1:] + + obj, ok := s.Objects[objName] + if !ok { + // Object referenced but not found; skip silently (schema integrity + // is the loader's responsibility). + continue + } + visitObjectAttrs(obj.Attributes, visited, &queue) + } + + // Sort object names for determinism. + objNames := make([]string, 0, len(visited)) + for name := range visited { + objNames = append(objNames, name) + } + sort.Strings(objNames) + + objects := make([]schema.Object, 0, len(objNames)) + for _, name := range objNames { + obj, ok := s.Objects[name] + if !ok { + continue + } + objects = append(objects, *obj) + } + + return classes, objects, nil +} + +// versionToPackage converts a semver string to a proto package suffix using +// only the major version component. "1.8.0" → "v1", "2.0.0" → "v2". +// +// Pre-release and build metadata are stripped before parsing (everything from +// the first '-' or '+'). This matches protobuf's versioning convention: the +// package is stable across minor/patch bumps, which only add fields. +func versionToPackage(version string) (string, error) { + // Strip pre-release and build metadata suffixes. + clean := version + if i := strings.IndexAny(clean, "-+"); i >= 0 { + clean = clean[:i] + } + + // Extract the major component (substring before the first '.'). + major := clean + if i := strings.Index(clean, "."); i >= 0 { + major = clean[:i] + } + + if major == "" { + return "", fmt.Errorf("ocsf emit: cannot parse major version from %q", version) + } + // Validate that major is numeric. + for _, c := range major { + if c < '0' || c > '9' { + return "", fmt.Errorf("ocsf emit: major version component %q is not numeric (version %q)", major, version) + } + } + + return "v" + major, nil +} + +// visitObjectAttrs adds unreachable object names from attrs to queue. +// Used by SelectClosure's BFS to collect the transitive object closure. +func visitObjectAttrs(attrs map[string]*schema.Attribute, visited map[string]bool, queue *[]string) { + for _, attr := range attrs { + if attr.Type == objectTypeName && attr.ObjectType != "" && attr.ObjectType != genericObject { + if !visited[attr.ObjectType] { + visited[attr.ObjectType] = true + *queue = append(*queue, attr.ObjectType) + } + } + } +} + +// detectImports determines which proto imports are needed by scanning all +// attributes across classes and objects. +// +// Attributes that resolveProtoType cannot resolve are skipped for import +// detection: an unresolvable type simply does not force any import, and the +// error will be surfaced when emitMessage processes the same attribute. +func detectImports(s *schema.Schema, classes []schema.Class, objects []schema.Object) (needStructProto, needValidateProto bool) { + checkAttrs := func(attrs map[string]*schema.Attribute, constraints *schema.Constraints) { + for _, attr := range attrs { + pt, err := resolveProtoType(s, *attr) + if err != nil { + // Skip: unresolvable attrs don't drive imports. + continue + } + if pt.WellKnown == wellKnownValueType { + needStructProto = true + } + if attr.Requirement == "required" { + needValidateProto = true + } + } + if constraints != nil && (len(constraints.AtLeastOne) > 0 || len(constraints.JustOne) > 0) { + needValidateProto = true + } + } + for i := range classes { + checkAttrs(classes[i].Attributes, classes[i].Constraints) + } + for i := range objects { + checkAttrs(objects[i].Attributes, objects[i].Constraints) + } + return needStructProto, needValidateProto +} + +// Emit produces a deterministic proto3 document from the named classes and +// their transitive object closure. +// +// version is embedded in the proto package name using only its major component: +// "1.8.0" → package ocsf.v1, "2.0.0" → package ocsf.v2. +// +// The caller owns tm and is responsible for calling tm.Save after Emit returns. +// Emit mutates tm by calling Assign for every field it emits. +// +// stubbed is the sorted, de-duplicated list of object names that were emitted +// as empty stub messages because they were referenced by attributes but absent +// from the schema snapshot. It is nil when no stubs were needed. Callers can +// use this to distinguish an expected partial-fixture gap from a loader bug. +func Emit(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version string) (proto string, stubbed []string, err error) { + classes, objects, err := SelectClosure(s, classNames) + if err != nil { + return "", nil, err + } + + // First pass: figure out which imports we need. + needStructProto, needValidateProto := detectImports(s, classes, objects) + + var sb strings.Builder + + // License / header comment. + sb.WriteString(`// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema ` + version + ` + +`) + + pkgSuffix, err := versionToPackage(version) + if err != nil { + return "", nil, err + } + + sb.WriteString(`syntax = "proto3";` + "\n\n") + sb.WriteString(`package ocsf.` + pkgSuffix + ";\n\n") + + // Imports (sorted). + var imports []string + if needStructProto { + imports = append(imports, `import "google/protobuf/struct.proto";`) + } + if needValidateProto { + imports = append(imports, `import "buf/validate/validate.proto";`) + } + sort.Strings(imports) + for _, imp := range imports { + sb.WriteString(imp + "\n") + } + if len(imports) > 0 { + sb.WriteString("\n") + } + + // Emit classes then objects, each sorted by name. + for i := range classes { + msg, emitErr := emitMessage(s, tm, toPascalCase(classes[i].Name), classes[i].Attributes, classes[i].Constraints) + if emitErr != nil { + return "", nil, fmt.Errorf("ocsf emit: class %q: %w", classes[i].Name, emitErr) + } + sb.WriteString(msg) + sb.WriteString("\n") + } + for i := range objects { + msg, emitErr := emitMessage(s, tm, toPascalCase(objects[i].Name), objects[i].Attributes, objects[i].Constraints) + if emitErr != nil { + return "", nil, fmt.Errorf("ocsf emit: object %q: %w", objects[i].Name, emitErr) + } + sb.WriteString(msg) + sb.WriteString("\n") + } + + // Emit stub messages for object types that are referenced but absent from + // the schema snapshot (e.g. profile-injected objects from a partial export). + stubs := collectStubs(s, classes, objects) + for _, stubName := range stubs { + sb.WriteString("// Stub: referenced object not present in this schema snapshot.\n") + sb.WriteString("message " + stubName + " {}\n\n") + } + + var stubbedNames []string + if len(stubs) > 0 { + stubbedNames = stubs + } + return sb.String(), stubbedNames, nil +} + +// resolveProtoType maps an attribute to its ProtoType, returning an error for +// unresolvable types. +// +// When MapType fails because an object is referenced but absent from the schema +// (profile-injected attributes in a partial snapshot), the attribute is treated +// as a forward-reference Message using the ObjectType name (nil error). This +// allows Emit to proceed and emit a syntactically valid proto file; stub +// messages are emitted for any such forward reference. +// +// For any other MapType failure (unknown scalar, type cycle), the error is +// returned so the caller can surface it rather than silently emitting an +// incorrect type. +func resolveProtoType(s *schema.Schema, attr schema.Attribute) (ProtoType, error) { + pt, err := MapType(s, attr) + if err != nil { + // object_t with an absent object: emit a stub Message reference. + if attr.Type == objectTypeName && attr.ObjectType != "" && attr.ObjectType != genericObject { + return ProtoType{ + Message: attr.ObjectType, + Repeated: attr.IsArray, + }, nil + } + return ProtoType{}, err + } + return pt, nil +} + +// collectStubs returns the set of object names that are referenced (as Message +// types) through attributes but are absent from the schema objects map. These +// need stub message declarations so the emitted proto compiles. +func collectStubs(s *schema.Schema, classes []schema.Class, objects []schema.Object) []string { + // Build the set of object names that will be emitted as messages. + emitted := make(map[string]bool, len(objects)) + for _, o := range objects { + emitted[toPascalCase(o.Name)] = true + } + + stubs := make(map[string]bool) + check := func(attrs map[string]*schema.Attribute) { + for _, attr := range attrs { + if attr.Type == objectTypeName && attr.ObjectType != "" && attr.ObjectType != genericObject { + if _, ok := s.Objects[attr.ObjectType]; !ok { + msgName := toPascalCase(attr.ObjectType) + if !emitted[msgName] { + stubs[msgName] = true + } + } + } + } + } + for i := range classes { + check(classes[i].Attributes) + } + for i := range objects { + check(objects[i].Attributes) + } + + result := make([]string, 0, len(stubs)) + for name := range stubs { + result = append(result, name) + } + sort.Strings(result) + return result +} + +// fieldSpec holds the resolved proto field information for a single attribute. +type fieldSpec struct { + tag int32 + // typeName is the exact string emitted in the .proto file: a proto3 scalar + // keyword ("string", "int64", etc.), a PascalCase message name, or a + // fully-qualified well-known type name ("google.protobuf.Value"). + typeName string + name string // proto field name (= OCSF attr name verbatim) + repeated bool + required bool + // enumName is non-empty when this field has a nested enum; it holds the + // PascalCase enum name (e.g. "ActivityId"). + enumName string +} + +// resolveFieldSpec builds a fieldSpec (and optional nested enum) for one attribute. +func resolveFieldSpec(s *schema.Schema, tm *tagmap.TagMap, msgName, attrName string, attr *schema.Attribute) (fieldSpec, *ProtoEnum, error) { + pt, err := resolveProtoType(s, *attr) + if err != nil { + return fieldSpec{}, nil, fmt.Errorf("attribute %q: %w", attrName, err) + } + + tag, err := tm.Assign(msgName, attrName) + if err != nil { + return fieldSpec{}, nil, fmt.Errorf("attribute %q: assign tag: %w", attrName, err) + } + + fs := fieldSpec{ + tag: tag, + name: attrName, + repeated: pt.Repeated, + required: attr.Requirement == "required", + } + + switch { + case pt.WellKnown != "": + fs.typeName = pt.WellKnown + case pt.Message != "": + fs.typeName = toPascalCase(pt.Message) + default: + // Scalar — check if this attribute has an int-keyed enum. + if len(attr.Enum) > 0 { + enumName := toPascalCase(attrName) + pe, isProtoEnum, enumErr := MapEnum(enumName, attr.Enum) + if enumErr != nil { + return fieldSpec{}, nil, fmt.Errorf("attribute %q: map enum: %w", attrName, enumErr) + } + if isProtoEnum { + fs.typeName = enumName + fs.enumName = enumName + return fs, &pe, nil + } + // String-keyed enum: emit as string. + fs.typeName = "string" + } else { + fs.typeName = pt.Scalar + } + } + + return fs, nil, nil +} + +// emitMessage generates one proto message block for the given message name, +// attribute map, and optional constraints. +func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[string]*schema.Attribute, constraints *schema.Constraints) (string, error) { + // Sort attribute names for determinism during tag assignment. + attrNames := make([]string, 0, len(attrs)) + for name := range attrs { + attrNames = append(attrNames, name) + } + sort.Strings(attrNames) + + // Resolve each attribute and assign tags. + fields := make([]fieldSpec, 0, len(attrNames)) + // Collect nested enums keyed by enum name (in case duplicates arise). + nestedEnums := make(map[string]ProtoEnum) + + for _, attrName := range attrNames { + fs, pe, err := resolveFieldSpec(s, tm, msgName, attrName, attrs[attrName]) + if err != nil { + return "", err + } + if pe != nil { + nestedEnums[fs.enumName] = *pe + } + fields = append(fields, fs) + } + + // Sort nested enum names for deterministic output. + enumNames := make([]string, 0, len(nestedEnums)) + for name := range nestedEnums { + enumNames = append(enumNames, name) + } + sort.Strings(enumNames) + + // Sort fields by ascending tag for output. + sort.Slice(fields, func(i, j int) bool { + return fields[i].tag < fields[j].tag + }) + + var sb strings.Builder + sb.WriteString("message " + msgName + " {\n") + + // Emit constraint CEL options (before nested enums and fields). + if constraints != nil { + if len(constraints.AtLeastOne) > 0 { + cel := atLeastOneCEL(msgName, constraints.AtLeastOne) + sb.WriteString(cel) + } + if len(constraints.JustOne) > 0 { + cel := justOneCEL(msgName, constraints.JustOne) + sb.WriteString(cel) + } + } + + // Emit nested enums. + for _, enumName := range enumNames { + pe := nestedEnums[enumName] + sb.WriteString(emitEnum(pe)) + } + + // Emit fields. + for _, fs := range fields { + line := " " + if fs.repeated { + line += "repeated " + } + line += fs.typeName + " " + fs.name + " = " + fmt.Sprintf("%d", fs.tag) + // protovalidate interprets `required` on a repeated field as "non-empty + // (len >= 1)", but OCSF "required" on an array means only "key present". + // Fields like osint can be legitimately empty, so we skip the annotation + // for repeated fields to avoid wrongly rejecting valid events. + if fs.required && !fs.repeated { + line += ` [(buf.validate.field).required = true]` + } + line += ";\n" + sb.WriteString(line) + } + + sb.WriteString("}\n") + return sb.String(), nil +} + +// emitEnum formats a proto3 nested enum declaration. +func emitEnum(pe ProtoEnum) string { + var sb strings.Builder + sb.WriteString(" enum " + pe.Name + " {\n") + for _, v := range pe.Values { + sb.WriteString(" " + v.Ident + " = " + fmt.Sprintf("%d", v.Number) + ";\n") + } + sb.WriteString(" }\n") + return sb.String() +} + +// atLeastOneCEL generates a buf.validate CEL option asserting at least one +// of the listed fields is set. +// +// Generated expression: has(this.a) || has(this.b) || has(this.c) +func atLeastOneCEL(msgName string, fields []string) string { + sorted := make([]string, len(fields)) + copy(sorted, fields) + sort.Strings(sorted) + + parts := make([]string, len(sorted)) + for i, f := range sorted { + parts[i] = "has(this." + f + ")" + } + expr := strings.Join(parts, " || ") + fieldList := "[" + strings.Join(sorted, ", ") + "]" + return fmt.Sprintf( + " option (buf.validate.message).cel = {\n"+ + " id: %q,\n"+ + " message: %q,\n"+ + " expression: %q\n"+ + " };\n", + msgName+".at_least_one", + "at least one of "+fieldList+" must be set", + expr, + ) +} + +// justOneCEL generates a buf.validate CEL option asserting exactly one of the +// listed fields is set. +// +// Generated expression: +// +// (has(this.a) ? 1 : 0) + (has(this.b) ? 1 : 0) + ... == 1 +func justOneCEL(msgName string, fields []string) string { + sorted := make([]string, len(fields)) + copy(sorted, fields) + sort.Strings(sorted) + + parts := make([]string, len(sorted)) + for i, f := range sorted { + parts[i] = "(has(this." + f + ") ? 1 : 0)" + } + expr := strings.Join(parts, " + ") + " == 1" + fieldList := "[" + strings.Join(sorted, ", ") + "]" + return fmt.Sprintf( + " option (buf.validate.message).cel = {\n"+ + " id: %q,\n"+ + " message: %q,\n"+ + " expression: %q\n"+ + " };\n", + msgName+".just_one", + "exactly one of "+fieldList+" must be set", + expr, + ) +} diff --git a/ocsf/internal/ocsf/gen/emit_test.go b/ocsf/internal/ocsf/gen/emit_test.go new file mode 100644 index 0000000..28e2a41 --- /dev/null +++ b/ocsf/internal/ocsf/gen/emit_test.go @@ -0,0 +1,469 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "flag" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// -update regenerates golden files when passed to `go test`. +var update = flag.Bool("update", false, "regenerate golden files") + +// goldenPath is the directory for golden .proto files. +const goldenDir = "testdata/golden" + +// TestSelectClosure_ApiActivity verifies that SelectClosure returns the api_activity +// class plus the full transitive object closure, all sorted deterministically. +func TestSelectClosure_ApiActivity(t *testing.T) { + s := loadFixture(t) + + classes, objects, err := gen.SelectClosure(s, []string{"api_activity"}) + require.NoError(t, err) + require.Len(t, classes, 1) + require.Equal(t, "api_activity", classes[0].Name) + + // There must be at least one object (actor is directly referenced). + require.NotEmpty(t, objects) + + // actor must be in closure because api_activity.actor references it. + actorFound := false + for _, o := range objects { + if o.Name == "actor" { + actorFound = true + } + } + require.True(t, actorFound, "actor object must be in transitive closure") + + // Objects must be sorted by name. + for i := 1; i < len(objects); i++ { + require.Less(t, objects[i-1].Name, objects[i].Name, + "objects must be sorted by name") + } +} + +// TestSelectClosure_UnknownClass verifies that requesting a non-existent class +// returns a descriptive error. +func TestSelectClosure_UnknownClass(t *testing.T) { + s := loadFixture(t) + _, _, err := gen.SelectClosure(s, []string{"nonexistent_class_xyz"}) + require.Error(t, err) + require.Contains(t, err.Error(), "nonexistent_class_xyz") +} + +// TestSelectClosure_Deterministic verifies that two SelectClosure calls with the +// same inputs produce identical results. +func TestSelectClosure_Deterministic(t *testing.T) { + s := loadFixture(t) + + classes1, objects1, err := gen.SelectClosure(s, []string{"api_activity"}) + require.NoError(t, err) + + classes2, objects2, err := gen.SelectClosure(s, []string{"api_activity"}) + require.NoError(t, err) + + require.Equal(t, len(classes1), len(classes2)) + require.Equal(t, len(objects1), len(objects2)) + for i := range objects1 { + require.Equal(t, objects1[i].Name, objects2[i].Name) + } +} + +// TestEmit_PackageAndSyntax verifies the proto3 header of the emitted file. +func TestEmit_PackageAndSyntax(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Contains(t, out, `syntax = "proto3";`) + require.Contains(t, out, `package ocsf.v1;`) +} + +// minimalSchema returns a minimal schema suitable for package-name tests. +func minimalSchema(version string) *schema.Schema { + return &schema.Schema{ + Version: version, + Classes: map[string]*schema.Class{ + "stub_event": { + Name: "stub_event", + Attributes: map[string]*schema.Attribute{}, + }, + }, + Objects: map[string]*schema.Object{}, + Types: map[string]*schema.TypeDef{}, + DictionaryAttributes: map[string]*schema.DictAttr{}, + BaseEvent: &schema.BaseEvent{Attributes: map[string]*schema.Attribute{}}, + } +} + +// TestVersionToPackage_TableDriven verifies that Emit uses the correct proto +// package suffix for a variety of semver input strings. +// +// The expected package names follow proto versioning convention: only the OCSF +// major version is encoded in the package (1.8.0 → ocsf.v1, 2.0.0 → ocsf.v2). +func TestVersionToPackage_TableDriven(t *testing.T) { + cases := []struct { + version string + wantPkg string // expected "package ocsf.;" line; empty = error expected + wantErr bool + }{ + {version: "1.8.0", wantPkg: "package ocsf.v1;"}, + {version: "1.9.0-dev", wantPkg: "package ocsf.v1;"}, + {version: "1.9.0-rc.2", wantPkg: "package ocsf.v1;"}, + {version: "2.0.0", wantPkg: "package ocsf.v2;"}, + {version: "1", wantPkg: "package ocsf.v1;"}, + {version: "0.42.0", wantPkg: "package ocsf.v0;"}, + } + + for _, tc := range cases { + tc := tc + t.Run(tc.version, func(t *testing.T) { + s := minimalSchema(tc.version) + tm := tagmap.New() + out, _, err := gen.Emit(s, []string{"stub_event"}, tm, tc.version) + if tc.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.Contains(t, out, tc.wantPkg, + "emitted proto must contain %q for version %q", tc.wantPkg, tc.version) + }) + } +} + +// TestEmit_MessageApiActivity verifies the ApiActivity message is emitted for +// the api_activity class. +func TestEmit_MessageApiActivity(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Contains(t, out, "message ApiActivity {") +} + +// TestEmit_NestedEnum verifies that an int-keyed enum attribute (activity_id) +// produces a nested enum named ActivityId inside ApiActivity, with a correct +// zero value ACTIVITY_ID_UNKNOWN = 0. +func TestEmit_NestedEnum(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Contains(t, out, "enum ActivityId {") + require.Contains(t, out, "ACTIVITY_ID_UNKNOWN = 0;") +} + +// TestEmit_ObjectTypedField verifies that an object-typed attribute (actor) +// is emitted as a message reference. +func TestEmit_ObjectTypedField(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + // actor field should be "Actor actor = ;" + require.Contains(t, out, "Actor actor =") +} + +// TestEmit_RepeatedField verifies that an is_array attribute (authorizations) +// is emitted as repeated. +func TestEmit_RepeatedField(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Contains(t, out, "repeated Authorization authorizations =") +} + +// TestEmit_WellKnownImport verifies that when a json_t / generic-object field +// is present (api_activity.unmapped), the struct.proto import is emitted. +func TestEmit_WellKnownImport(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Contains(t, out, `import "google/protobuf/struct.proto";`) +} + +// TestEmit_RequiredFieldAnnotation verifies that a required attribute emits +// the protovalidate required annotation and triggers the validate.proto import. +func TestEmit_RequiredFieldAnnotation(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + // api_activity.time is required + require.Contains(t, out, "(buf.validate.field).required = true") + require.Contains(t, out, `import "buf/validate/validate.proto";`) +} + +// TestEmit_StableTags verifies that field tags are stable across two Emit calls +// using a fresh tag map (i.e., the second call reuses tags assigned by the first +// because Assign is idempotent). +func TestEmit_StableTags(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out1, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + out2, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + require.Equal(t, out1, out2, "two Emit calls with the same tag map must produce identical output") +} + +// TestEmit_Deterministic verifies that two Emit calls with equivalent fresh tag +// maps produce byte-identical output. +func TestEmit_Deterministic(t *testing.T) { + s := loadFixture(t) + + tm1 := tagmap.New() + out1, _, err := gen.Emit(s, []string{"api_activity"}, tm1, "1.8.0") + require.NoError(t, err) + + tm2 := tagmap.New() + out2, _, err := gen.Emit(s, []string{"api_activity"}, tm2, "1.8.0") + require.NoError(t, err) + + require.Equal(t, out1, out2, "Emit with fresh tag maps must be byte-identical") +} + +// TestEmit_ConstraintCEL verifies that objects with at_least_one constraints +// emit buf.validate CEL options. The user object has +// at_least_one: [account, name, uid]. +func TestEmit_ConstraintCEL(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + // api_activity pulls in the user object transitively. + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + // The User message must contain a CEL option for at_least_one. + require.Contains(t, out, "buf.validate.message") + require.Contains(t, out, "User.at_least_one") +} + +// TestEmit_JustOneCEL verifies that a just_one constraint emits correct CEL +// asserting exactly one field is present. vulnerability has just_one: [advisory, cve, cwe]. +func TestEmit_JustOneCEL(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + // vulnerability is in the transitive closure + require.Contains(t, out, "Vulnerability.just_one") +} + +// TestEmit_Golden is a golden-file test. It emits api_activity + entity_management +// and compares against testdata/golden/api_entity.proto. +// +// Run with -update to regenerate the golden file. +func TestEmit_Golden(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity", "entity_management"}, tm, "1.8.0") + require.NoError(t, err) + + goldenFile := goldenDir + "/api_entity.proto" + + if *update { + require.NoError(t, os.MkdirAll(goldenDir, 0o755)) + require.NoError(t, os.WriteFile(goldenFile, []byte(out), 0o644)) + t.Logf("golden file updated: %s", goldenFile) + return + } + + golden, err := os.ReadFile(goldenFile) + if os.IsNotExist(err) { + t.Fatalf("golden file %s does not exist; run with -update to generate it", goldenFile) + } + require.NoError(t, err) + require.Equal(t, string(golden), out, + "emitted proto does not match golden; re-run with -update if intentional") +} + +// TestEmit_ImportOrder verifies that imports appear in sorted order. +func TestEmit_ImportOrder(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + bufIdx := strings.Index(out, `"buf/validate/validate.proto"`) + googleIdx := strings.Index(out, `"google/protobuf/struct.proto"`) + require.Greater(t, googleIdx, -1, "struct.proto import must be present") + require.Greater(t, bufIdx, -1, "validate.proto import must be present") + // buf/validate comes before google/protobuf lexicographically ('b' < 'g') + require.Less(t, bufIdx, googleIdx, "imports must be sorted: buf before google") +} + +// TestEmit_StubbedObjects_ReportsAbsent verifies that Emit returns the names of +// objects that were emitted as empty stubs because they were referenced in +// attributes but absent from the schema snapshot. A synthetic schema is used so +// the test does not depend on the fixture's particular missing objects. +func TestEmit_StubbedObjects_ReportsAbsent(t *testing.T) { + // Build a minimal schema: one class with a single attribute referencing + // "phantom_obj", which is intentionally absent from the objects map. + s := &schema.Schema{ + Version: "0.0.1", + Classes: map[string]*schema.Class{ + "test_event": { + Name: "test_event", + Attributes: map[string]*schema.Attribute{ + "the_field": { + Name: "the_field", + Type: "object_t", + ObjectType: "phantom_obj", + }, + }, + }, + }, + Objects: map[string]*schema.Object{}, + Types: map[string]*schema.TypeDef{ + "string_t": {Caption: "String"}, + }, + DictionaryAttributes: map[string]*schema.DictAttr{}, + BaseEvent: &schema.BaseEvent{Attributes: map[string]*schema.Attribute{}}, + } + + tm := tagmap.New() + _, stubbed, err := gen.Emit(s, []string{"test_event"}, tm, "0.0.1") + require.NoError(t, err) + require.Equal(t, []string{"PhantomObj"}, stubbed, + "Emit must report PascalCase name of the absent object in stubbed") +} + +// TestEmit_StubbedObjects_NoneWhenFullyResolvable verifies that Emit returns +// nil stubbed when all objects transitively referenced by the selected classes +// are present in the schema snapshot. Uses entity_management, whose full +// transitive closure is present in the 1.8.0 fixture. +func TestEmit_StubbedObjects_NoneWhenFullyResolvable(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + _, stubbed, err := gen.Emit(s, []string{"entity_management"}, tm, "1.8.0") + require.NoError(t, err) + require.Empty(t, stubbed, + "Emit must return empty stubbed when all referenced objects are present in the schema") +} + +// TestEmit_RequiredRepeatedFieldNoAnnotation verifies that a required REPEATED +// field does NOT get the (buf.validate.field).required annotation (Fix 1). +// +// protovalidate interprets `required` on a repeated field as "len >= 1", but +// OCSF "required" on an array means only "key present" — the array may be +// legitimately empty. api_activity.osint is repeated+required and must NOT get +// the annotation. api_activity.time is singular+required and MUST keep it. +func TestEmit_RequiredRepeatedFieldNoAnnotation(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + // osint is repeated+required: must NOT carry the annotation. + require.NotContains(t, out, "repeated Osint osint = 37 [(buf.validate.field).required = true]", + "required repeated field must not get (buf.validate.field).required annotation") + require.Contains(t, out, "repeated Osint osint =", + "osint field must still be emitted as repeated") + + // time is singular+required: must still carry the annotation. + require.Contains(t, out, "(buf.validate.field).required = true", + "singular required fields must still get the annotation") +} + +// TestEmit_UnresolvableScalarErrors verifies that Emit returns an error (not a +// silent fallback to google.protobuf.Value) when an attribute has a scalar type +// that cannot be resolved through the schema's type chain. +// +// Before FIX 6, resolveProtoType fell back to WellKnown="google.protobuf.Value" +// for non-object type errors, hiding the unresolvable type silently. +func TestEmit_UnresolvableScalarErrors(t *testing.T) { + s := &schema.Schema{ + Version: "0.0.1", + Classes: map[string]*schema.Class{ + "bad_event": { + Name: "bad_event", + Attributes: map[string]*schema.Attribute{ + "mystery_field": { + Name: "mystery_field", + // This scalar type is not in Types map and not in baseMapping. + Type: "totally_unknown_scalar_t", + }, + }, + }, + }, + Objects: map[string]*schema.Object{}, + Types: map[string]*schema.TypeDef{}, + DictionaryAttributes: map[string]*schema.DictAttr{}, + BaseEvent: &schema.BaseEvent{Attributes: map[string]*schema.Attribute{}}, + } + + tm := tagmap.New() + _, _, err := gen.Emit(s, []string{"bad_event"}, tm, "0.0.1") + require.Error(t, err, "Emit must return an error for an unresolvable scalar type") + require.Contains(t, err.Error(), "totally_unknown_scalar_t", + "error must name the unresolvable type") +} + +// TestEmit_DeterministicWithSavedTagMap verifies that a TagMap saved after one +// Emit call and loaded back produces byte-identical output on a second Emit call. +// This strengthens the wire-stability guarantee: the on-disk format round-trips +// without changing field numbers. +func TestEmit_DeterministicWithSavedTagMap(t *testing.T) { + s := loadFixture(t) + + // First run: emit with a fresh TagMap and save it. + tm1 := tagmap.New() + out1, _, err := gen.Emit(s, []string{"api_activity"}, tm1, "1.8.0") + require.NoError(t, err) + + tagFile := filepath.Join(t.TempDir(), "tags.json") + require.NoError(t, tm1.Save(tagFile)) + + // Second run: load the saved TagMap and emit again. + tm2, err := tagmap.Load(tagFile) + require.NoError(t, err) + + out2, _, err := gen.Emit(s, []string{"api_activity"}, tm2, "1.8.0") + require.NoError(t, err) + + require.Equal(t, out1, out2, + "Emit output must be byte-identical when using a TagMap loaded from the saved file") +} diff --git a/ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto b/ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto new file mode 100644 index 0000000..bff84db --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto @@ -0,0 +1,3085 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; + +message ApiActivity { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + string action = 1; + ActionId action_id = 2; + ActivityId activity_id = 3 [(buf.validate.field).required = true]; + string activity_name = 4; + Actor actor = 5 [(buf.validate.field).required = true]; + AiModel ai_model = 6; + Api api = 7 [(buf.validate.field).required = true]; + repeated Attack attacks = 8; + repeated Authorization authorizations = 9; + string category_name = 10; + CategoryUid category_uid = 11 [(buf.validate.field).required = true]; + string class_name = 12; + ClassUid class_uid = 13 [(buf.validate.field).required = true]; + Cloud cloud = 14 [(buf.validate.field).required = true]; + string confidence = 15; + ConfidenceId confidence_id = 16; + int32 confidence_score = 17; + int32 count = 18; + Device device = 19; + string disposition = 20; + DispositionId disposition_id = 21; + NetworkEndpoint dst_endpoint = 22; + int64 duration = 23; + int64 end_time = 24; + string end_time_dt = 25; + repeated Enrichment enrichments = 26; + FirewallRule firewall_rule = 27; + HttpRequest http_request = 28; + HttpResponse http_response = 29; + bool is_alert = 30; + repeated Malware malware = 31; + MalwareScanInfo malware_scan_info = 32; + string message = 33; + MessageContext message_context = 34; + Metadata metadata = 35 [(buf.validate.field).required = true]; + repeated Observable observables = 36; + repeated Osint osint = 37; + Policy policy = 38; + string raw_data = 39; + Fingerprint raw_data_hash = 40; + int64 raw_data_size = 41; + repeated ResourceDetails resources = 42; + string risk_details = 43; + string risk_level = 44; + RiskLevelId risk_level_id = 45; + int32 risk_score = 46; + string severity = 47; + SeverityId severity_id = 48 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; + int64 start_time = 50; + string start_time_dt = 51; + string status = 52; + string status_code = 53; + string status_detail = 54; + StatusId status_id = 55; + int64 time = 56 [(buf.validate.field).required = true]; + string time_dt = 57; + int32 timezone_offset = 58; + Trace trace = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + +message EntityManagement { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_MOVE = 5; + ACTIVITY_ID_ENROLL = 6; + ACTIVITY_ID_UNENROLL = 7; + ACTIVITY_ID_ENABLE = 8; + ACTIVITY_ID_DISABLE = 9; + ACTIVITY_ID_ACTIVATE = 10; + ACTIVITY_ID_DEACTIVATE = 11; + ACTIVITY_ID_SUSPEND = 12; + ACTIVITY_ID_RESUME = 13; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + ActivityId activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + Api api = 8; + repeated Attack attacks = 9; + repeated Authorization authorizations = 10; + string category_name = 11; + CategoryUid category_uid = 12 [(buf.validate.field).required = true]; + string class_name = 13; + ClassUid class_uid = 14 [(buf.validate.field).required = true]; + Cloud cloud = 15 [(buf.validate.field).required = true]; + string comment = 16; + string confidence = 17; + ConfidenceId confidence_id = 18; + int32 confidence_score = 19; + int32 count = 20; + Device device = 21; + string disposition = 22; + DispositionId disposition_id = 23; + int64 duration = 24; + int64 end_time = 25; + string end_time_dt = 26; + repeated Enrichment enrichments = 27; + ManagedEntity entity = 28 [(buf.validate.field).required = true]; + ManagedEntity entity_result = 29; + FirewallRule firewall_rule = 30; + HttpRequest http_request = 31; + HttpResponse http_response = 32; + bool is_alert = 33; + repeated Malware malware = 34; + MalwareScanInfo malware_scan_info = 35; + string message = 36; + Metadata metadata = 37 [(buf.validate.field).required = true]; + repeated Observable observables = 38; + repeated Osint osint = 39; + Policy policy = 40; + string raw_data = 41; + Fingerprint raw_data_hash = 42; + int64 raw_data_size = 43; + string risk_details = 44; + string risk_level = 45; + RiskLevelId risk_level_id = 46; + int32 risk_score = 47; + string severity = 48; + SeverityId severity_id = 49 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 50; + int64 start_time = 51; + string start_time_dt = 52; + string status = 53; + string status_code = 54; + string status_detail = 55; + StatusId status_id = 56; + int64 time = 57 [(buf.validate.field).required = true]; + string time_dt = 58; + int32 timezone_offset = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + +message Account { + option (buf.validate.message).cel = { + id: "Account.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + bool is_disabled = 1; + bool is_locked = 2; + bool is_on_premises_sync_enabled = 3; + repeated string labels = 4; + string name = 5; + repeated KeyValueObject tags = 6; + string type = 7; + TypeId type_id = 8; + string uid = 9; +} + +message Actor { + option (buf.validate.message).cel = { + id: "Actor.at_least_one", + message: "at least one of [app_name, app_uid, invoked_by, process, session, user] must be set", + expression: "has(this.app_name) || has(this.app_uid) || has(this.invoked_by) || has(this.process) || has(this.session) || has(this.user)" + }; + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20 [(buf.validate.field).required = true]; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3 [(buf.validate.field).required = true]; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8 [(buf.validate.field).required = true]; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20 [(buf.validate.field).required = true]; +} + +message Agent { + option (buf.validate.message).cel = { + id: "Agent.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message AiModel { + option (buf.validate.message).cel = { + id: "AiModel.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string ai_provider = 1 [(buf.validate.field).required = true]; + string name = 2 [(buf.validate.field).required = true]; + string uid = 3; + string version = 4; +} + +message Analytic { + option (buf.validate.message).cel = { + id: "Analytic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9 [(buf.validate.field).required = true]; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2 [(buf.validate.field).required = true]; + Request request = 3; + Response response = 4; + Service service = 5; + Token token = 6; + string version = 7; +} + +message Application { + option (buf.validate.message).cel = { + id: "Application.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + string criticality = 1; + google.protobuf.Value data = 2; + string desc = 3; + Group group = 4; + string hostname = 5; + repeated string labels = 6; + string name = 7; + User owner = 8; + string region = 9; + Graph resource_relationship = 10; + string risk_level = 11; + RiskLevelId risk_level_id = 12; + int32 risk_score = 13; + Sbom sbom = 14; + repeated KeyValueObject tags = 15; + string type = 16; + string uid = 17; + string uid_alt = 18; + Url url = 19; + string version = 20; +} + +message Attack { + option (buf.validate.message).cel = { + id: "Attack.at_least_one", + message: "at least one of [sub_technique, tactic, technique] must be set", + expression: "has(this.sub_technique) || has(this.tactic) || has(this.technique)" + }; + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4 [(buf.validate.field).required = true]; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + option (buf.validate.message).cel = { + id: "AutonomousSystem.at_least_one", + message: "at least one of [name, number] must be set", + expression: "has(this.name) || has(this.number)" + }; + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1 [(buf.validate.field).required = true]; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7 [(buf.validate.field).required = true]; + repeated San sans = 8; + string serial_number = 9 [(buf.validate.field).required = true]; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2 [(buf.validate.field).required = true]; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2 [(buf.validate.field).required = true]; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5 [(buf.validate.field).required = true]; + string region = 6; + string zone = 7; +} + +message Container { + option (buf.validate.message).cel = { + id: "Container.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16 [(buf.validate.field).required = true]; +} + +message Cvss { + double base_score = 1 [(buf.validate.field).required = true]; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9 [(buf.validate.field).required = true]; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3 [(buf.validate.field).required = true]; +} + +message D3fTactic { + option (buf.validate.message).cel = { + id: "D3fTactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + option (buf.validate.message).cel = { + id: "D3fTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + option (buf.validate.message).cel = { + id: "D3fend.at_least_one", + message: "at least one of [d3f_tactic, d3f_technique] must be set", + expression: "has(this.d3f_tactic) || has(this.d3f_technique)" + }; + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + option (buf.validate.message).cel = { + id: "DataClassification.at_least_one", + message: "at least one of [category_id, confidentiality_id] must be set", + expression: "has(this.category_id) || has(this.confidentiality_id)" + }; + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + option (buf.validate.message).cel = { + id: "Device.at_least_one", + message: "at least one of [hostname, instance_uid, interface_name, interface_uid, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string mac_vendor = 38; + string meid = 39; + string model = 40; + int64 modified_time = 41; + string modified_time_dt = 42; + string name = 43; + int32 namespace_pid = 44; + repeated NetworkInterface network_interfaces = 45; + Organization org = 46; + Os os = 47; + string os_machine_uuid = 48; + User owner = 49; + Group pool = 50; + string region = 51; + string risk_level = 52; + RiskLevelId risk_level_id = 53; + int32 risk_score = 54; + string subnet = 55; + string subnet_uid = 56; + string type = 57; + TypeId type_id = 58 [(buf.validate.field).required = true]; + string udid = 59; + string uid = 60; + string uid_alt = 61; + string vendor_name = 62; + string vlan_uid = 63; + string vpc_uid = 64; + string zone = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + int32 gpu_count = 13; + repeated GpuInfo gpu_info_list = 14; + KeyboardInfo keyboard_info = 15; + int32 ram_size = 16; + string serial_number = 17; + string uuid = 18; + string vendor_name = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5 [(buf.validate.field).required = true]; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Edge { + option (buf.validate.message).cel = { + id: "Edge.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + google.protobuf.Value data = 1; + bool is_directed = 2; + string name = 3; + string relation = 4; + string source = 5 [(buf.validate.field).required = true]; + string target = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Email { + option (buf.validate.message).cel = { + id: "Email.at_least_one", + message: "at least one of [from, to] must be set", + expression: "has(this.from) || has(this.to)" + }; + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3 [(buf.validate.field).required = true]; + string desc = 4; + string name = 5 [(buf.validate.field).required = true]; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11 [(buf.validate.field).required = true]; +} + +message EnvironmentVariable { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4 [(buf.validate.field).required = true]; + string version = 5; +} + +message Extension { + option (buf.validate.message).cel = { + id: "Extension.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3 [(buf.validate.field).required = true]; +} + +message Feature { + option (buf.validate.message).cel = { + id: "Feature.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + repeated string imported_symbols = 19; + string internal_name = 20; + bool is_deleted = 21; + bool is_encrypted = 22; + bool is_public = 23; + bool is_readonly = 24; + bool is_system = 25; + string mime_type = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + User modifier = 29; + string name = 30 [(buf.validate.field).required = true]; + User owner = 31; + string parent_folder = 32; + string path = 33; + Product product = 34; + string security_descriptor = 35; + DigitalSignature signature = 36; + repeated DigitalSignature signatures = 37; + int64 size = 38; + string storage_class = 39; + repeated KeyValueObject tags = 40; + string type = 41; + TypeId type_id = 42 [(buf.validate.field).required = true]; + string uid = 43; + string uri = 44; + Url url = 45; + string version = 46; + string volume = 47; + google.protobuf.Value xattributes = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + string value = 3 [(buf.validate.field).required = true]; +} + +message FirewallRule { + option (buf.validate.message).cel = { + id: "FirewallRule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Graph { + option (buf.validate.message).cel = { + id: "Graph.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum QueryLanguageId { + QUERY_LANGUAGE_ID_UNKNOWN = 0; + QUERY_LANGUAGE_ID_CYPHER = 1; + QUERY_LANGUAGE_ID_GRAPHQL = 2; + QUERY_LANGUAGE_ID_GREMLIN = 3; + QUERY_LANGUAGE_ID_GQL = 4; + QUERY_LANGUAGE_ID_G_CORE = 5; + QUERY_LANGUAGE_ID_PGQL = 6; + QUERY_LANGUAGE_ID_SPARQL = 7; + QUERY_LANGUAGE_ID_OTHER = 99; + } + string desc = 1; + repeated Edge edges = 2; + bool is_directed = 3; + string name = 4; + repeated Node nodes = 5; + string query_language = 6; + QueryLanguageId query_language_id = 7; + string type = 8; + string uid = 9; +} + +message Group { + option (buf.validate.message).cel = { + id: "Group.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2 [(buf.validate.field).required = true]; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + option (buf.validate.message).cel = { + id: "Idp.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6 [(buf.validate.field).required = true]; +} + +message KbArticle { + option (buf.validate.message).cel = { + id: "KbArticle.at_least_one", + message: "at least one of [src_url, uid] must be set", + expression: "has(this.src_url) || has(this.uid)" + }; + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + option (buf.validate.message).cel = { + id: "KeyValueObject.at_least_one", + message: "at least one of [value, values] must be set", + expression: "has(this.value) || has(this.values)" + }; + string name = 1 [(buf.validate.field).required = true]; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2 [(buf.validate.field).required = true]; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string department = 6; + string display_name = 7; + repeated string email_addrs = 8; + string employee_uid = 9; + string given_name = 10; + int64 hire_time = 11; + string hire_time_dt = 12; + string job_title = 13; + repeated string labels = 14; + int64 last_login_time = 15; + string last_login_time_dt = 16; + string ldap_cn = 17; + string ldap_dn = 18; + int64 leave_time = 19; + string leave_time_dt = 20; + Location location = 21; + User manager = 22; + int64 modified_time = 23; + string modified_time_dt = 24; + string office_location = 25; + string phone_number = 26; + string surname = 27; + repeated KeyValueObject tags = 28; +} + +message Location { + option (buf.validate.message).cel = { + id: "Location.at_least_one", + message: "at least one of [city, country, postal_code, region] must be set", + expression: "has(this.city) || has(this.country) || has(this.postal_code) || has(this.region)" + }; + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + option (buf.validate.message).cel = { + id: "Logger.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3 [(buf.validate.field).required = true]; +} + +message Malware { + option (buf.validate.message).cel = { + id: "Malware.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + option (buf.validate.message).cel = { + id: "MalwareScanInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11 [(buf.validate.field).required = true]; + string uid = 12; + int32 unique_malware_count = 13; +} + +message ManagedEntity { + option (buf.validate.message).cel = { + id: "ManagedEntity.at_least_one", + message: "at least one of [device, group, name, org, policy, uid, user] must be set", + expression: "has(this.device) || has(this.group) || has(this.name) || has(this.org) || has(this.policy) || has(this.uid) || has(this.user)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_DEVICE = 1; + TYPE_ID_USER = 2; + TYPE_ID_GROUP = 3; + TYPE_ID_ORGANIZATION = 4; + TYPE_ID_POLICY = 5; + TYPE_ID_EMAIL = 6; + TYPE_ID_NETWORK_ZONE = 7; + TYPE_ID_OTHER = 99; + } + google.protobuf.Value data = 1; + Device device = 2; + Email email = 3; + Group group = 4; + Location location = 5; + string name = 6; + Organization org = 7; + Policy policy = 8; + string type = 9; + TypeId type_id = 10; + string uid = 11; + User user = 12; + string version = 13; +} + +message MessageContext { + option (buf.validate.message).cel = { + id: "MessageContext.at_least_one", + message: "at least one of [application, service] must be set", + expression: "has(this.application) || has(this.service)" + }; + enum AiRoleId { + AI_ROLE_ID_UNKNOWN = 0; + AI_ROLE_ID_USER = 1; + AI_ROLE_ID_ASSISTANT = 2; + AI_ROLE_ID_TOOL = 3; + AI_ROLE_ID_AGENT = 4; + AI_ROLE_ID_ORCHESTRATOR = 5; + AI_ROLE_ID_RETRIEVER = 6; + AI_ROLE_ID_OTHER = 99; + } + string ai_role = 1; + AiRoleId ai_role_id = 2; + Application application = 3; + int32 completion_tokens = 4; + string name = 5; + int32 prompt_tokens = 6; + Service service = 7; + int32 total_tokens = 8; + string uid = 9; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25 [(buf.validate.field).required = true]; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + Timespan total_queued_duration = 32; + repeated TransformationInfo transformation_info_list = 33; + int64 transmit_time = 34; + string transmit_time_dt = 35; + string type = 36; + string uid = 37; + int32 untruncated_size = 38; + string version = 39 [(buf.validate.field).required = true]; +} + +message Metric { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Mitigation { + option (buf.validate.message).cel = { + id: "Mitigation.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + option (buf.validate.message).cel = { + id: "NetworkEndpoint.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message NetworkInterface { + option (buf.validate.message).cel = { + id: "NetworkInterface.at_least_one", + message: "at least one of [hostname, ip, mac, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.mac) || has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + option (buf.validate.message).cel = { + id: "NetworkProxy.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message Node { + google.protobuf.Value data = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5 [(buf.validate.field).required = true]; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5 [(buf.validate.field).required = true]; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + option (buf.validate.message).cel = { + id: "OccurrenceDetails.at_least_one", + message: "at least one of [cell_name, column_name, column_number, end_line, json_path, page_number, record_index_in_array, row_number, start_line] must be set", + expression: "has(this.cell_name) || has(this.column_name) || has(this.column_number) || has(this.end_line) || has(this.json_path) || has(this.page_number) || has(this.record_index_in_array) || has(this.row_number) || has(this.start_line)" + }; + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + option (buf.validate.message).cel = { + id: "Organization.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8 [(buf.validate.field).required = true]; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12 [(buf.validate.field).required = true]; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44 [(buf.validate.field).required = true]; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48 [(buf.validate.field).required = true]; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7 [(buf.validate.field).required = true]; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17 [(buf.validate.field).required = true]; +} + +message Policy { + option (buf.validate.message).cel = { + id: "Policy.at_least_one", + message: "at least one of [name, type, uid] must be set", + expression: "has(this.name) || has(this.type) || has(this.uid)" + }; + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1 [(buf.validate.field).required = true]; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + option (buf.validate.message).cel = { + id: "Process.at_least_one", + message: "at least one of [cpid, pid, uid] must be set", + expression: "has(this.cpid) || has(this.pid) || has(this.uid)" + }; + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + option (buf.validate.message).cel = { + id: "ProcessEntity.at_least_one", + message: "at least one of [cmd_line, cpid, name, path, pid, uid] must be set", + expression: "has(this.cmd_line) || has(this.cpid) || has(this.name) || has(this.path) || has(this.pid) || has(this.uid)" + }; + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + option (buf.validate.message).cel = { + id: "Product.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2 [(buf.validate.field).required = true]; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + option (buf.validate.message).cel = { + id: "Reporter.at_least_one", + message: "at least one of [hostname, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.name) || has(this.uid)" + }; + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1 [(buf.validate.field).required = true]; + string provider = 2; + string score = 3; + ScoreId score_id = 4 [(buf.validate.field).required = true]; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message ResourceDetails { + option (buf.validate.message).cel = { + id: "ResourceDetails.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RoleId { + ROLE_ID_UNKNOWN = 0; + ROLE_ID_TARGET = 1; + ROLE_ID_ACTOR = 2; + ROLE_ID_AFFECTED = 3; + ROLE_ID_RELATED = 4; + ROLE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string cloud_partition = 2; + int64 created_time = 3; + string created_time_dt = 4; + string criticality = 5; + google.protobuf.Value data = 6; + DataClassification data_classification = 7; + repeated DataClassification data_classifications = 8; + Group group = 9; + string hostname = 10; + string ip = 11; + bool is_backed_up = 12; + repeated string labels = 13; + int64 modified_time = 14; + string modified_time_dt = 15; + string name = 16; + string namespace = 17; + User owner = 18; + string provider = 19; + string region = 20; + Graph resource_relationship = 21; + string role = 22; + RoleId role_id = 23; + repeated KeyValueObject tags = 24; + string type = 25; + string uid = 26; + string uid_alt = 27; + string version = 28; + string zone = 29; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + option (buf.validate.message).cel = { + id: "Rule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1 [(buf.validate.field).required = true]; + string type = 2 [(buf.validate.field).required = true]; +} + +message Sbom { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SPDX = 1; + TYPE_ID_CYCLONEDX = 2; + TYPE_ID_SWID = 3; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + Package package = 3 [(buf.validate.field).required = true]; + Product product = 4; + repeated SoftwareComponent software_components = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; + string version = 9; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5 [(buf.validate.field).required = true]; + string type = 6; + TypeId type_id = 7 [(buf.validate.field).required = true]; + string uid = 8; +} + +message Service { + option (buf.validate.message).cel = { + id: "Service.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message SoftwareComponent { + enum RelationshipId { + RELATIONSHIP_ID_UNKNOWN = 0; + RELATIONSHIP_ID_DEPENDS_ON = 1; + RELATIONSHIP_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_FRAMEWORK = 1; + TYPE_ID_LIBRARY = 2; + TYPE_ID_OPERATING_SYSTEM = 3; + TYPE_ID_OTHER = 99; + } + string author = 1; + Fingerprint hash = 2; + string license = 3; + string name = 4 [(buf.validate.field).required = true]; + string purl = 5; + string related_component = 6; + string relationship = 7; + RelationshipId relationship_id = 8; + string type = 9; + TypeId type_id = 10; + string version = 11 [(buf.validate.field).required = true]; +} + +message Span { + int64 duration = 1; + int64 end_time = 2 [(buf.validate.field).required = true]; + string end_time_dt = 3; + string message = 4; + string operation = 5; + string parent_uid = 6; + Service service = 7; + int64 start_time = 8 [(buf.validate.field).required = true]; + string start_time_dt = 9; + string status_code = 10; + string uid = 11 [(buf.validate.field).required = true]; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + option (buf.validate.message).cel = { + id: "SubTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + option (buf.validate.message).cel = { + id: "Tactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + option (buf.validate.message).cel = { + id: "Technique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1 [(buf.validate.field).required = true]; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + option (buf.validate.message).cel = { + id: "Timespan.at_least_one", + message: "at least one of [duration, duration_days, duration_hours, duration_mins, duration_months, duration_secs, duration_weeks, duration_years, end_time, start_time] must be set", + expression: "has(this.duration) || has(this.duration_days) || has(this.duration_hours) || has(this.duration_mins) || has(this.duration_months) || has(this.duration_secs) || has(this.duration_weeks) || has(this.duration_years) || has(this.end_time) || has(this.start_time)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message Trace { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + repeated string flags = 4; + Service service = 5; + Span span = 6; + int64 start_time = 7; + string start_time_dt = 8; + string uid = 9 [(buf.validate.field).required = true]; +} + +message TransformationInfo { + option (buf.validate.message).cel = { + id: "TransformationInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + option (buf.validate.message).cel = { + id: "Url.at_least_one", + message: "at least one of [path, url_string] must be set", + expression: "has(this.path) || has(this.url_string)" + }; + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + option (buf.validate.message).cel = { + id: "User.at_least_one", + message: "at least one of [account, name, uid] must be set", + expression: "has(this.account) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + option (buf.validate.message).cel = { + id: "Vulnerability.just_one", + message: "exactly one of [advisory, cve, cwe] must be set", + expression: "(has(this.advisory) ? 1 : 0) + (has(this.cve) ? 1 : 0) + (has(this.cwe) ? 1 : 0) == 1" + }; + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + option (buf.validate.message).cel = { + id: "WinService.at_least_one", + message: "at least one of [cmd_line, service_category_id, service_dependencies, service_error_control_id, service_start_name, service_start_type_id, service_type_id] must be set", + expression: "has(this.cmd_line) || has(this.service_category_id) || has(this.service_dependencies) || has(this.service_error_control_id) || has(this.service_start_name) || has(this.service_start_type_id) || has(this.service_type_id)" + }; + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5 [(buf.validate.field).required = true]; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden/buf.lock b/ocsf/internal/ocsf/gen/testdata/golden/buf.lock new file mode 100644 index 0000000..709ae02 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/buf.lock @@ -0,0 +1,6 @@ +# Generated by buf. DO NOT EDIT. +version: v2 +deps: + - name: buf.build/bufbuild/protovalidate + commit: 50325440f8f24053b047484a6bf60b76 + digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31 diff --git a/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml new file mode 100644 index 0000000..4d2ee62 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml @@ -0,0 +1,16 @@ +version: v2 +modules: + - path: . +deps: + - buf.build/bufbuild/protovalidate +lint: + use: + - STANDARD + except: + # Generated files don't follow a consistent package/directory convention. + - PACKAGE_DIRECTORY_MATCH + # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values by design. + - ENUM_ZERO_VALUE_SUFFIX +breaking: + use: + - FILE From 7f80b24c1b34d5a426922716d7e0e8b659022341 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:09:07 +0200 Subject: [PATCH 05/26] feat(ocsf): add OCSF-JSON exporter with integer enums Reflection-based marshaller producing schema-valid OCSF JSON: enums always emit as integers (singular, nested, repeated, map), 64-bit ints as JSON numbers (exact beyond 2^53), snake_case keys, and unset fields omitted. Fixes the three ways stock protojson diverges from OCSF, proven by a divergence test. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/internal/ocsf/exporter/exporter.go | 332 ++++++++++++++++ ocsf/internal/ocsf/exporter/exporter_test.go | 352 +++++++++++++++++ .../exporter/testdata/sample/buf.gen.yaml | 7 + .../ocsf/exporter/testdata/sample/buf.lock | 2 + .../ocsf/exporter/testdata/sample/buf.yaml | 15 + .../exporter/testdata/sample/sample.pb.go | 362 ++++++++++++++++++ .../exporter/testdata/sample/sample.proto | 65 ++++ 7 files changed, 1135 insertions(+) create mode 100644 ocsf/internal/ocsf/exporter/exporter.go create mode 100644 ocsf/internal/ocsf/exporter/exporter_test.go create mode 100644 ocsf/internal/ocsf/exporter/testdata/sample/buf.gen.yaml create mode 100644 ocsf/internal/ocsf/exporter/testdata/sample/buf.lock create mode 100644 ocsf/internal/ocsf/exporter/testdata/sample/buf.yaml create mode 100644 ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go create mode 100644 ocsf/internal/ocsf/exporter/testdata/sample/sample.proto diff --git a/ocsf/internal/ocsf/exporter/exporter.go b/ocsf/internal/ocsf/exporter/exporter.go new file mode 100644 index 0000000..c4d62d0 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/exporter.go @@ -0,0 +1,332 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package exporter marshals generated OCSF proto messages to schema-valid +// OCSF JSON, fixing three things that stock protojson gets wrong: +// +// 1. ENUMS: protojson emits the enum value name (e.g. "SEVERITY_ID_CRITICAL"); +// OCSF requires the integer (e.g. 5). +// +// 2. 64-BIT INTEGERS: protojson emits int64/uint64 etc. as a quoted string +// (e.g. "1685403212834"); OCSF timestamp_t and type_uid are JSON numbers. +// +// 3. KEY CASING: protojson defaults to camelCase JSON names (e.g. "classUid"); +// OCSF keys are snake_case, matching the proto field names (e.g. "class_uid"). +package exporter + +import ( + "bytes" + "encoding/base64" + "encoding/json" + "fmt" + "sort" + + "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/reflect/protoreflect" + "google.golang.org/protobuf/types/known/structpb" +) + +// wellKnownStructural is the set of google.protobuf well-known wrapper and +// structural message full names that we delegate to protojson for natural +// JSON rendering instead of recursing into their internal fields. +var wellKnownStructural = map[protoreflect.FullName]bool{ + "google.protobuf.Value": true, + "google.protobuf.Struct": true, + "google.protobuf.ListValue": true, + // Wrappers: delegate to protojson too. + "google.protobuf.DoubleValue": true, + "google.protobuf.FloatValue": true, + "google.protobuf.Int64Value": true, + "google.protobuf.UInt64Value": true, + "google.protobuf.Int32Value": true, + "google.protobuf.UInt32Value": true, + "google.protobuf.BoolValue": true, + "google.protobuf.StringValue": true, + "google.protobuf.BytesValue": true, +} + +// ToOCSFJSON marshals a proto.Message to OCSF-compliant JSON. +// +// Contract: +// - Keys are the proto field names (snake_case). +// - Enum fields are emitted as their integer values, not name strings. +// - int64/uint64/sint64/sfixed64/fixed64 are emitted as unquoted JSON numbers. +// - google.protobuf.Value/Struct/ListValue are emitted as their natural JSON. +// - Unset fields are omitted: proto3 implicit-presence scalars at zero value, +// explicit optional fields that are nil, empty repeated/map, nil messages. +// - repeated -> JSON array; nested message -> JSON object (recursively). +// - Fields are emitted in ascending field-number order (deterministic). +func ToOCSFJSON(m proto.Message) ([]byte, error) { + var buf bytes.Buffer + if err := marshalMessage(&buf, m.ProtoReflect()); err != nil { + return nil, err + } + return buf.Bytes(), nil +} + +// marshalMessage writes a single proto message as a JSON object to buf. +func marshalMessage(buf *bytes.Buffer, msg protoreflect.Message) error { + // Delegate well-known structural types to protojson for natural rendering. + if wellKnownStructural[msg.Descriptor().FullName()] { + return marshalWellKnown(buf, msg) + } + + // Collect set fields sorted by field number. + fields := collectSetFields(msg) + + buf.WriteByte('{') + first := true + for _, fd := range fields { + val := msg.Get(fd) + + var valBuf bytes.Buffer + if err := marshalValue(&valBuf, fd, val); err != nil { + return fmt.Errorf("field %q: %w", fd.Name(), err) + } + + if !first { + buf.WriteByte(',') + } + first = false + + // Key: proto field name (snake_case). + key, err := json.Marshal(string(fd.Name())) + if err != nil { + return err + } + buf.Write(key) + buf.WriteByte(':') + buf.Write(valBuf.Bytes()) + } + buf.WriteByte('}') + return nil +} + +// collectSetFields returns the field descriptors for all set (non-zero) fields +// of msg, sorted by ascending field number. +// +// For proto3 implicit-presence scalars, "set" means the value is not the zero +// value. For fields with explicit presence (optional, oneof, message), "set" +// means HasField returns true. +// +// Note: protoreflect.Message.Range visits set fields in undefined order. The +// explicit sort.Slice by field number below is what guarantees deterministic +// output. +func collectSetFields(msg protoreflect.Message) []protoreflect.FieldDescriptor { + var fds []protoreflect.FieldDescriptor + msg.Range(func(fd protoreflect.FieldDescriptor, _ protoreflect.Value) bool { + fds = append(fds, fd) + return true + }) + sort.Slice(fds, func(i, j int) bool { + return fds[i].Number() < fds[j].Number() + }) + return fds +} + +// marshalValue writes a single proto field value as JSON to buf. +func marshalValue(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, val protoreflect.Value) error { + // Repeated field -> JSON array. + if fd.IsList() { + return marshalList(buf, fd, val.List()) + } + + // Map field -> JSON object. + if fd.IsMap() { + return marshalMap(buf, fd, val.Map()) + } + + return marshalSingular(buf, fd, val) +} + +// marshalList writes a repeated field as a JSON array. +func marshalList(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, list protoreflect.List) error { + buf.WriteByte('[') + for i := range list.Len() { + if i > 0 { + buf.WriteByte(',') + } + if err := marshalSingular(buf, fd, list.Get(i)); err != nil { + return err + } + } + buf.WriteByte(']') + return nil +} + +// marshalMap writes a map field as a JSON object. +func marshalMap(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, m protoreflect.Map) error { + valFD := fd.MapValue() + + // Collect keys for deterministic ordering. + keys := make([]protoreflect.MapKey, 0, m.Len()) + m.Range(func(k protoreflect.MapKey, _ protoreflect.Value) bool { + keys = append(keys, k) + return true + }) + sort.Slice(keys, func(i, j int) bool { + return keys[i].String() < keys[j].String() + }) + + buf.WriteByte('{') + for i, k := range keys { + if i > 0 { + buf.WriteByte(',') + } + // Map keys are always strings in JSON. + keyBytes, err := json.Marshal(k.String()) + if err != nil { + return err + } + buf.Write(keyBytes) + buf.WriteByte(':') + + var valBuf bytes.Buffer + if err := marshalSingular(&valBuf, valFD, m.Get(k)); err != nil { + return err + } + buf.Write(valBuf.Bytes()) + } + buf.WriteByte('}') + return nil +} + +// marshalSingular writes a single (non-repeated, non-map) proto value as JSON. +func marshalSingular(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, val protoreflect.Value) error { + switch fd.Kind() { + case protoreflect.MessageKind, protoreflect.GroupKind: + return marshalMessage(buf, val.Message()) + + case protoreflect.EnumKind: + // OCSF requires the integer, not the enum name string. + fmt.Fprintf(buf, "%d", val.Enum()) + return nil + + case protoreflect.BoolKind: + if val.Bool() { + buf.WriteString("true") + } else { + buf.WriteString("false") + } + return nil + + case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind, + protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind: + // OCSF timestamps and type_uid are JSON numbers, not quoted strings. + fmt.Fprintf(buf, "%d", val.Int()) + return nil + + case protoreflect.Uint32Kind, protoreflect.Fixed32Kind, + protoreflect.Uint64Kind, protoreflect.Fixed64Kind: + fmt.Fprintf(buf, "%d", val.Uint()) + return nil + + case protoreflect.FloatKind: + b, err := json.Marshal(float32(val.Float())) + if err != nil { + return err + } + buf.Write(b) + return nil + + case protoreflect.DoubleKind: + b, err := json.Marshal(val.Float()) + if err != nil { + return err + } + buf.Write(b) + return nil + + case protoreflect.StringKind: + b, err := json.Marshal(val.String()) + if err != nil { + return err + } + buf.Write(b) + return nil + + case protoreflect.BytesKind: + // Proto JSON convention: bytes -> base64 standard encoding. + enc := base64.StdEncoding.EncodeToString(val.Bytes()) + b, err := json.Marshal(enc) + if err != nil { + return err + } + buf.Write(b) + return nil + + default: + return fmt.Errorf("unsupported proto kind %v for field %q", fd.Kind(), fd.Name()) + } +} + +// marshalWellKnown delegates well-known structural message serialisation to the +// standard protojson library, which handles the natural JSON forms of +// google.protobuf.Value, Struct, ListValue, and wrapper types correctly. +// +// We then re-emit the protojson output verbatim; these types don't have +// snake_case / int-enum / unquoted-int64 concerns. +func marshalWellKnown(buf *bytes.Buffer, msg protoreflect.Message) error { + // Extract the concrete proto.Message to pass to the structpb marshaler. + // The only well-known types we care about in OCSF are Value/Struct/ListValue. + // Use a type switch on the underlying Go type. + concrete := msg.Interface() + switch v := concrete.(type) { + case *structpb.Value: + b, err := v.MarshalJSON() + if err != nil { + return err + } + buf.Write(b) + return nil + case *structpb.Struct: + b, err := v.MarshalJSON() + if err != nil { + return err + } + buf.Write(b) + return nil + case *structpb.ListValue: + b, err := v.MarshalJSON() + if err != nil { + return err + } + buf.Write(b) + return nil + default: + // Fallback for other well-known types (wrappers etc.): use protojson. + // These don't appear in generated OCSF protos but we handle them + // defensively. + return marshalWellKnownFallback(buf, msg) + } +} + +// marshalWellKnownFallback uses protojson to serialise any remaining well-known +// types not handled by the type switch above. +func marshalWellKnownFallback(buf *bytes.Buffer, msg protoreflect.Message) error { + // protojson doesn't export a low-level per-message marshaler easily, so we + // use the standard proto.Marshal -> json.RawMessage route by delegating + // through the concrete message interface. + // + // This path is only hit for wrapper types (DoubleValue, StringValue, etc.) + // which are rarely used in OCSF protos. We use encoding/json to re-encode + // the protojson output to avoid any escaping surprises. + type jsonMarshaler interface { + MarshalJSON() ([]byte, error) + } + if jm, ok := msg.Interface().(jsonMarshaler); ok { + b, err := jm.MarshalJSON() + if err != nil { + return err + } + buf.Write(b) + return nil + } + return fmt.Errorf("well-known type %q does not implement MarshalJSON", msg.Descriptor().FullName()) +} diff --git a/ocsf/internal/ocsf/exporter/exporter_test.go b/ocsf/internal/ocsf/exporter/exporter_test.go new file mode 100644 index 0000000..42eae94 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/exporter_test.go @@ -0,0 +1,352 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package exporter_test + +import ( + "bytes" + "encoding/json" + "strings" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/types/known/structpb" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" + samplev1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter/testdata/sample" +) + +// sampleMsg builds a fully-populated SampleEvent for use in tests. +func sampleMsg(t *testing.T) *samplev1.SampleEvent { + t.Helper() + + note := "some note" + metaVal, err := structpb.NewValue(map[string]any{ + "src_ip": "192.0.2.1", + "port": float64(443), + }) + require.NoError(t, err) + + return &samplev1.SampleEvent{ + SeverityId: samplev1.SampleEvent_SEVERITY_ID_CRITICAL, // 5 + Time: 1685403212834, + Count: 42, + MessageText: "login failed", + IsAlert: true, + Score: 3.14, + Metadata: metaVal, + Tags: []string{"alpha", "beta"}, + Actor: &samplev1.Actor{ + Name: "alice", + Uid: 9876543210, + }, + Note: ¬e, + } +} + +// TestToOCSFJSON_EnumIsNumber asserts that an enum field is serialised as a +// JSON number equal to the integer value (5 for SEVERITY_ID_CRITICAL), not a +// string like "SEVERITY_ID_CRITICAL". +func TestToOCSFJSON_EnumIsNumber(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + v, ok := m["severity_id"] + require.True(t, ok, "severity_id must be present") + + // After json.Unmarshal into map[string]any, numbers become float64. + f, isFloat := v.(float64) + require.True(t, isFloat, "severity_id must unmarshal as float64 (JSON number), got %T", v) + require.Equal(t, float64(5), f) +} + +// TestToOCSFJSON_Int64IsNumber asserts that int64 fields are emitted as +// unquoted JSON numbers, not quoted strings. We verify both at the structural +// level (correct numeric value) and at the byte level (no surrounding quotes +// around the number in the raw JSON). +func TestToOCSFJSON_Int64IsNumber(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + // Byte-level assertion: the raw JSON must contain `"time":1685403212834` + // (no surrounding quotes on the value). + require.True(t, bytes.Contains(out, []byte(`"time":1685403212834`)), + "time must be an unquoted JSON number; raw JSON: %s", out) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + v, ok := m["time"] + require.True(t, ok, "time must be present") + f, isFloat := v.(float64) + require.True(t, isFloat, "time must be a JSON number, got %T", v) + require.Equal(t, float64(1685403212834), f) +} + +// TestToOCSFJSON_SnakeCaseKeys asserts that JSON keys are snake_case, matching +// the proto field names, not camelCase. +func TestToOCSFJSON_SnakeCaseKeys(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + // snake_case keys must be present. + require.Contains(t, m, "severity_id", "severity_id (snake_case) must be a key") + require.Contains(t, m, "message_text", "message_text (snake_case) must be a key") + require.Contains(t, m, "is_alert", "is_alert (snake_case) must be a key") + + // camelCase keys must NOT appear. + require.NotContains(t, m, "severityId", "camelCase key severityId must not appear") + require.NotContains(t, m, "messageText", "camelCase key messageText must not appear") + require.NotContains(t, m, "isAlert", "camelCase key isAlert must not appear") +} + +// TestToOCSFJSON_UnsetOptionalAbsent asserts that an explicit optional field +// that was not set is omitted from the output entirely. +func TestToOCSFJSON_UnsetOptionalAbsent(t *testing.T) { + // Build a message WITHOUT the optional note field. + msg := &samplev1.SampleEvent{ + SeverityId: samplev1.SampleEvent_SEVERITY_ID_CRITICAL, + Time: 1685403212834, + MessageText: "test", + } + + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + _, present := m["note"] + require.False(t, present, "unset optional field 'note' must not appear in output") +} + +// TestToOCSFJSON_ZeroImplicitScalarAbsent asserts that a proto3 implicit- +// presence scalar at its zero value is omitted. +func TestToOCSFJSON_ZeroImplicitScalarAbsent(t *testing.T) { + msg := &samplev1.SampleEvent{ + MessageText: "non-zero", + // count, time, score, is_alert left at zero values + } + + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + _, hasCount := m["count"] + require.False(t, hasCount, "zero count must be omitted") + _, hasTime := m["time"] + require.False(t, hasTime, "zero time must be omitted") + _, hasScore := m["score"] + require.False(t, hasScore, "zero score must be omitted") + _, hasIsAlert := m["is_alert"] + require.False(t, hasIsAlert, "false is_alert must be omitted") +} + +// TestToOCSFJSON_RepeatedField asserts that repeated fields become JSON arrays. +func TestToOCSFJSON_RepeatedField(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + tagsRaw, ok := m["tags"] + require.True(t, ok, "tags must be present") + tags, ok := tagsRaw.([]any) + require.True(t, ok, "tags must be a JSON array, got %T", tagsRaw) + require.Len(t, tags, 2) + require.Equal(t, "alpha", tags[0]) + require.Equal(t, "beta", tags[1]) +} + +// TestToOCSFJSON_EmptyRepeatedAbsent asserts that an empty repeated field is +// omitted from the output. +func TestToOCSFJSON_EmptyRepeatedAbsent(t *testing.T) { + msg := &samplev1.SampleEvent{MessageText: "x"} + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + _, present := m["tags"] + require.False(t, present, "empty repeated field must be omitted") +} + +// TestToOCSFJSON_NestedMessage asserts that nested messages are serialised as +// JSON objects applying the same rules (snake_case keys, numeric int64). +func TestToOCSFJSON_NestedMessage(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + actorRaw, ok := m["actor"] + require.True(t, ok, "actor must be present") + actor, ok := actorRaw.(map[string]any) + require.True(t, ok, "actor must be a JSON object, got %T", actorRaw) + + require.Equal(t, "alice", actor["name"]) + + // uid is an int64 — must be a JSON number, not a string. + uidRaw, ok := actor["uid"] + require.True(t, ok, "uid must be present in actor") + _, isFloat := uidRaw.(float64) + require.True(t, isFloat, "actor.uid must be a JSON number, got %T", uidRaw) + + // Nested key must also be snake_case (uid is already snake, but verify no camelCase leaks). + require.NotContains(t, actor, "unknownFields") +} + +// TestToOCSFJSON_WellKnownValue asserts that google.protobuf.Value fields +// round-trip to their natural JSON representation. +func TestToOCSFJSON_WellKnownValue(t *testing.T) { + msg := sampleMsg(t) + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + metaRaw, ok := m["metadata"] + require.True(t, ok, "metadata must be present") + meta, ok := metaRaw.(map[string]any) + require.True(t, ok, "metadata must be a JSON object, got %T", metaRaw) + + require.Equal(t, "192.0.2.1", meta["src_ip"]) + require.Equal(t, float64(443), meta["port"]) +} + +// TestToOCSFJSON_Deterministic asserts that two calls on the same message +// produce byte-identical output. +func TestToOCSFJSON_Deterministic(t *testing.T) { + msg := sampleMsg(t) + + out1, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + out2, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + require.Equal(t, string(out1), string(out2), + "ToOCSFJSON must be deterministic: two calls on same message must be byte-identical") +} + +// TestToOCSFJSON_DivergenceFromProtojson proves that ToOCSFJSON is necessary by +// showing stock protojson.Marshal diverges on at least three points: +// +// (a) enum: stock emits the name string; ToOCSFJSON emits the integer. +// (b) int64: stock emits a quoted string; ToOCSFJSON emits an unquoted number. +// (c) key casing: stock emits camelCase; ToOCSFJSON emits snake_case. +func TestToOCSFJSON_DivergenceFromProtojson(t *testing.T) { + msg := sampleMsg(t) + + // Stock protojson output. + stockBytes, err := protojson.Marshal(msg) + require.NoError(t, err) + stockStr := string(stockBytes) + + // Our exporter output. + ourBytes, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + ourStr := string(ourBytes) + + // (a) Enum: stock emits name string; we emit integer. + require.True(t, strings.Contains(stockStr, "SEVERITY_ID_CRITICAL"), + "stock protojson must emit the enum name string, got: %s", stockStr) + require.False(t, strings.Contains(ourStr, "SEVERITY_ID_CRITICAL"), + "ToOCSFJSON must NOT emit enum name strings, got: %s", ourStr) + require.True(t, strings.Contains(ourStr, `"severity_id":5`), + "ToOCSFJSON must emit severity_id as integer 5, got: %s", ourStr) + + // (b) int64: stock emits quoted string; we emit unquoted number. + require.True(t, strings.Contains(stockStr, `"1685403212834"`), + "stock protojson must emit int64 as a quoted string, got: %s", stockStr) + require.True(t, bytes.Contains(ourBytes, []byte(`"time":1685403212834`)), + "ToOCSFJSON must emit time as unquoted number, got: %s", ourStr) + + // (c) Key casing: stock uses camelCase; we use snake_case. + // stock must NOT have snake_case severity_id directly (it uses severityId) + // and must NOT have snake_case message_text (it uses messageText). + require.True(t, strings.Contains(stockStr, "severityId") || strings.Contains(stockStr, "messageText"), + "stock protojson must emit camelCase keys, got: %s", stockStr) + require.False(t, strings.Contains(ourStr, "severityId"), + "ToOCSFJSON must not emit camelCase severityId, got: %s", ourStr) + require.False(t, strings.Contains(ourStr, "messageText"), + "ToOCSFJSON must not emit camelCase messageText, got: %s", ourStr) +} + +// TestToOCSFJSON_RepeatedEnumIsIntArray asserts that a repeated enum field +// marshals to a JSON array of integers, not name strings. This directly +// validates the headline requirement: enums are always integers, including in +// the repeated position (e.g. [5,99], never ["SEVERITY_ID_CRITICAL",...]). +func TestToOCSFJSON_RepeatedEnumIsIntArray(t *testing.T) { + msg := &samplev1.SampleEvent{ + MessageText: "repeated enum test", + Severities: []samplev1.SampleEvent_SeverityId{ + samplev1.SampleEvent_SEVERITY_ID_CRITICAL, // 5 + samplev1.SampleEvent_SEVERITY_ID_OTHER, // 99 + }, + } + + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + raw, ok := m["severities"] + require.True(t, ok, "severities must be present") + + arr, ok := raw.([]any) + require.True(t, ok, "severities must be a JSON array, got %T", raw) + require.Len(t, arr, 2) + + // Each element must be a JSON number (float64 after unmarshal), not a string. + f0, ok := arr[0].(float64) + require.True(t, ok, "severities[0] must be a JSON number, got %T", arr[0]) + require.Equal(t, float64(5), f0, "severities[0] must be 5 (SEVERITY_ID_CRITICAL)") + + f1, ok := arr[1].(float64) + require.True(t, ok, "severities[1] must be a JSON number, got %T", arr[1]) + require.Equal(t, float64(99), f1, "severities[1] must be 99 (SEVERITY_ID_OTHER)") + + // Byte-level check: no enum name strings in the output. + require.False(t, strings.Contains(string(out), "SEVERITY_ID"), + "ToOCSFJSON must not emit enum name strings in repeated field, got: %s", out) +} + +// TestToOCSFJSON_OptionalSetPresent asserts that an optional field that IS set +// appears in the output. +func TestToOCSFJSON_OptionalSetPresent(t *testing.T) { + msg := sampleMsg(t) // note is set to "some note" in sampleMsg + out, err := exporter.ToOCSFJSON(msg) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(out, &m)) + + v, present := m["note"] + require.True(t, present, "set optional field 'note' must appear in output") + require.Equal(t, "some note", v) +} diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/buf.gen.yaml b/ocsf/internal/ocsf/exporter/testdata/sample/buf.gen.yaml new file mode 100644 index 0000000..535b289 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/testdata/sample/buf.gen.yaml @@ -0,0 +1,7 @@ +version: v2 +plugins: + - local: protoc-gen-go + out: . + opt: paths=source_relative +inputs: + - directory: . diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/buf.lock b/ocsf/internal/ocsf/exporter/testdata/sample/buf.lock new file mode 100644 index 0000000..4f98143 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/testdata/sample/buf.lock @@ -0,0 +1,2 @@ +# Generated by buf. DO NOT EDIT. +version: v2 diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/buf.yaml b/ocsf/internal/ocsf/exporter/testdata/sample/buf.yaml new file mode 100644 index 0000000..9dbc13f --- /dev/null +++ b/ocsf/internal/ocsf/exporter/testdata/sample/buf.yaml @@ -0,0 +1,15 @@ +version: v2 +modules: + - path: . +deps: [] +lint: + use: + - STANDARD + except: + # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values. + - ENUM_ZERO_VALUE_SUFFIX + # The package doesn't follow standard versioning conventions. + - PACKAGE_VERSION_SUFFIX +breaking: + use: + - FILE diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go new file mode 100644 index 0000000..8356e3c --- /dev/null +++ b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go @@ -0,0 +1,362 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Test message for the OCSF JSON exporter. DO NOT USE in production. + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.6 +// protoc (unknown) +// source: sample.proto + +package samplev1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + structpb "google.golang.org/protobuf/types/known/structpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// SeverityId is an OCSF-style integer-keyed enum. +type SampleEvent_SeverityId int32 + +const ( + SampleEvent_SEVERITY_ID_UNKNOWN SampleEvent_SeverityId = 0 + SampleEvent_SEVERITY_ID_CRITICAL SampleEvent_SeverityId = 5 + SampleEvent_SEVERITY_ID_OTHER SampleEvent_SeverityId = 99 +) + +// Enum value maps for SampleEvent_SeverityId. +var ( + SampleEvent_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 5: "SEVERITY_ID_CRITICAL", + 99: "SEVERITY_ID_OTHER", + } + SampleEvent_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x SampleEvent_SeverityId) Enum() *SampleEvent_SeverityId { + p := new(SampleEvent_SeverityId) + *p = x + return p +} + +func (x SampleEvent_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (SampleEvent_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_sample_proto_enumTypes[0].Descriptor() +} + +func (SampleEvent_SeverityId) Type() protoreflect.EnumType { + return &file_sample_proto_enumTypes[0] +} + +func (x SampleEvent_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use SampleEvent_SeverityId.Descriptor instead. +func (SampleEvent_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_sample_proto_rawDescGZIP(), []int{0, 0} +} + +type SampleEvent struct { + state protoimpl.MessageState `protogen:"open.v1"` + // severity_id exercises enum -> integer conversion. + SeverityId SampleEvent_SeverityId `protobuf:"varint,1,opt,name=severity_id,json=severityId,proto3,enum=ocsf.exporter.sample.v1.SampleEvent_SeverityId" json:"severity_id,omitempty"` + // time is an int64 (timestamp_t in OCSF) — must be a JSON number, not quoted. + Time int64 `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"` + // count is an int32. + Count int32 `protobuf:"varint,3,opt,name=count,proto3" json:"count,omitempty"` + // message_text is a plain string field. + MessageText string `protobuf:"bytes,4,opt,name=message_text,json=messageText,proto3" json:"message_text,omitempty"` + // is_alert is a bool. + IsAlert bool `protobuf:"varint,5,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + // score is a double. + Score float64 `protobuf:"fixed64,6,opt,name=score,proto3" json:"score,omitempty"` + // metadata is a google.protobuf.Value (OCSF json_t / unmapped bag). + Metadata *structpb.Value `protobuf:"bytes,7,opt,name=metadata,proto3" json:"metadata,omitempty"` + // tags is a repeated string. + Tags []string `protobuf:"bytes,8,rep,name=tags,proto3" json:"tags,omitempty"` + // actor is a nested message. + Actor *Actor `protobuf:"bytes,9,opt,name=actor,proto3" json:"actor,omitempty"` + // note is an explicit optional string; absent when unset. + Note *string `protobuf:"bytes,10,opt,name=note,proto3,oneof" json:"note,omitempty"` + // severities is a repeated enum field; must marshal to a JSON array of + // integers (e.g. [5,99]), never name strings. + Severities []SampleEvent_SeverityId `protobuf:"varint,11,rep,packed,name=severities,proto3,enum=ocsf.exporter.sample.v1.SampleEvent_SeverityId" json:"severities,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SampleEvent) Reset() { + *x = SampleEvent{} + mi := &file_sample_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SampleEvent) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SampleEvent) ProtoMessage() {} + +func (x *SampleEvent) ProtoReflect() protoreflect.Message { + mi := &file_sample_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SampleEvent.ProtoReflect.Descriptor instead. +func (*SampleEvent) Descriptor() ([]byte, []int) { + return file_sample_proto_rawDescGZIP(), []int{0} +} + +func (x *SampleEvent) GetSeverityId() SampleEvent_SeverityId { + if x != nil { + return x.SeverityId + } + return SampleEvent_SEVERITY_ID_UNKNOWN +} + +func (x *SampleEvent) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *SampleEvent) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *SampleEvent) GetMessageText() string { + if x != nil { + return x.MessageText + } + return "" +} + +func (x *SampleEvent) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *SampleEvent) GetScore() float64 { + if x != nil { + return x.Score + } + return 0 +} + +func (x *SampleEvent) GetMetadata() *structpb.Value { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *SampleEvent) GetTags() []string { + if x != nil { + return x.Tags + } + return nil +} + +func (x *SampleEvent) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *SampleEvent) GetNote() string { + if x != nil && x.Note != nil { + return *x.Note + } + return "" +} + +func (x *SampleEvent) GetSeverities() []SampleEvent_SeverityId { + if x != nil { + return x.Severities + } + return nil +} + +type Actor struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Uid int64 `protobuf:"varint,2,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Actor) Reset() { + *x = Actor{} + mi := &file_sample_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Actor) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Actor) ProtoMessage() {} + +func (x *Actor) ProtoReflect() protoreflect.Message { + mi := &file_sample_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Actor.ProtoReflect.Descriptor instead. +func (*Actor) Descriptor() ([]byte, []int) { + return file_sample_proto_rawDescGZIP(), []int{1} +} + +func (x *Actor) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Actor) GetUid() int64 { + if x != nil { + return x.Uid + } + return 0 +} + +var File_sample_proto protoreflect.FileDescriptor + +const file_sample_proto_rawDesc = "" + + "\n" + + "\fsample.proto\x12\x17ocsf.exporter.sample.v1\x1a\x1cgoogle/protobuf/struct.proto\"\xa6\x04\n" + + "\vSampleEvent\x12P\n" + + "\vseverity_id\x18\x01 \x01(\x0e2/.ocsf.exporter.sample.v1.SampleEvent.SeverityIdR\n" + + "severityId\x12\x12\n" + + "\x04time\x18\x02 \x01(\x03R\x04time\x12\x14\n" + + "\x05count\x18\x03 \x01(\x05R\x05count\x12!\n" + + "\fmessage_text\x18\x04 \x01(\tR\vmessageText\x12\x19\n" + + "\bis_alert\x18\x05 \x01(\bR\aisAlert\x12\x14\n" + + "\x05score\x18\x06 \x01(\x01R\x05score\x122\n" + + "\bmetadata\x18\a \x01(\v2\x16.google.protobuf.ValueR\bmetadata\x12\x12\n" + + "\x04tags\x18\b \x03(\tR\x04tags\x124\n" + + "\x05actor\x18\t \x01(\v2\x1e.ocsf.exporter.sample.v1.ActorR\x05actor\x12\x17\n" + + "\x04note\x18\n" + + " \x01(\tH\x00R\x04note\x88\x01\x01\x12O\n" + + "\n" + + "severities\x18\v \x03(\x0e2/.ocsf.exporter.sample.v1.SampleEvent.SeverityIdR\n" + + "severities\"V\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10cB\a\n" + + "\x05_note\"-\n" + + "\x05Actor\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" + + "\x03uid\x18\x02 \x01(\x03R\x03uidBYZWgithub.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter/testdata/sample;samplev1b\x06proto3" + +var ( + file_sample_proto_rawDescOnce sync.Once + file_sample_proto_rawDescData []byte +) + +func file_sample_proto_rawDescGZIP() []byte { + file_sample_proto_rawDescOnce.Do(func() { + file_sample_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sample_proto_rawDesc), len(file_sample_proto_rawDesc))) + }) + return file_sample_proto_rawDescData +} + +var file_sample_proto_enumTypes = make([]protoimpl.EnumInfo, 1) +var file_sample_proto_msgTypes = make([]protoimpl.MessageInfo, 2) +var file_sample_proto_goTypes = []any{ + (SampleEvent_SeverityId)(0), // 0: ocsf.exporter.sample.v1.SampleEvent.SeverityId + (*SampleEvent)(nil), // 1: ocsf.exporter.sample.v1.SampleEvent + (*Actor)(nil), // 2: ocsf.exporter.sample.v1.Actor + (*structpb.Value)(nil), // 3: google.protobuf.Value +} +var file_sample_proto_depIdxs = []int32{ + 0, // 0: ocsf.exporter.sample.v1.SampleEvent.severity_id:type_name -> ocsf.exporter.sample.v1.SampleEvent.SeverityId + 3, // 1: ocsf.exporter.sample.v1.SampleEvent.metadata:type_name -> google.protobuf.Value + 2, // 2: ocsf.exporter.sample.v1.SampleEvent.actor:type_name -> ocsf.exporter.sample.v1.Actor + 0, // 3: ocsf.exporter.sample.v1.SampleEvent.severities:type_name -> ocsf.exporter.sample.v1.SampleEvent.SeverityId + 4, // [4:4] is the sub-list for method output_type + 4, // [4:4] is the sub-list for method input_type + 4, // [4:4] is the sub-list for extension type_name + 4, // [4:4] is the sub-list for extension extendee + 0, // [0:4] is the sub-list for field type_name +} + +func init() { file_sample_proto_init() } +func file_sample_proto_init() { + if File_sample_proto != nil { + return + } + file_sample_proto_msgTypes[0].OneofWrappers = []any{} + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_sample_proto_rawDesc), len(file_sample_proto_rawDesc)), + NumEnums: 1, + NumMessages: 2, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_sample_proto_goTypes, + DependencyIndexes: file_sample_proto_depIdxs, + EnumInfos: file_sample_proto_enumTypes, + MessageInfos: file_sample_proto_msgTypes, + }.Build() + File_sample_proto = out.File + file_sample_proto_goTypes = nil + file_sample_proto_depIdxs = nil +} diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto b/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto new file mode 100644 index 0000000..360c5e5 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto @@ -0,0 +1,65 @@ +// Copyright 2024 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Test message for the OCSF JSON exporter. DO NOT USE in production. +syntax = "proto3"; + +package ocsf.exporter.sample.v1; + +import "google/protobuf/struct.proto"; + +option go_package = "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter/testdata/sample;samplev1"; + +message SampleEvent { + // SeverityId is an OCSF-style integer-keyed enum. + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_OTHER = 99; + } + + // severity_id exercises enum -> integer conversion. + SeverityId severity_id = 1; + + // time is an int64 (timestamp_t in OCSF) — must be a JSON number, not quoted. + int64 time = 2; + + // count is an int32. + int32 count = 3; + + // message_text is a plain string field. + string message_text = 4; + + // is_alert is a bool. + bool is_alert = 5; + + // score is a double. + double score = 6; + + // metadata is a google.protobuf.Value (OCSF json_t / unmapped bag). + google.protobuf.Value metadata = 7; + + // tags is a repeated string. + repeated string tags = 8; + + // actor is a nested message. + Actor actor = 9; + + // note is an explicit optional string; absent when unset. + optional string note = 10; + + // severities is a repeated enum field; must marshal to a JSON array of + // integers (e.g. [5,99]), never name strings. + repeated SeverityId severities = 11; +} + +message Actor { + string name = 1; + int64 uid = 2; +} From ac2e48cd5ae4c78db77eb3018d82a7033d6764d9 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:09:16 +0200 Subject: [PATCH 06/26] feat(ocsf): add ocsf-protogen CLI with compat gate generate mode emits the proto and saves the tag map; --check gates on output drift and newly-stubbed objects; --compat-check runs CheckCompat between the base-ref and current field-number maps to enforce wire stability. Includes the committed baseline proto and field-numbers.json. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/cmd/ocsf-protogen/main.go | 152 + ocsf/cmd/ocsf-protogen/protogen/protogen.go | 185 + .../ocsf-protogen/protogen/protogen_test.go | 373 ++ .../ocsf-protogen/testdata/api_entity.proto | 3085 +++++++++++++++++ ocsf/cmd/ocsf-protogen/testdata/buf.lock | 6 + ocsf/cmd/ocsf-protogen/testdata/buf.yaml | 16 + .../ocsf-protogen/testdata/field-numbers.json | 1996 +++++++++++ 7 files changed, 5813 insertions(+) create mode 100644 ocsf/cmd/ocsf-protogen/main.go create mode 100644 ocsf/cmd/ocsf-protogen/protogen/protogen.go create mode 100644 ocsf/cmd/ocsf-protogen/protogen/protogen_test.go create mode 100644 ocsf/cmd/ocsf-protogen/testdata/api_entity.proto create mode 100644 ocsf/cmd/ocsf-protogen/testdata/buf.lock create mode 100644 ocsf/cmd/ocsf-protogen/testdata/buf.yaml create mode 100644 ocsf/cmd/ocsf-protogen/testdata/field-numbers.json diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go new file mode 100644 index 0000000..19a48a8 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -0,0 +1,152 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Command ocsf-protogen generates proto3 definitions from a compiled OCSF +// schema JSON export. +// +// Normal mode (no --check): +// +// ocsf-protogen \ +// --schema ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json \ +// --classes api_activity,entity_management \ +// --version 1.8.0 \ +// --out ocsf/cmd/ocsf-protogen/testdata/api_entity.proto \ +// --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json +// +// Check mode (for CI — verifies committed baseline is up-to-date): +// +// ocsf-protogen --check \ +// --schema ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json \ +// --classes api_activity,entity_management \ +// --version 1.8.0 \ +// --out ocsf/cmd/ocsf-protogen/testdata/api_entity.proto \ +// --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json +// +// Compat-check mode (for CI — verifies field numbers didn't regress vs base branch): +// +// ocsf-protogen --compat-check \ +// --old /tmp/old-field-numbers.json \ +// --new ocsf/cmd/ocsf-protogen/testdata/field-numbers.json +package main + +import ( + "errors" + "flag" + "fmt" + "os" + "path/filepath" + "runtime" + "strings" + + "github.com/redpanda-data/common-go/ocsf/cmd/ocsf-protogen/protogen" +) + +// defaultSchemaPath returns the path to the committed schema fixture relative +// to this source file. It resolves correctly whether the binary is invoked +// from any working directory via `go run`. +// +// NOTE: this path is only meaningful for `go run` and tests; compiled binaries +// embed no source path and must pass --schema explicitly. +func defaultSchemaPath() string { + _, thisFile, _, ok := runtime.Caller(0) + if !ok { + return "" + } + return filepath.Join(filepath.Dir(thisFile), "..", "..", "internal", "ocsf", "schema", "testdata", "ocsf-1.8.0.json") +} + +func main() { + if err := run(os.Args[1:]); err != nil { + fmt.Fprintf(os.Stderr, "ocsf-protogen: %v\n", err) + os.Exit(1) + } +} + +func run(args []string) error { + fs := flag.NewFlagSet("ocsf-protogen", flag.ContinueOnError) + fs.SetOutput(os.Stderr) + + schemaFlag := fs.String("schema", defaultSchemaPath(), "path to compiled OCSF schema JSON") + classesFlag := fs.String("classes", "", "comma-separated OCSF class names (e.g. api_activity,entity_management)") + versionFlag := fs.String("version", "1.8.0", "OCSF schema version string (e.g. 1.8.0)") + outFlag := fs.String("out", "", "output .proto file path (required)") + tagmapFlag := fs.String("tagmap", "", "path to field-numbers JSON (created on first run)") + checkFlag := fs.Bool("check", false, "check committed baseline matches fresh generation (for CI)") + compatCheckFlag := fs.Bool("compat-check", false, "check wire stability between two tagmap files (use with --old and --new)") + oldFlag := fs.String("old", "", "path to the base-branch tagmap JSON (for --compat-check)") + newFlag := fs.String("new", "", "path to the PR tagmap JSON (for --compat-check)") + + if err := fs.Parse(args); err != nil { + return err + } + + // --compat-check is a standalone mode: compare --old and --new tagmaps. + if *compatCheckFlag { + if strings.TrimSpace(*oldFlag) == "" { + return errors.New("--compat-check requires --old ") + } + if strings.TrimSpace(*newFlag) == "" { + return errors.New("--compat-check requires --new ") + } + if err := protogen.CompatCheck(*oldFlag, *newFlag); err != nil { + return err + } + fmt.Println("ok") + return nil + } + + // Validate required flags for generate / check modes. + if strings.TrimSpace(*outFlag) == "" { + return errors.New("--out is required") + } + if strings.TrimSpace(*tagmapFlag) == "" { + return errors.New("--tagmap is required") + } + + classes, err := protogen.ParseClasses(*classesFlag) + if err != nil { + return err + } + + cfg := protogen.Config{ + SchemaPath: *schemaFlag, + Classes: classes, + Version: *versionFlag, + OutPath: *outFlag, + TagmapPath: *tagmapFlag, + Check: *checkFlag, + } + + if cfg.Check { + if err := protogen.Check(cfg); err != nil { + return err + } + fmt.Println("ok") + return nil + } + + stubbed, err := protogen.Generate(cfg) + if err != nil { + return err + } + + if len(stubbed) > 0 { + fmt.Fprintf(os.Stderr, "WARNING: the following objects are referenced in attributes but absent "+ + "from the schema snapshot and were emitted as empty stubs:\n") + for _, name := range stubbed { + fmt.Fprintf(os.Stderr, " - %s\n", name) + } + fmt.Fprintf(os.Stderr, "This is expected for partial schema exports. "+ + "Re-run with a full schema snapshot to resolve.\n") + } + + fmt.Printf("wrote %s\n", cfg.OutPath) + fmt.Printf("saved tagmap %s\n", cfg.TagmapPath) + return nil +} diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go new file mode 100644 index 0000000..2afa2a6 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -0,0 +1,185 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package protogen contains the testable logic for the ocsf-protogen CLI. +// main.go stays thin; everything that can be unit-tested lives here. +package protogen + +import ( + "errors" + "fmt" + "os" + "strings" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// Config holds the parsed CLI parameters. +type Config struct { + SchemaPath string + Classes []string + Version string + OutPath string + TagmapPath string + Check bool +} + +// Generate loads the schema, emits the proto, writes --out and --tagmap. +// Returns the stubbed object names (may be nil) and any error. +func Generate(cfg Config) (stubbed []string, err error) { + s, err := schema.LoadFile(cfg.SchemaPath) + if err != nil { + return nil, fmt.Errorf("load schema: %w", err) + } + + if cfg.Version != s.Version { + return nil, fmt.Errorf("--version %q does not match schema version %q", cfg.Version, s.Version) + } + + tm, err := tagmap.Load(cfg.TagmapPath) + if err != nil { + return nil, fmt.Errorf("load tagmap: %w", err) + } + + protoOut, stubbed, err := gen.Emit(s, cfg.Classes, tm, cfg.Version) + if err != nil { + return nil, fmt.Errorf("emit proto: %w", err) + } + + if err := os.WriteFile(cfg.OutPath, []byte(protoOut), 0o600); err != nil { + return nil, fmt.Errorf("write proto to %q: %w", cfg.OutPath, err) + } + + if err := tm.Save(cfg.TagmapPath); err != nil { + return nil, fmt.Errorf("save tagmap to %q: %w", cfg.TagmapPath, err) + } + + return stubbed, nil +} + +// Check regenerates the proto in memory and detects drift vs. the committed +// baseline files (--out and --tagmap). It returns a non-nil error with a +// descriptive message when: +// - the tagmap is incompatible (tag number changed, dropped without reserve, etc.) +// - the emitted proto text differs from the committed --out file +// - stubbed objects appear in the output (indicates schema regression) +func Check(cfg Config) error { + s, err := schema.LoadFile(cfg.SchemaPath) + if err != nil { + return fmt.Errorf("load schema: %w", err) + } + + if cfg.Version != s.Version { + return fmt.Errorf("--version %q does not match schema version %q", cfg.Version, s.Version) + } + + // Load the committed tagmap as "old". + oldTM, err := tagmap.Load(cfg.TagmapPath) + if err != nil { + return fmt.Errorf("load committed tagmap: %w", err) + } + + // Create a fresh copy to emit into ("new"). + newTM, err := tagmap.Load(cfg.TagmapPath) + if err != nil { + return fmt.Errorf("copy tagmap for check: %w", err) + } + + protoOut, stubbed, err := gen.Emit(s, cfg.Classes, newTM, cfg.Version) + if err != nil { + return fmt.Errorf("emit proto: %w", err) + } + + // Read the committed proto before the diff so we can compare stub lists. + committedBytes, err := os.ReadFile(cfg.OutPath) + if err != nil { + return fmt.Errorf("read committed proto %q: %w", cfg.OutPath, err) + } + + // Stubs in --check are only a hard failure when they are NEW (i.e. absent + // from the committed baseline). An existing partial schema fixture may + // legitimately produce stubs, and the proto-drift check below already + // catches any regression. We detect "new" stubs by checking whether the + // fresh proto introduces stub declarations not present in the baseline. + for _, stubName := range stubbed { + stubDecl := "message " + stubName + " {}" + if !strings.Contains(string(committedBytes), stubDecl) { + return fmt.Errorf("new stub message %q appeared in generated proto but is absent from committed baseline — "+ + "schema regression or missing object in schema snapshot", stubName) + } + } + + // Tag-map compatibility. + if err := tagmap.CheckCompat(oldTM, newTM); err != nil { + return fmt.Errorf("tagmap incompatibility detected (regenerate and commit field-numbers.json):\n%w", err) + } + + // Proto content drift. + if string(committedBytes) != protoOut { + return fmt.Errorf( + "committed proto %q differs from freshly generated output "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + cfg.OutPath, + ) + } + + return nil +} + +// CompatCheck loads two tagmap JSON files and runs CheckCompat(old, new). +// +// If oldPath does not exist (bootstrap: the baseline didn't exist on the base +// branch yet), CompatCheck returns nil and prints a diagnostic to stderr so CI +// remains green on the first PR that introduces the tagmap. +// +// Returns a non-nil error with a descriptive message if the new tagmap breaks +// wire stability (tag changed, tag dropped without reserve, reserved tag reused). +func CompatCheck(oldPath, newPath string) error { + oldTM, err := tagmap.Load(oldPath) + if err != nil { + // tagmap.Load returns a new empty map for a missing file (ErrNotExist). + // Any other error (permissions, malformed JSON) is a hard failure. + return fmt.Errorf("load old tagmap %q: %w", oldPath, err) + } + + // Distinguish "file did not exist" (empty map from Load) from a real load. + // We need to check via os.Stat so we can print the bootstrap message. + if _, statErr := os.Stat(oldPath); os.IsNotExist(statErr) { + fmt.Fprintf(os.Stderr, "no prior tagmap at %q; skipping compat check (bootstrap)\n", oldPath) + return nil + } + + newTM, err := tagmap.Load(newPath) + if err != nil { + return fmt.Errorf("load new tagmap %q: %w", newPath, err) + } + + if err := tagmap.CheckCompat(oldTM, newTM); err != nil { + return fmt.Errorf("tagmap compat check failed (field numbers changed between base and PR):\n%w", err) + } + return nil +} + +// ParseClasses splits a comma-separated class list and trims whitespace. +// Returns an error if the result is empty. +func ParseClasses(s string) ([]string, error) { + var out []string + for _, part := range strings.Split(s, ",") { + trimmed := strings.TrimSpace(part) + if trimmed != "" { + out = append(out, trimmed) + } + } + if len(out) == 0 { + return nil, errors.New("--classes must be a non-empty comma-separated list") + } + return out, nil +} diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go new file mode 100644 index 0000000..237fe14 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -0,0 +1,373 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package protogen_test + +import ( + "encoding/json" + "os" + "path/filepath" + "runtime" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/cmd/ocsf-protogen/protogen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// schemaFixture returns the absolute path to the committed OCSF schema fixture. +func schemaFixture() string { + _, thisFile, _, ok := runtime.Caller(0) + if !ok { + panic("runtime.Caller failed") + } + // thisFile: .../ocsf/cmd/ocsf-protogen/protogen/protogen_test.go + // schema: .../ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json + root := filepath.Join(filepath.Dir(thisFile), "..", "..", "..", "internal", "ocsf", "schema", "testdata") + return filepath.Join(root, "ocsf-1.8.0.json") +} + +// committedBaseline returns the absolute path to the committed proto baseline +// and field-numbers.json that were generated from the CLI. +func committedBaseline() (protoPath, tagmapPath string) { + _, thisFile, _, ok := runtime.Caller(0) + if !ok { + panic("runtime.Caller failed") + } + // testdata is at .../ocsf/cmd/ocsf-protogen/testdata/ + td := filepath.Join(filepath.Dir(thisFile), "..", "testdata") + return filepath.Join(td, "api_entity.proto"), filepath.Join(td, "field-numbers.json") +} + +// ─── ParseClasses ───────────────────────────────────────────────────────────── + +func TestParseClasses_Valid(t *testing.T) { + got, err := protogen.ParseClasses("api_activity,entity_management") + require.NoError(t, err) + require.Equal(t, []string{"api_activity", "entity_management"}, got) +} + +func TestParseClasses_Whitespace(t *testing.T) { + got, err := protogen.ParseClasses(" api_activity , entity_management ") + require.NoError(t, err) + require.Equal(t, []string{"api_activity", "entity_management"}, got) +} + +func TestParseClasses_Single(t *testing.T) { + got, err := protogen.ParseClasses("api_activity") + require.NoError(t, err) + require.Equal(t, []string{"api_activity"}, got) +} + +func TestParseClasses_Empty(t *testing.T) { + _, err := protogen.ParseClasses("") + require.Error(t, err) +} + +func TestParseClasses_OnlyCommas(t *testing.T) { + _, err := protogen.ParseClasses(",,,") + require.Error(t, err) +} + +// ─── Generate → Check (round-trip) ─────────────────────────────────────────── + +// TestGenerateThenCheck generates into a temp dir, then runs Check against the +// same temp dir and asserts it passes (exit 0 equivalent). +func TestGenerateThenCheck(t *testing.T) { + dir := t.TempDir() + outPath := filepath.Join(dir, "out.proto") + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutPath: outPath, + TagmapPath: tagmapPath, + Check: false, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Both files should have been created. + require.FileExists(t, outPath) + require.FileExists(t, tagmapPath) + + // --check against the just-generated baseline must pass. + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.NoError(t, err, "--check must pass immediately after Generate on the same baseline") +} + +// ─── Check: tagmap incompatibility ──────────────────────────────────────────── + +// TestCheckFailsOnProtoDriftFromEditedTagmap verifies that protogen.Check +// detects proto drift when the on-disk tagmap has been manually edited so that +// a field's assigned tag differs from what Emit would use, causing the freshly +// generated proto to diverge from the committed baseline. +func TestCheckFailsOnProtoDriftFromEditedTagmap(t *testing.T) { + dir := t.TempDir() + outPath := filepath.Join(dir, "out.proto") + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutPath: outPath, + TagmapPath: tagmapPath, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Modify a field tag in the tagmap so that Emit re-uses the stored (now + // different) tag when Check runs. The proto content will then differ from + // the committed baseline (which was generated with the original tags). + raw, err := os.ReadFile(tagmapPath) + require.NoError(t, err) + + var wireTop map[string]json.RawMessage + require.NoError(t, json.Unmarshal(raw, &wireTop)) + + type msgEntry struct { + Fields map[string]int32 `json:"fields"` + Reserved []int32 `json:"reserved"` + } + + // Change one field in one message to tag 9998 (unlikely to collide). + changed := false + for msgName, msgRaw := range wireTop { + var entry msgEntry + if err := json.Unmarshal(msgRaw, &entry); err != nil || len(entry.Fields) == 0 { + continue + } + for attrName := range entry.Fields { + entry.Fields[attrName] = 9998 + b, err := json.Marshal(entry) + require.NoError(t, err) + wireTop[msgName] = b + changed = true + break + } + if changed { + break + } + } + require.True(t, changed, "test setup: must have found at least one field to change") + + out, err := json.MarshalIndent(wireTop, "", " ") + require.NoError(t, err) + require.NoError(t, os.WriteFile(tagmapPath, out, 0o644)) + + // outPath still contains the proto from the original generate (original tags). + // The corrupted tagmap causes Emit to assign tag 9998 to that field. + // Proto diff fires because the committed proto uses the original tag. + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.Error(t, err, "--check must fail when tagmap causes different proto output") + require.Contains(t, err.Error(), "differs", "error must report proto drift") +} + +// ─── Check: proto drift ──────────────────────────────────────────────────────── + +// TestCheckFailsOnProtoDrift generates a baseline, edits the committed proto +// file, and asserts Check detects the drift. +func TestCheckFailsOnProtoDrift(t *testing.T) { + dir := t.TempDir() + outPath := filepath.Join(dir, "out.proto") + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutPath: outPath, + TagmapPath: tagmapPath, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Corrupt the committed proto file. + content, err := os.ReadFile(outPath) + require.NoError(t, err) + corrupted := string(content) + "\n// CORRUPTED BY TEST\n" + require.NoError(t, os.WriteFile(outPath, []byte(corrupted), 0o644)) + + // Check must fail with a drift error. + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.Error(t, err, "--check must fail when committed proto differs from fresh output") + require.Contains(t, err.Error(), "differs", "error must describe the drift") +} + +// ─── Check: committed baseline ─────────────────────────────────────────────── + +// TestCheckAgainstCommittedBaseline runs --check against the files committed to +// the repository (testdata/api_entity.proto and testdata/field-numbers.json). +// This test fails if the committed baseline drifts from what the generator +// would produce today. +func TestCheckAgainstCommittedBaseline(t *testing.T) { + protoPath, tagmapPath := committedBaseline() + + // Skip gracefully if the committed baseline does not exist yet + // (before the first `go run ./cmd/ocsf-protogen --out ... --tagmap ...` is run). + if _, err := os.Stat(protoPath); os.IsNotExist(err) { + t.Skip("committed baseline not yet generated; run: go run ./cmd/ocsf-protogen ...") + } + if _, err := os.Stat(tagmapPath); os.IsNotExist(err) { + t.Skip("committed baseline not yet generated; run: go run ./cmd/ocsf-protogen ...") + } + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutPath: protoPath, + TagmapPath: tagmapPath, + Check: true, + } + + err := protogen.Check(cfg) + require.NoError(t, err, "--check must pass against the committed baseline") +} + +// ─── Version cross-check ────────────────────────────────────────────────────── + +// TestGenerateVersionMismatch verifies that Generate returns an error when +// --version does not match the schema's own version field (Fix 2). +func TestGenerateVersionMismatch(t *testing.T) { + dir := t.TempDir() + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "9.9.9", // wrong: schema is 1.8.0 + OutPath: filepath.Join(dir, "out.proto"), + TagmapPath: filepath.Join(dir, "field-numbers.json"), + } + _, err := protogen.Generate(cfg) + require.Error(t, err, "Generate must fail when --version mismatches schema version") + require.Contains(t, err.Error(), "9.9.9") + require.Contains(t, err.Error(), "1.8.0") +} + +// TestCheckVersionMismatch verifies that Check returns an error when +// --version does not match the schema's own version field (Fix 2). +func TestCheckVersionMismatch(t *testing.T) { + dir := t.TempDir() + // First generate a valid baseline with the correct version. + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "1.8.0", + OutPath: filepath.Join(dir, "out.proto"), + TagmapPath: filepath.Join(dir, "field-numbers.json"), + } + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Now check with the wrong version. + cfg.Version = "9.9.9" + cfg.Check = true + err = protogen.Check(cfg) + require.Error(t, err, "Check must fail when --version mismatches schema version") + require.Contains(t, err.Error(), "9.9.9") + require.Contains(t, err.Error(), "1.8.0") +} + +// ─── CompatCheck ───────────────────────────────────────────────────────────── + +// writeTagmap writes a minimal tagmap JSON with a single message "Msg" and the +// given field→tag assignments to a temp file and returns its path. +func writeTagmap(t *testing.T, fields map[string]int32) string { + t.Helper() + type msgEntry struct { + Fields map[string]int32 `json:"fields"` + Reserved []int32 `json:"reserved"` + } + wire := map[string]msgEntry{ + "Msg": {Fields: fields, Reserved: nil}, + } + b, err := json.MarshalIndent(wire, "", " ") + require.NoError(t, err) + f, err := os.CreateTemp(t.TempDir(), "tagmap-*.json") + require.NoError(t, err) + _, err = f.Write(b) + require.NoError(t, err) + require.NoError(t, f.Close()) + return f.Name() +} + +// TestCompatCheck_IncompatibleTagChange verifies that CompatCheck returns an +// error naming the field whose tag changed between old and new. +func TestCompatCheck_IncompatibleTagChange(t *testing.T) { + oldPath := writeTagmap(t, map[string]int32{"field_x": 5}) + newPath := writeTagmap(t, map[string]int32{"field_x": 7}) + + err := protogen.CompatCheck(oldPath, newPath) + require.Error(t, err, "CompatCheck must fail when a tag changes") + require.Contains(t, err.Error(), "field_x", "error must name the offending field") +} + +// TestCompatCheck_CompatibleAdditive verifies that adding a new field to new +// without touching existing tags is not an error. +func TestCompatCheck_CompatibleAdditive(t *testing.T) { + oldPath := writeTagmap(t, map[string]int32{"field_x": 5}) + newPath := writeTagmap(t, map[string]int32{"field_x": 5, "field_y": 6}) + + err := protogen.CompatCheck(oldPath, newPath) + require.NoError(t, err, "CompatCheck must pass for a purely additive change") +} + +// TestCompatCheck_MissingOldFile verifies that a missing old tagmap (bootstrap: +// the base branch never had one) is treated as compatible and returns nil. +func TestCompatCheck_MissingOldFile(t *testing.T) { + oldPath := filepath.Join(t.TempDir(), "does-not-exist.json") + newPath := writeTagmap(t, map[string]int32{"field_x": 5}) + + err := protogen.CompatCheck(oldPath, newPath) + require.NoError(t, err, "CompatCheck must pass when old tagmap does not exist (bootstrap)") +} + +// TestCompatCheck_SameFile verifies that comparing a tagmap against itself is +// always compatible. +func TestCompatCheck_SameFile(t *testing.T) { + _, tagmapPath := committedBaseline() + if _, err := os.Stat(tagmapPath); os.IsNotExist(err) { + t.Skip("committed baseline not yet generated") + } + + err := protogen.CompatCheck(tagmapPath, tagmapPath) + require.NoError(t, err, "CompatCheck must pass when old and new are the same file") +} + +// TestCompatCheck_UsesTagmapCheckCompat verifies the integration with +// tagmap.CheckCompat by constructing tagmaps directly and cross-checking the +// error text produced by CompatCheck against the underlying package. +func TestCompatCheck_UsesTagmapCheckCompat(t *testing.T) { + oldPath := writeTagmap(t, map[string]int32{"alpha": 1, "beta": 2}) + // beta's tag changed from 2 → 3; alpha is fine. + newPath := writeTagmap(t, map[string]int32{"alpha": 1, "beta": 3}) + + err := protogen.CompatCheck(oldPath, newPath) + require.Error(t, err) + + // Cross-check: the same inputs via tagmap.CheckCompat directly must also err. + oldTM, loadErr := tagmap.Load(oldPath) + require.NoError(t, loadErr) + newTM, loadErr := tagmap.Load(newPath) + require.NoError(t, loadErr) + require.Error(t, tagmap.CheckCompat(oldTM, newTM)) +} diff --git a/ocsf/cmd/ocsf-protogen/testdata/api_entity.proto b/ocsf/cmd/ocsf-protogen/testdata/api_entity.proto new file mode 100644 index 0000000..928b0c1 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/api_entity.proto @@ -0,0 +1,3085 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; + +message ApiActivity { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + string action = 1; + ActionId action_id = 2; + ActivityId activity_id = 3 [(buf.validate.field).required = true]; + string activity_name = 4; + Actor actor = 5 [(buf.validate.field).required = true]; + AiModel ai_model = 6; + Api api = 7 [(buf.validate.field).required = true]; + repeated Attack attacks = 8; + repeated Authorization authorizations = 9; + string category_name = 10; + CategoryUid category_uid = 11 [(buf.validate.field).required = true]; + string class_name = 12; + ClassUid class_uid = 13 [(buf.validate.field).required = true]; + Cloud cloud = 14 [(buf.validate.field).required = true]; + string confidence = 15; + ConfidenceId confidence_id = 16; + int32 confidence_score = 17; + int32 count = 18; + Device device = 19; + string disposition = 20; + DispositionId disposition_id = 21; + NetworkEndpoint dst_endpoint = 22; + int64 duration = 23; + int64 end_time = 24; + string end_time_dt = 25; + repeated Enrichment enrichments = 26; + FirewallRule firewall_rule = 27; + HttpRequest http_request = 28; + HttpResponse http_response = 29; + bool is_alert = 30; + repeated Malware malware = 31; + MalwareScanInfo malware_scan_info = 32; + string message = 33; + MessageContext message_context = 34; + Metadata metadata = 35 [(buf.validate.field).required = true]; + repeated Observable observables = 36; + repeated Osint osint = 37; + Policy policy = 38; + string raw_data = 39; + Fingerprint raw_data_hash = 40; + int64 raw_data_size = 41; + repeated ResourceDetails resources = 42; + string risk_details = 43; + string risk_level = 44; + RiskLevelId risk_level_id = 45; + int32 risk_score = 46; + string severity = 47; + SeverityId severity_id = 48 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; + int64 start_time = 50; + string start_time_dt = 51; + string status = 52; + string status_code = 53; + string status_detail = 54; + StatusId status_id = 55; + int64 time = 56 [(buf.validate.field).required = true]; + string time_dt = 57; + int32 timezone_offset = 58; + Trace trace = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + +message EntityManagement { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_MOVE = 5; + ACTIVITY_ID_ENROLL = 6; + ACTIVITY_ID_UNENROLL = 7; + ACTIVITY_ID_ENABLE = 8; + ACTIVITY_ID_DISABLE = 9; + ACTIVITY_ID_ACTIVATE = 10; + ACTIVITY_ID_DEACTIVATE = 11; + ACTIVITY_ID_SUSPEND = 12; + ACTIVITY_ID_RESUME = 13; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + ActivityId activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + Api api = 8; + repeated Attack attacks = 9; + repeated Authorization authorizations = 10; + string category_name = 11; + CategoryUid category_uid = 12 [(buf.validate.field).required = true]; + string class_name = 13; + ClassUid class_uid = 14 [(buf.validate.field).required = true]; + Cloud cloud = 15 [(buf.validate.field).required = true]; + string comment = 16; + string confidence = 17; + ConfidenceId confidence_id = 18; + int32 confidence_score = 19; + int32 count = 20; + Device device = 21; + string disposition = 22; + DispositionId disposition_id = 23; + int64 duration = 24; + int64 end_time = 25; + string end_time_dt = 26; + repeated Enrichment enrichments = 27; + ManagedEntity entity = 28 [(buf.validate.field).required = true]; + ManagedEntity entity_result = 29; + FirewallRule firewall_rule = 30; + HttpRequest http_request = 31; + HttpResponse http_response = 32; + bool is_alert = 33; + repeated Malware malware = 34; + MalwareScanInfo malware_scan_info = 35; + string message = 36; + Metadata metadata = 37 [(buf.validate.field).required = true]; + repeated Observable observables = 38; + repeated Osint osint = 39; + Policy policy = 40; + string raw_data = 41; + Fingerprint raw_data_hash = 42; + int64 raw_data_size = 43; + string risk_details = 44; + string risk_level = 45; + RiskLevelId risk_level_id = 46; + int32 risk_score = 47; + string severity = 48; + SeverityId severity_id = 49 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 50; + int64 start_time = 51; + string start_time_dt = 52; + string status = 53; + string status_code = 54; + string status_detail = 55; + StatusId status_id = 56; + int64 time = 57 [(buf.validate.field).required = true]; + string time_dt = 58; + int32 timezone_offset = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + +message Account { + option (buf.validate.message).cel = { + id: "Account.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string type = 4; + TypeId type_id = 5; + string uid = 6; + bool is_disabled = 7; + bool is_locked = 8; + bool is_on_premises_sync_enabled = 9; +} + +message Actor { + option (buf.validate.message).cel = { + id: "Actor.at_least_one", + message: "at least one of [app_name, app_uid, invoked_by, process, session, user] must be set", + expression: "has(this.app_name) || has(this.app_uid) || has(this.invoked_by) || has(this.process) || has(this.session) || has(this.user)" + }; + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20 [(buf.validate.field).required = true]; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3 [(buf.validate.field).required = true]; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8 [(buf.validate.field).required = true]; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20 [(buf.validate.field).required = true]; +} + +message Agent { + option (buf.validate.message).cel = { + id: "Agent.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message AiModel { + option (buf.validate.message).cel = { + id: "AiModel.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string ai_provider = 1 [(buf.validate.field).required = true]; + string name = 2 [(buf.validate.field).required = true]; + string uid = 3; + string version = 4; +} + +message Analytic { + option (buf.validate.message).cel = { + id: "Analytic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9 [(buf.validate.field).required = true]; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2 [(buf.validate.field).required = true]; + Request request = 3; + Response response = 4; + Service service = 5; + string version = 6; + Token token = 7; +} + +message Application { + option (buf.validate.message).cel = { + id: "Application.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + string criticality = 1; + google.protobuf.Value data = 2; + string desc = 3; + Group group = 4; + string hostname = 5; + repeated string labels = 6; + string name = 7; + User owner = 8; + string region = 9; + Graph resource_relationship = 10; + string risk_level = 11; + RiskLevelId risk_level_id = 12; + int32 risk_score = 13; + Sbom sbom = 14; + repeated KeyValueObject tags = 15; + string type = 16; + string uid = 17; + string uid_alt = 18; + Url url = 19; + string version = 20; +} + +message Attack { + option (buf.validate.message).cel = { + id: "Attack.at_least_one", + message: "at least one of [sub_technique, tactic, technique] must be set", + expression: "has(this.sub_technique) || has(this.tactic) || has(this.technique)" + }; + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4 [(buf.validate.field).required = true]; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + option (buf.validate.message).cel = { + id: "AutonomousSystem.at_least_one", + message: "at least one of [name, number] must be set", + expression: "has(this.name) || has(this.number)" + }; + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1 [(buf.validate.field).required = true]; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7 [(buf.validate.field).required = true]; + repeated San sans = 8; + string serial_number = 9 [(buf.validate.field).required = true]; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2 [(buf.validate.field).required = true]; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2 [(buf.validate.field).required = true]; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5 [(buf.validate.field).required = true]; + string region = 6; + string zone = 7; +} + +message Container { + option (buf.validate.message).cel = { + id: "Container.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16 [(buf.validate.field).required = true]; +} + +message Cvss { + double base_score = 1 [(buf.validate.field).required = true]; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9 [(buf.validate.field).required = true]; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3 [(buf.validate.field).required = true]; +} + +message D3fTactic { + option (buf.validate.message).cel = { + id: "D3fTactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + option (buf.validate.message).cel = { + id: "D3fTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + option (buf.validate.message).cel = { + id: "D3fend.at_least_one", + message: "at least one of [d3f_tactic, d3f_technique] must be set", + expression: "has(this.d3f_tactic) || has(this.d3f_technique)" + }; + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + option (buf.validate.message).cel = { + id: "DataClassification.at_least_one", + message: "at least one of [category_id, confidentiality_id] must be set", + expression: "has(this.category_id) || has(this.confidentiality_id)" + }; + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + option (buf.validate.message).cel = { + id: "Device.at_least_one", + message: "at least one of [hostname, instance_uid, interface_name, interface_uid, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string meid = 38; + string model = 39; + int64 modified_time = 40; + string modified_time_dt = 41; + string name = 42; + int32 namespace_pid = 43; + repeated NetworkInterface network_interfaces = 44; + Organization org = 45; + Os os = 46; + string os_machine_uuid = 47; + User owner = 48; + string region = 49; + string risk_level = 50; + RiskLevelId risk_level_id = 51; + int32 risk_score = 52; + string subnet = 53; + string subnet_uid = 54; + string type = 55; + TypeId type_id = 56 [(buf.validate.field).required = true]; + string udid = 57; + string uid = 58; + string uid_alt = 59; + string vendor_name = 60; + string vlan_uid = 61; + string vpc_uid = 62; + string zone = 63; + string mac_vendor = 64; + Group pool = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + KeyboardInfo keyboard_info = 13; + int32 ram_size = 14; + string serial_number = 15; + string uuid = 16; + string vendor_name = 17; + int32 gpu_count = 18; + repeated GpuInfo gpu_info_list = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5 [(buf.validate.field).required = true]; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Edge { + option (buf.validate.message).cel = { + id: "Edge.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + google.protobuf.Value data = 1; + bool is_directed = 2; + string name = 3; + string relation = 4; + string source = 5 [(buf.validate.field).required = true]; + string target = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Email { + option (buf.validate.message).cel = { + id: "Email.at_least_one", + message: "at least one of [from, to] must be set", + expression: "has(this.from) || has(this.to)" + }; + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3 [(buf.validate.field).required = true]; + string desc = 4; + string name = 5 [(buf.validate.field).required = true]; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11 [(buf.validate.field).required = true]; +} + +message EnvironmentVariable { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4 [(buf.validate.field).required = true]; + string version = 5; +} + +message Extension { + option (buf.validate.message).cel = { + id: "Extension.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3 [(buf.validate.field).required = true]; +} + +message Feature { + option (buf.validate.message).cel = { + id: "Feature.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + string internal_name = 19; + bool is_deleted = 20; + bool is_encrypted = 21; + bool is_public = 22; + bool is_readonly = 23; + bool is_system = 24; + string mime_type = 25; + int64 modified_time = 26; + string modified_time_dt = 27; + User modifier = 28; + string name = 29 [(buf.validate.field).required = true]; + User owner = 30; + string parent_folder = 31; + string path = 32; + Product product = 33; + string security_descriptor = 34; + DigitalSignature signature = 35; + int64 size = 36; + string storage_class = 37; + repeated KeyValueObject tags = 38; + string type = 39; + TypeId type_id = 40 [(buf.validate.field).required = true]; + string uid = 41; + string uri = 42; + Url url = 43; + string version = 44; + string volume = 45; + google.protobuf.Value xattributes = 46; + repeated string imported_symbols = 47; + repeated DigitalSignature signatures = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + string value = 3 [(buf.validate.field).required = true]; +} + +message FirewallRule { + option (buf.validate.message).cel = { + id: "FirewallRule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Graph { + option (buf.validate.message).cel = { + id: "Graph.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum QueryLanguageId { + QUERY_LANGUAGE_ID_UNKNOWN = 0; + QUERY_LANGUAGE_ID_CYPHER = 1; + QUERY_LANGUAGE_ID_GRAPHQL = 2; + QUERY_LANGUAGE_ID_GREMLIN = 3; + QUERY_LANGUAGE_ID_GQL = 4; + QUERY_LANGUAGE_ID_G_CORE = 5; + QUERY_LANGUAGE_ID_PGQL = 6; + QUERY_LANGUAGE_ID_SPARQL = 7; + QUERY_LANGUAGE_ID_OTHER = 99; + } + string desc = 1; + repeated Edge edges = 2; + bool is_directed = 3; + string name = 4; + repeated Node nodes = 5; + string query_language = 6; + QueryLanguageId query_language_id = 7; + string type = 8; + string uid = 9; +} + +message Group { + option (buf.validate.message).cel = { + id: "Group.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2 [(buf.validate.field).required = true]; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + option (buf.validate.message).cel = { + id: "Idp.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6 [(buf.validate.field).required = true]; +} + +message KbArticle { + option (buf.validate.message).cel = { + id: "KbArticle.at_least_one", + message: "at least one of [src_url, uid] must be set", + expression: "has(this.src_url) || has(this.uid)" + }; + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + option (buf.validate.message).cel = { + id: "KeyValueObject.at_least_one", + message: "at least one of [value, values] must be set", + expression: "has(this.value) || has(this.values)" + }; + string name = 1 [(buf.validate.field).required = true]; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2 [(buf.validate.field).required = true]; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string display_name = 6; + repeated string email_addrs = 7; + string employee_uid = 8; + string given_name = 9; + int64 hire_time = 10; + string hire_time_dt = 11; + string job_title = 12; + repeated string labels = 13; + int64 last_login_time = 14; + string last_login_time_dt = 15; + string ldap_cn = 16; + string ldap_dn = 17; + int64 leave_time = 18; + string leave_time_dt = 19; + Location location = 20; + User manager = 21; + int64 modified_time = 22; + string modified_time_dt = 23; + string office_location = 24; + string phone_number = 25; + string surname = 26; + repeated KeyValueObject tags = 27; + string department = 28; +} + +message Location { + option (buf.validate.message).cel = { + id: "Location.at_least_one", + message: "at least one of [city, country, postal_code, region] must be set", + expression: "has(this.city) || has(this.country) || has(this.postal_code) || has(this.region)" + }; + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + option (buf.validate.message).cel = { + id: "Logger.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3 [(buf.validate.field).required = true]; +} + +message Malware { + option (buf.validate.message).cel = { + id: "Malware.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + option (buf.validate.message).cel = { + id: "MalwareScanInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11 [(buf.validate.field).required = true]; + string uid = 12; + int32 unique_malware_count = 13; +} + +message ManagedEntity { + option (buf.validate.message).cel = { + id: "ManagedEntity.at_least_one", + message: "at least one of [device, group, name, org, policy, uid, user] must be set", + expression: "has(this.device) || has(this.group) || has(this.name) || has(this.org) || has(this.policy) || has(this.uid) || has(this.user)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_DEVICE = 1; + TYPE_ID_USER = 2; + TYPE_ID_GROUP = 3; + TYPE_ID_ORGANIZATION = 4; + TYPE_ID_POLICY = 5; + TYPE_ID_EMAIL = 6; + TYPE_ID_NETWORK_ZONE = 7; + TYPE_ID_OTHER = 99; + } + google.protobuf.Value data = 1; + Device device = 2; + Email email = 3; + Group group = 4; + Location location = 5; + string name = 6; + Organization org = 7; + Policy policy = 8; + string type = 9; + TypeId type_id = 10; + string uid = 11; + User user = 12; + string version = 13; +} + +message MessageContext { + option (buf.validate.message).cel = { + id: "MessageContext.at_least_one", + message: "at least one of [application, service] must be set", + expression: "has(this.application) || has(this.service)" + }; + enum AiRoleId { + AI_ROLE_ID_UNKNOWN = 0; + AI_ROLE_ID_USER = 1; + AI_ROLE_ID_ASSISTANT = 2; + AI_ROLE_ID_TOOL = 3; + AI_ROLE_ID_AGENT = 4; + AI_ROLE_ID_ORCHESTRATOR = 5; + AI_ROLE_ID_RETRIEVER = 6; + AI_ROLE_ID_OTHER = 99; + } + string ai_role = 1; + AiRoleId ai_role_id = 2; + Application application = 3; + int32 completion_tokens = 4; + string name = 5; + int32 prompt_tokens = 6; + Service service = 7; + int32 total_tokens = 8; + string uid = 9; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25 [(buf.validate.field).required = true]; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + repeated TransformationInfo transformation_info_list = 32; + int64 transmit_time = 33; + string transmit_time_dt = 34; + string type = 35; + string uid = 36; + int32 untruncated_size = 37; + string version = 38 [(buf.validate.field).required = true]; + Timespan total_queued_duration = 39; +} + +message Metric { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Mitigation { + option (buf.validate.message).cel = { + id: "Mitigation.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + option (buf.validate.message).cel = { + id: "NetworkEndpoint.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + string hostname = 5; + DeviceHwInfo hw_info = 6; + string instance_uid = 7; + string interface_name = 8; + string interface_uid = 9; + repeated string intermediate_ips = 10; + string ip = 11; + string isp = 12; + string isp_org = 13; + Location location = 14; + string mac = 15; + string name = 16; + int32 namespace_pid = 17; + string network_scope = 18; + NetworkScopeId network_scope_id = 19; + Os os = 20; + User owner = 21; + int32 port = 22; + NetworkProxy proxy_endpoint = 23; + string subnet_uid = 24; + string svc_name = 25; + string type = 26; + TypeId type_id = 27; + string uid = 28; + string vlan_uid = 29; + string vpc_uid = 30; + string zone = 31; + repeated Fingerprint fingerprints = 32; + string mac_vendor = 33; + Group pool = 34; +} + +message NetworkInterface { + option (buf.validate.message).cel = { + id: "NetworkInterface.at_least_one", + message: "at least one of [hostname, ip, mac, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.mac) || has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + option (buf.validate.message).cel = { + id: "NetworkProxy.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + string hostname = 5; + DeviceHwInfo hw_info = 6; + string instance_uid = 7; + string interface_name = 8; + string interface_uid = 9; + repeated string intermediate_ips = 10; + string ip = 11; + string isp = 12; + string isp_org = 13; + Location location = 14; + string mac = 15; + string name = 16; + int32 namespace_pid = 17; + string network_scope = 18; + NetworkScopeId network_scope_id = 19; + Os os = 20; + User owner = 21; + int32 port = 22; + NetworkProxy proxy_endpoint = 23; + string subnet_uid = 24; + string svc_name = 25; + string type = 26; + TypeId type_id = 27; + string uid = 28; + string vlan_uid = 29; + string vpc_uid = 30; + string zone = 31; + repeated Fingerprint fingerprints = 32; + string mac_vendor = 33; + Group pool = 34; +} + +message Node { + google.protobuf.Value data = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5 [(buf.validate.field).required = true]; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5 [(buf.validate.field).required = true]; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + option (buf.validate.message).cel = { + id: "OccurrenceDetails.at_least_one", + message: "at least one of [cell_name, column_name, column_number, end_line, json_path, page_number, record_index_in_array, row_number, start_line] must be set", + expression: "has(this.cell_name) || has(this.column_name) || has(this.column_number) || has(this.end_line) || has(this.json_path) || has(this.page_number) || has(this.record_index_in_array) || has(this.row_number) || has(this.start_line)" + }; + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + option (buf.validate.message).cel = { + id: "Organization.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8 [(buf.validate.field).required = true]; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12 [(buf.validate.field).required = true]; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44 [(buf.validate.field).required = true]; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48 [(buf.validate.field).required = true]; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7 [(buf.validate.field).required = true]; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17 [(buf.validate.field).required = true]; +} + +message Policy { + option (buf.validate.message).cel = { + id: "Policy.at_least_one", + message: "at least one of [name, type, uid] must be set", + expression: "has(this.name) || has(this.type) || has(this.uid)" + }; + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1 [(buf.validate.field).required = true]; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + option (buf.validate.message).cel = { + id: "Process.at_least_one", + message: "at least one of [cpid, pid, uid] must be set", + expression: "has(this.cpid) || has(this.pid) || has(this.uid)" + }; + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + option (buf.validate.message).cel = { + id: "ProcessEntity.at_least_one", + message: "at least one of [cmd_line, cpid, name, path, pid, uid] must be set", + expression: "has(this.cmd_line) || has(this.cpid) || has(this.name) || has(this.path) || has(this.pid) || has(this.uid)" + }; + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + option (buf.validate.message).cel = { + id: "Product.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2 [(buf.validate.field).required = true]; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + option (buf.validate.message).cel = { + id: "Reporter.at_least_one", + message: "at least one of [hostname, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.name) || has(this.uid)" + }; + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1 [(buf.validate.field).required = true]; + string provider = 2; + string score = 3; + ScoreId score_id = 4 [(buf.validate.field).required = true]; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message ResourceDetails { + option (buf.validate.message).cel = { + id: "ResourceDetails.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RoleId { + ROLE_ID_UNKNOWN = 0; + ROLE_ID_TARGET = 1; + ROLE_ID_ACTOR = 2; + ROLE_ID_AFFECTED = 3; + ROLE_ID_RELATED = 4; + ROLE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string cloud_partition = 2; + int64 created_time = 3; + string created_time_dt = 4; + string criticality = 5; + google.protobuf.Value data = 6; + DataClassification data_classification = 7; + repeated DataClassification data_classifications = 8; + Group group = 9; + string hostname = 10; + string ip = 11; + bool is_backed_up = 12; + repeated string labels = 13; + int64 modified_time = 14; + string modified_time_dt = 15; + string name = 16; + string namespace = 17; + User owner = 18; + string region = 19; + Graph resource_relationship = 20; + string role = 21; + RoleId role_id = 22; + repeated KeyValueObject tags = 23; + string type = 24; + string uid = 25; + string uid_alt = 26; + string version = 27; + string zone = 28; + string provider = 29; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + option (buf.validate.message).cel = { + id: "Rule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1 [(buf.validate.field).required = true]; + string type = 2 [(buf.validate.field).required = true]; +} + +message Sbom { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SPDX = 1; + TYPE_ID_CYCLONEDX = 2; + TYPE_ID_SWID = 3; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + Package package = 3 [(buf.validate.field).required = true]; + Product product = 4; + repeated SoftwareComponent software_components = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; + string version = 9; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5 [(buf.validate.field).required = true]; + string type = 6; + TypeId type_id = 7 [(buf.validate.field).required = true]; + string uid = 8; +} + +message Service { + option (buf.validate.message).cel = { + id: "Service.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message SoftwareComponent { + enum RelationshipId { + RELATIONSHIP_ID_UNKNOWN = 0; + RELATIONSHIP_ID_DEPENDS_ON = 1; + RELATIONSHIP_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_FRAMEWORK = 1; + TYPE_ID_LIBRARY = 2; + TYPE_ID_OPERATING_SYSTEM = 3; + TYPE_ID_OTHER = 99; + } + string author = 1; + Fingerprint hash = 2; + string license = 3; + string name = 4 [(buf.validate.field).required = true]; + string purl = 5; + string related_component = 6; + string relationship = 7; + RelationshipId relationship_id = 8; + string type = 9; + TypeId type_id = 10; + string version = 11 [(buf.validate.field).required = true]; +} + +message Span { + int64 duration = 1; + int64 end_time = 2 [(buf.validate.field).required = true]; + string end_time_dt = 3; + string message = 4; + string operation = 5; + string parent_uid = 6; + Service service = 7; + int64 start_time = 8 [(buf.validate.field).required = true]; + string start_time_dt = 9; + string status_code = 10; + string uid = 11 [(buf.validate.field).required = true]; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + option (buf.validate.message).cel = { + id: "SubTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + option (buf.validate.message).cel = { + id: "Tactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + option (buf.validate.message).cel = { + id: "Technique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1 [(buf.validate.field).required = true]; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + option (buf.validate.message).cel = { + id: "Timespan.at_least_one", + message: "at least one of [duration, duration_days, duration_hours, duration_mins, duration_months, duration_secs, duration_weeks, duration_years, end_time, start_time] must be set", + expression: "has(this.duration) || has(this.duration_days) || has(this.duration_hours) || has(this.duration_mins) || has(this.duration_months) || has(this.duration_secs) || has(this.duration_weeks) || has(this.duration_years) || has(this.end_time) || has(this.start_time)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message Trace { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + repeated string flags = 4; + Service service = 5; + Span span = 6; + int64 start_time = 7; + string start_time_dt = 8; + string uid = 9 [(buf.validate.field).required = true]; +} + +message TransformationInfo { + option (buf.validate.message).cel = { + id: "TransformationInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + option (buf.validate.message).cel = { + id: "Url.at_least_one", + message: "at least one of [path, url_string] must be set", + expression: "has(this.path) || has(this.url_string)" + }; + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + option (buf.validate.message).cel = { + id: "User.at_least_one", + message: "at least one of [account, name, uid] must be set", + expression: "has(this.account) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + option (buf.validate.message).cel = { + id: "Vulnerability.just_one", + message: "exactly one of [advisory, cve, cwe] must be set", + expression: "(has(this.advisory) ? 1 : 0) + (has(this.cve) ? 1 : 0) + (has(this.cwe) ? 1 : 0) == 1" + }; + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + option (buf.validate.message).cel = { + id: "WinService.at_least_one", + message: "at least one of [cmd_line, service_category_id, service_dependencies, service_error_control_id, service_start_name, service_start_type_id, service_type_id] must be set", + expression: "has(this.cmd_line) || has(this.service_category_id) || has(this.service_dependencies) || has(this.service_error_control_id) || has(this.service_start_name) || has(this.service_start_type_id) || has(this.service_type_id)" + }; + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5 [(buf.validate.field).required = true]; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + diff --git a/ocsf/cmd/ocsf-protogen/testdata/buf.lock b/ocsf/cmd/ocsf-protogen/testdata/buf.lock new file mode 100644 index 0000000..709ae02 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/buf.lock @@ -0,0 +1,6 @@ +# Generated by buf. DO NOT EDIT. +version: v2 +deps: + - name: buf.build/bufbuild/protovalidate + commit: 50325440f8f24053b047484a6bf60b76 + digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31 diff --git a/ocsf/cmd/ocsf-protogen/testdata/buf.yaml b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml new file mode 100644 index 0000000..4d2ee62 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml @@ -0,0 +1,16 @@ +version: v2 +modules: + - path: . +deps: + - buf.build/bufbuild/protovalidate +lint: + use: + - STANDARD + except: + # Generated files don't follow a consistent package/directory convention. + - PACKAGE_DIRECTORY_MATCH + # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values by design. + - ENUM_ZERO_VALUE_SUFFIX +breaking: + use: + - FILE diff --git a/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json b/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json new file mode 100644 index 0000000..84dccc0 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json @@ -0,0 +1,1996 @@ +{ + "Account": { + "fields": { + "is_disabled": 7, + "is_locked": 8, + "is_on_premises_sync_enabled": 9, + "labels": 1, + "name": 2, + "tags": 3, + "type": 4, + "type_id": 5, + "uid": 6 + }, + "reserved": [] + }, + "Actor": { + "fields": { + "app_name": 1, + "app_uid": 2, + "authorizations": 3, + "idp": 4, + "invoked_by": 5, + "process": 6, + "session": 7, + "user": 8 + }, + "reserved": [] + }, + "Advisory": { + "fields": { + "avg_timespan": 1, + "bulletin": 2, + "classification": 3, + "created_time": 4, + "created_time_dt": 5, + "desc": 6, + "install_state": 7, + "install_state_id": 8, + "is_superseded": 9, + "modified_time": 10, + "modified_time_dt": 11, + "os": 12, + "product": 13, + "references": 14, + "related_cves": 15, + "related_cwes": 16, + "size": 17, + "src_url": 18, + "title": 19, + "uid": 20 + }, + "reserved": [] + }, + "AffectedCode": { + "fields": { + "end_column": 1, + "end_line": 2, + "file": 3, + "owner": 4, + "remediation": 5, + "rule": 6, + "start_column": 7, + "start_line": 8 + }, + "reserved": [] + }, + "AffectedPackage": { + "fields": { + "architecture": 1, + "cpe_name": 2, + "epoch": 3, + "fixed_in_version": 4, + "hash": 5, + "license": 6, + "license_url": 7, + "name": 8, + "package_manager": 9, + "package_manager_url": 10, + "path": 11, + "purl": 12, + "release": 13, + "remediation": 14, + "src_url": 15, + "type": 16, + "type_id": 17, + "uid": 18, + "vendor_name": 19, + "version": 20 + }, + "reserved": [] + }, + "Agent": { + "fields": { + "name": 1, + "policies": 2, + "type": 3, + "type_id": 4, + "uid": 5, + "uid_alt": 6, + "vendor_name": 7, + "version": 8 + }, + "reserved": [] + }, + "AiModel": { + "fields": { + "ai_provider": 1, + "name": 2, + "uid": 3, + "version": 4 + }, + "reserved": [] + }, + "Analytic": { + "fields": { + "algorithm": 1, + "category": 2, + "desc": 3, + "name": 4, + "related_analytics": 5, + "state": 6, + "state_id": 7, + "type": 8, + "type_id": 9, + "uid": 10, + "version": 11 + }, + "reserved": [] + }, + "Api": { + "fields": { + "group": 1, + "operation": 2, + "request": 3, + "response": 4, + "service": 5, + "token": 7, + "version": 6 + }, + "reserved": [] + }, + "ApiActivity": { + "fields": { + "action": 1, + "action_id": 2, + "activity_id": 3, + "activity_name": 4, + "actor": 5, + "ai_model": 6, + "api": 7, + "attacks": 8, + "authorizations": 9, + "category_name": 10, + "category_uid": 11, + "class_name": 12, + "class_uid": 13, + "cloud": 14, + "confidence": 15, + "confidence_id": 16, + "confidence_score": 17, + "count": 18, + "device": 19, + "disposition": 20, + "disposition_id": 21, + "dst_endpoint": 22, + "duration": 23, + "end_time": 24, + "end_time_dt": 25, + "enrichments": 26, + "firewall_rule": 27, + "http_request": 28, + "http_response": 29, + "is_alert": 30, + "malware": 31, + "malware_scan_info": 32, + "message": 33, + "message_context": 34, + "metadata": 35, + "observables": 36, + "osint": 37, + "policy": 38, + "raw_data": 39, + "raw_data_hash": 40, + "raw_data_size": 41, + "resources": 42, + "risk_details": 43, + "risk_level": 44, + "risk_level_id": 45, + "risk_score": 46, + "severity": 47, + "severity_id": 48, + "src_endpoint": 49, + "start_time": 50, + "start_time_dt": 51, + "status": 52, + "status_code": 53, + "status_detail": 54, + "status_id": 55, + "time": 56, + "time_dt": 57, + "timezone_offset": 58, + "trace": 59, + "type_name": 60, + "type_uid": 61, + "unmapped": 62 + }, + "reserved": [] + }, + "Application": { + "fields": { + "criticality": 1, + "data": 2, + "desc": 3, + "group": 4, + "hostname": 5, + "labels": 6, + "name": 7, + "owner": 8, + "region": 9, + "resource_relationship": 10, + "risk_level": 11, + "risk_level_id": 12, + "risk_score": 13, + "sbom": 14, + "tags": 15, + "type": 16, + "uid": 17, + "uid_alt": 18, + "url": 19, + "version": 20 + }, + "reserved": [] + }, + "Attack": { + "fields": { + "mitigation": 1, + "sub_technique": 2, + "tactic": 3, + "tactics": 4, + "technique": 5, + "version": 6 + }, + "reserved": [] + }, + "AuthFactor": { + "fields": { + "device": 1, + "email_addr": 2, + "factor_type": 3, + "factor_type_id": 4, + "is_hotp": 5, + "is_totp": 6, + "phone_number": 7, + "provider": 8, + "security_questions": 9 + }, + "reserved": [] + }, + "Authorization": { + "fields": { + "decision": 1, + "policy": 2 + }, + "reserved": [] + }, + "AutonomousSystem": { + "fields": { + "name": 1, + "number": 2 + }, + "reserved": [] + }, + "Campaign": { + "fields": { + "name": 1 + }, + "reserved": [] + }, + "Certificate": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "expiration_time": 3, + "expiration_time_dt": 4, + "fingerprints": 5, + "is_self_signed": 6, + "issuer": 7, + "sans": 8, + "serial_number": 9, + "subject": 10, + "uid": 11, + "version": 12 + }, + "reserved": [] + }, + "CisControl": { + "fields": { + "desc": 1, + "name": 2, + "version": 3 + }, + "reserved": [] + }, + "ClassifierDetails": { + "fields": { + "name": 1, + "type": 2, + "uid": 3 + }, + "reserved": [] + }, + "Cloud": { + "fields": { + "account": 1, + "cloud_partition": 2, + "org": 3, + "project_uid": 4, + "provider": 5, + "region": 6, + "zone": 7 + }, + "reserved": [] + }, + "Container": { + "fields": { + "hash": 1, + "image": 2, + "labels": 3, + "name": 4, + "network_driver": 5, + "orchestrator": 6, + "pod_uuid": 7, + "runtime": 8, + "size": 9, + "tag": 10, + "tags": 11, + "uid": 12 + }, + "reserved": [] + }, + "Cve": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "cvss": 3, + "cwe": 4, + "cwe_uid": 5, + "cwe_url": 6, + "desc": 7, + "epss": 8, + "modified_time": 9, + "modified_time_dt": 10, + "product": 11, + "references": 12, + "related_cwes": 13, + "title": 14, + "type": 15, + "uid": 16 + }, + "reserved": [] + }, + "Cvss": { + "fields": { + "base_score": 1, + "depth": 2, + "metrics": 3, + "overall_score": 4, + "severity": 5, + "src_url": 6, + "vector_string": 7, + "vendor_name": 8, + "version": 9 + }, + "reserved": [] + }, + "Cwe": { + "fields": { + "caption": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "D3fTactic": { + "fields": { + "name": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "D3fTechnique": { + "fields": { + "name": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "D3fend": { + "fields": { + "d3f_tactic": 1, + "d3f_technique": 2, + "version": 3 + }, + "reserved": [] + }, + "DataClassification": { + "fields": { + "category": 1, + "category_id": 2, + "classifier_details": 3, + "confidentiality": 4, + "confidentiality_id": 5, + "discovery_details": 6, + "policy": 7, + "size": 8, + "src_url": 9, + "status": 10, + "status_details": 11, + "status_id": 12, + "total": 13, + "uid": 14 + }, + "reserved": [] + }, + "Device": { + "fields": { + "agent_list": 1, + "autoscale_uid": 2, + "boot_time": 3, + "boot_time_dt": 4, + "boot_uid": 5, + "container": 6, + "created_time": 7, + "created_time_dt": 8, + "desc": 9, + "domain": 10, + "eid": 11, + "first_seen_time": 12, + "first_seen_time_dt": 13, + "groups": 14, + "hostname": 15, + "hw_info": 16, + "hypervisor": 17, + "iccid": 18, + "image": 19, + "imei": 20, + "imei_list": 21, + "instance_uid": 22, + "interface_name": 23, + "interface_uid": 24, + "ip": 25, + "is_backed_up": 26, + "is_compliant": 27, + "is_managed": 28, + "is_mobile_account_active": 29, + "is_personal": 30, + "is_shared": 31, + "is_supervised": 32, + "is_trusted": 33, + "last_seen_time": 34, + "last_seen_time_dt": 35, + "location": 36, + "mac": 37, + "mac_vendor": 64, + "meid": 38, + "model": 39, + "modified_time": 40, + "modified_time_dt": 41, + "name": 42, + "namespace_pid": 43, + "network_interfaces": 44, + "org": 45, + "os": 46, + "os_machine_uuid": 47, + "owner": 48, + "pool": 65, + "region": 49, + "risk_level": 50, + "risk_level_id": 51, + "risk_score": 52, + "subnet": 53, + "subnet_uid": 54, + "type": 55, + "type_id": 56, + "udid": 57, + "uid": 58, + "uid_alt": 59, + "vendor_name": 60, + "vlan_uid": 61, + "vpc_uid": 62, + "zone": 63 + }, + "reserved": [] + }, + "DeviceHwInfo": { + "fields": { + "bios_date": 1, + "bios_manufacturer": 2, + "bios_ver": 3, + "chassis": 4, + "cpu_architecture": 5, + "cpu_architecture_id": 6, + "cpu_bits": 7, + "cpu_cores": 8, + "cpu_count": 9, + "cpu_speed": 10, + "cpu_type": 11, + "desktop_display": 12, + "gpu_count": 18, + "gpu_info_list": 19, + "keyboard_info": 13, + "ram_size": 14, + "serial_number": 15, + "uuid": 16, + "vendor_name": 17 + }, + "reserved": [] + }, + "DigitalSignature": { + "fields": { + "algorithm": 1, + "algorithm_id": 2, + "certificate": 3, + "created_time": 4, + "created_time_dt": 5, + "developer_uid": 6, + "digest": 7, + "state": 8, + "state_id": 9 + }, + "reserved": [] + }, + "DiscoveryDetails": { + "fields": { + "count": 1, + "occurrence_details": 2, + "occurrences": 3, + "type": 4, + "value": 5 + }, + "reserved": [] + }, + "Display": { + "fields": { + "color_depth": 1, + "physical_height": 2, + "physical_orientation": 3, + "physical_width": 4, + "scale_factor": 5 + }, + "reserved": [] + }, + "DnsAnswer": { + "fields": { + "class": 1, + "flag_ids": 2, + "flags": 3, + "packet_uid": 4, + "rdata": 5, + "ttl": 6, + "type": 7 + }, + "reserved": [] + }, + "DomainContact": { + "fields": { + "email_addr": 1, + "location": 2, + "name": 3, + "phone_number": 4, + "type": 5, + "type_id": 6, + "uid": 7 + }, + "reserved": [] + }, + "Edge": { + "fields": { + "data": 1, + "is_directed": 2, + "name": 3, + "relation": 4, + "source": 5, + "target": 6, + "uid": 7 + }, + "reserved": [] + }, + "Email": { + "fields": { + "cc": 1, + "cc_mailboxes": 2, + "data_classification": 3, + "data_classifications": 4, + "delivered_to": 5, + "delivered_to_list": 6, + "files": 7, + "from": 8, + "from_list": 9, + "from_mailbox": 10, + "from_mailboxes": 11, + "http_headers": 12, + "is_read": 13, + "message_uid": 14, + "raw_header": 15, + "reply_to": 16, + "reply_to_list": 17, + "reply_to_mailboxes": 18, + "return_path": 19, + "sender": 20, + "sender_mailbox": 21, + "size": 22, + "smtp_from": 23, + "smtp_to": 24, + "subject": 25, + "to": 26, + "to_mailboxes": 27, + "uid": 28, + "urls": 29, + "x_originating_ip": 30 + }, + "reserved": [] + }, + "EmailAuth": { + "fields": { + "dkim": 1, + "dkim_domain": 2, + "dkim_signature": 3, + "dmarc": 4, + "dmarc_override": 5, + "dmarc_policy": 6, + "spf": 7 + }, + "reserved": [] + }, + "EncryptionDetails": { + "fields": { + "algorithm": 1, + "algorithm_id": 2, + "key_length": 3, + "key_uid": 4, + "type": 5 + }, + "reserved": [] + }, + "Enrichment": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "data": 3, + "desc": 4, + "name": 5, + "provider": 6, + "reputation": 7, + "short_desc": 8, + "src_url": 9, + "type": 10, + "value": 11 + }, + "reserved": [] + }, + "EntityManagement": { + "fields": { + "access_list": 1, + "access_mask": 2, + "action": 3, + "action_id": 4, + "activity_id": 5, + "activity_name": 6, + "actor": 7, + "api": 8, + "attacks": 9, + "authorizations": 10, + "category_name": 11, + "category_uid": 12, + "class_name": 13, + "class_uid": 14, + "cloud": 15, + "comment": 16, + "confidence": 17, + "confidence_id": 18, + "confidence_score": 19, + "count": 20, + "device": 21, + "disposition": 22, + "disposition_id": 23, + "duration": 24, + "end_time": 25, + "end_time_dt": 26, + "enrichments": 27, + "entity": 28, + "entity_result": 29, + "firewall_rule": 30, + "http_request": 31, + "http_response": 32, + "is_alert": 33, + "malware": 34, + "malware_scan_info": 35, + "message": 36, + "metadata": 37, + "observables": 38, + "osint": 39, + "policy": 40, + "raw_data": 41, + "raw_data_hash": 42, + "raw_data_size": 43, + "risk_details": 44, + "risk_level": 45, + "risk_level_id": 46, + "risk_score": 47, + "severity": 48, + "severity_id": 49, + "src_endpoint": 50, + "start_time": 51, + "start_time_dt": 52, + "status": 53, + "status_code": 54, + "status_detail": 55, + "status_id": 56, + "time": 57, + "time_dt": 58, + "timezone_offset": 59, + "type_name": 60, + "type_uid": 61, + "unmapped": 62 + }, + "reserved": [] + }, + "EnvironmentVariable": { + "fields": { + "name": 1, + "value": 2 + }, + "reserved": [] + }, + "Epss": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "percentile": 3, + "score": 4, + "version": 5 + }, + "reserved": [] + }, + "Extension": { + "fields": { + "name": 1, + "uid": 2, + "version": 3 + }, + "reserved": [] + }, + "Feature": { + "fields": { + "name": 1, + "uid": 2, + "version": 3 + }, + "reserved": [] + }, + "File": { + "fields": { + "accessed_time": 1, + "accessed_time_dt": 2, + "accessor": 3, + "attributes": 4, + "company_name": 5, + "confidentiality": 6, + "confidentiality_id": 7, + "created_time": 8, + "created_time_dt": 9, + "creator": 10, + "data_classification": 11, + "data_classifications": 12, + "desc": 13, + "drive_type": 14, + "drive_type_id": 15, + "encryption_details": 16, + "ext": 17, + "hashes": 18, + "imported_symbols": 47, + "internal_name": 19, + "is_deleted": 20, + "is_encrypted": 21, + "is_public": 22, + "is_readonly": 23, + "is_system": 24, + "mime_type": 25, + "modified_time": 26, + "modified_time_dt": 27, + "modifier": 28, + "name": 29, + "owner": 30, + "parent_folder": 31, + "path": 32, + "product": 33, + "security_descriptor": 34, + "signature": 35, + "signatures": 48, + "size": 36, + "storage_class": 37, + "tags": 38, + "type": 39, + "type_id": 40, + "uid": 41, + "uri": 42, + "url": 43, + "version": 44, + "volume": 45, + "xattributes": 46 + }, + "reserved": [] + }, + "Fingerprint": { + "fields": { + "algorithm": 1, + "algorithm_id": 2, + "value": 3 + }, + "reserved": [] + }, + "FirewallRule": { + "fields": { + "category": 1, + "condition": 2, + "desc": 3, + "duration": 4, + "match_details": 5, + "match_location": 6, + "name": 7, + "rate_limit": 8, + "sensitivity": 9, + "type": 10, + "uid": 11, + "version": 12 + }, + "reserved": [] + }, + "GpuInfo": { + "fields": { + "bus_type": 1, + "bus_type_id": 2, + "cores": 3, + "model": 4, + "vendor_name": 5, + "vram_mode": 6, + "vram_mode_id": 7, + "vram_size": 8 + }, + "reserved": [] + }, + "Graph": { + "fields": { + "desc": 1, + "edges": 2, + "is_directed": 3, + "name": 4, + "nodes": 5, + "query_language": 6, + "query_language_id": 7, + "type": 8, + "uid": 9 + }, + "reserved": [] + }, + "Group": { + "fields": { + "desc": 1, + "domain": 2, + "name": 3, + "privileges": 4, + "type": 5, + "uid": 6, + "uid_alt": 7 + }, + "reserved": [] + }, + "HttpHeader": { + "fields": { + "name": 1, + "value": 2 + }, + "reserved": [] + }, + "HttpRequest": { + "fields": { + "args": 1, + "body_length": 2, + "http_headers": 3, + "http_method": 4, + "length": 5, + "referrer": 6, + "uid": 7, + "url": 8, + "user_agent": 9, + "version": 10, + "x_forwarded_for": 11 + }, + "reserved": [] + }, + "HttpResponse": { + "fields": { + "body_length": 1, + "code": 2, + "content_type": 3, + "http_headers": 4, + "latency": 5, + "length": 6, + "message": 7, + "status": 8 + }, + "reserved": [] + }, + "Idp": { + "fields": { + "auth_factors": 1, + "domain": 2, + "fingerprint": 3, + "has_mfa": 4, + "issuer": 5, + "name": 6, + "protocol_name": 7, + "scim": 8, + "sso": 9, + "state": 10, + "state_id": 11, + "tenant_uid": 12, + "uid": 13, + "url_string": 14 + }, + "reserved": [] + }, + "Image": { + "fields": { + "labels": 1, + "name": 2, + "path": 3, + "tag": 4, + "tags": 5, + "uid": 6 + }, + "reserved": [] + }, + "KbArticle": { + "fields": { + "avg_timespan": 1, + "bulletin": 2, + "classification": 3, + "created_time": 4, + "created_time_dt": 5, + "install_state": 6, + "install_state_id": 7, + "is_superseded": 8, + "os": 9, + "product": 10, + "severity": 11, + "size": 12, + "src_url": 13, + "title": 14, + "uid": 15 + }, + "reserved": [] + }, + "KeyValueObject": { + "fields": { + "name": 1, + "value": 2, + "values": 3 + }, + "reserved": [] + }, + "KeyboardInfo": { + "fields": { + "function_keys": 1, + "ime": 2, + "keyboard_layout": 3, + "keyboard_subtype": 4, + "keyboard_type": 5 + }, + "reserved": [] + }, + "KillChainPhase": { + "fields": { + "phase": 1, + "phase_id": 2 + }, + "reserved": [] + }, + "LdapPerson": { + "fields": { + "cost_center": 1, + "created_time": 2, + "created_time_dt": 3, + "deleted_time": 4, + "deleted_time_dt": 5, + "department": 28, + "display_name": 6, + "email_addrs": 7, + "employee_uid": 8, + "given_name": 9, + "hire_time": 10, + "hire_time_dt": 11, + "job_title": 12, + "labels": 13, + "last_login_time": 14, + "last_login_time_dt": 15, + "ldap_cn": 16, + "ldap_dn": 17, + "leave_time": 18, + "leave_time_dt": 19, + "location": 20, + "manager": 21, + "modified_time": 22, + "modified_time_dt": 23, + "office_location": 24, + "phone_number": 25, + "surname": 26, + "tags": 27 + }, + "reserved": [] + }, + "Location": { + "fields": { + "aerial_height": 1, + "city": 2, + "continent": 3, + "coordinates": 4, + "country": 5, + "desc": 6, + "geodetic_altitude": 7, + "geodetic_vertical_accuracy": 8, + "geohash": 9, + "horizontal_accuracy": 10, + "is_on_premises": 11, + "isp": 12, + "lat": 13, + "long": 14, + "postal_code": 15, + "pressure_altitude": 16, + "provider": 17, + "region": 18 + }, + "reserved": [] + }, + "Logger": { + "fields": { + "device": 1, + "event_uid": 2, + "is_truncated": 3, + "log_format": 4, + "log_level": 5, + "log_name": 6, + "log_provider": 7, + "log_version": 8, + "logged_time": 9, + "logged_time_dt": 10, + "name": 11, + "product": 12, + "transmit_time": 13, + "transmit_time_dt": 14, + "uid": 15, + "untruncated_size": 16, + "version": 17 + }, + "reserved": [] + }, + "LongString": { + "fields": { + "is_truncated": 1, + "untruncated_size": 2, + "value": 3 + }, + "reserved": [] + }, + "Malware": { + "fields": { + "classification_ids": 1, + "classifications": 2, + "cves": 3, + "files": 4, + "name": 5, + "num_infected": 6, + "path": 7, + "provider": 8, + "severity": 9, + "severity_id": 10, + "uid": 11 + }, + "reserved": [] + }, + "MalwareScanInfo": { + "fields": { + "end_time": 1, + "end_time_dt": 2, + "name": 3, + "num_files": 4, + "num_infected": 5, + "num_volumes": 6, + "size": 7, + "start_time": 8, + "start_time_dt": 9, + "type": 10, + "type_id": 11, + "uid": 12, + "unique_malware_count": 13 + }, + "reserved": [] + }, + "ManagedEntity": { + "fields": { + "data": 1, + "device": 2, + "email": 3, + "group": 4, + "location": 5, + "name": 6, + "org": 7, + "policy": 8, + "type": 9, + "type_id": 10, + "uid": 11, + "user": 12, + "version": 13 + }, + "reserved": [] + }, + "MessageContext": { + "fields": { + "ai_role": 1, + "ai_role_id": 2, + "application": 3, + "completion_tokens": 4, + "name": 5, + "prompt_tokens": 6, + "service": 7, + "total_tokens": 8, + "uid": 9 + }, + "reserved": [] + }, + "Metadata": { + "fields": { + "correlation_uid": 1, + "data_classification": 2, + "data_classifications": 3, + "debug": 4, + "event_code": 5, + "extension": 6, + "extensions": 7, + "is_truncated": 8, + "labels": 9, + "log_format": 10, + "log_level": 11, + "log_name": 12, + "log_provider": 13, + "log_source": 14, + "log_version": 15, + "logged_time": 16, + "logged_time_dt": 17, + "loggers": 18, + "modified_time": 19, + "modified_time_dt": 20, + "original_event_uid": 21, + "original_time": 22, + "processed_time": 23, + "processed_time_dt": 24, + "product": 25, + "profiles": 26, + "reporter": 27, + "sequence": 28, + "source": 29, + "tags": 30, + "tenant_uid": 31, + "total_queued_duration": 39, + "transformation_info_list": 32, + "transmit_time": 33, + "transmit_time_dt": 34, + "type": 35, + "uid": 36, + "untruncated_size": 37, + "version": 38 + }, + "reserved": [] + }, + "Metric": { + "fields": { + "name": 1, + "value": 2 + }, + "reserved": [] + }, + "Mitigation": { + "fields": { + "countermeasures": 1, + "name": 2, + "src_url": 3, + "uid": 4 + }, + "reserved": [] + }, + "NetworkEndpoint": { + "fields": { + "agent_list": 1, + "autonomous_system": 2, + "container": 3, + "domain": 4, + "fingerprints": 32, + "hostname": 5, + "hw_info": 6, + "instance_uid": 7, + "interface_name": 8, + "interface_uid": 9, + "intermediate_ips": 10, + "ip": 11, + "isp": 12, + "isp_org": 13, + "location": 14, + "mac": 15, + "mac_vendor": 33, + "name": 16, + "namespace_pid": 17, + "network_scope": 18, + "network_scope_id": 19, + "os": 20, + "owner": 21, + "pool": 34, + "port": 22, + "proxy_endpoint": 23, + "subnet_uid": 24, + "svc_name": 25, + "type": 26, + "type_id": 27, + "uid": 28, + "vlan_uid": 29, + "vpc_uid": 30, + "zone": 31 + }, + "reserved": [] + }, + "NetworkInterface": { + "fields": { + "hostname": 1, + "ip": 2, + "mac": 3, + "name": 4, + "namespace": 5, + "open_ports": 6, + "subnet_prefix": 7, + "type": 8, + "type_id": 9, + "uid": 10 + }, + "reserved": [] + }, + "NetworkProxy": { + "fields": { + "agent_list": 1, + "autonomous_system": 2, + "container": 3, + "domain": 4, + "fingerprints": 32, + "hostname": 5, + "hw_info": 6, + "instance_uid": 7, + "interface_name": 8, + "interface_uid": 9, + "intermediate_ips": 10, + "ip": 11, + "isp": 12, + "isp_org": 13, + "location": 14, + "mac": 15, + "mac_vendor": 33, + "name": 16, + "namespace_pid": 17, + "network_scope": 18, + "network_scope_id": 19, + "os": 20, + "owner": 21, + "pool": 34, + "port": 22, + "proxy_endpoint": 23, + "subnet_uid": 24, + "svc_name": 25, + "type": 26, + "type_id": 27, + "uid": 28, + "vlan_uid": 29, + "vpc_uid": 30, + "zone": 31 + }, + "reserved": [] + }, + "Node": { + "fields": { + "data": 1, + "desc": 2, + "name": 3, + "type": 4, + "uid": 5 + }, + "reserved": [] + }, + "Observable": { + "fields": { + "event_uid": 1, + "name": 2, + "reputation": 3, + "type": 4, + "type_id": 5, + "type_uid": 6, + "value": 7 + }, + "reserved": [] + }, + "OccurrenceDetails": { + "fields": { + "cell_name": 1, + "column_name": 2, + "column_number": 3, + "end_line": 4, + "json_path": 5, + "page_number": 6, + "record_index_in_array": 7, + "row_number": 8, + "start_line": 9 + }, + "reserved": [] + }, + "Organization": { + "fields": { + "name": 1, + "ou_name": 2, + "ou_uid": 3, + "uid": 4 + }, + "reserved": [] + }, + "Os": { + "fields": { + "build": 1, + "country": 2, + "cpe_name": 3, + "cpu_bits": 4, + "edition": 5, + "kernel_release": 6, + "lang": 7, + "name": 8, + "sp_name": 9, + "sp_ver": 10, + "type": 11, + "type_id": 12, + "version": 13 + }, + "reserved": [] + }, + "Osint": { + "fields": { + "answers": 1, + "attacks": 2, + "autonomous_system": 3, + "campaign": 4, + "category": 5, + "comment": 6, + "confidence": 7, + "confidence_id": 8, + "created_time": 9, + "created_time_dt": 10, + "creator": 11, + "desc": 12, + "detection_pattern": 13, + "detection_pattern_type": 14, + "detection_pattern_type_id": 15, + "email": 16, + "email_auth": 17, + "expiration_time": 18, + "expiration_time_dt": 19, + "external_uid": 20, + "file": 21, + "intrusion_sets": 22, + "kill_chain": 23, + "labels": 24, + "location": 25, + "malware": 26, + "modified_time": 27, + "modified_time_dt": 28, + "name": 29, + "references": 30, + "related_analytics": 31, + "reputation": 32, + "risk_score": 33, + "script": 34, + "severity": 35, + "severity_id": 36, + "signatures": 37, + "src_url": 38, + "subdomains": 39, + "subnet": 40, + "threat_actor": 41, + "tlp": 42, + "type": 43, + "type_id": 44, + "uid": 45, + "uploaded_time": 46, + "uploaded_time_dt": 47, + "value": 48, + "vendor_name": 49, + "vulnerabilities": 50, + "whois": 51 + }, + "reserved": [] + }, + "Package": { + "fields": { + "architecture": 1, + "cpe_name": 2, + "epoch": 3, + "hash": 4, + "license": 5, + "license_url": 6, + "name": 7, + "package_manager": 8, + "package_manager_url": 9, + "purl": 10, + "release": 11, + "src_url": 12, + "type": 13, + "type_id": 14, + "uid": 15, + "vendor_name": 16, + "version": 17 + }, + "reserved": [] + }, + "Policy": { + "fields": { + "data": 1, + "desc": 2, + "group": 3, + "is_applied": 4, + "name": 5, + "type": 6, + "uid": 7, + "version": 8 + }, + "reserved": [] + }, + "PortInfo": { + "fields": { + "port": 1, + "protocol_name": 2, + "protocol_num": 3 + }, + "reserved": [] + }, + "Process": { + "fields": { + "ancestry": 1, + "auid": 2, + "cmd_line": 3, + "container": 4, + "cpid": 5, + "created_time": 6, + "created_time_dt": 7, + "egid": 8, + "environment_variables": 9, + "euid": 10, + "file": 11, + "group": 12, + "hosted_services": 13, + "integrity": 14, + "integrity_id": 15, + "lineage": 16, + "loaded_modules": 17, + "name": 18, + "namespace_pid": 19, + "parent_process": 20, + "path": 21, + "pid": 22, + "ptid": 23, + "sandbox": 24, + "session": 25, + "terminated_time": 26, + "terminated_time_dt": 27, + "tid": 28, + "uid": 29, + "user": 30, + "working_directory": 31, + "xattributes": 32 + }, + "reserved": [] + }, + "ProcessEntity": { + "fields": { + "cmd_line": 1, + "cpid": 2, + "created_time": 3, + "created_time_dt": 4, + "name": 5, + "path": 6, + "pid": 7, + "uid": 8 + }, + "reserved": [] + }, + "Product": { + "fields": { + "cpe_name": 1, + "data_classification": 2, + "data_classifications": 3, + "feature": 4, + "lang": 5, + "name": 6, + "path": 7, + "uid": 8, + "url_string": 9, + "vendor_name": 10, + "version": 11 + }, + "reserved": [] + }, + "ProgrammaticCredential": { + "fields": { + "last_used_time": 1, + "last_used_time_dt": 2, + "type": 3, + "uid": 4 + }, + "reserved": [] + }, + "Remediation": { + "fields": { + "cis_controls": 1, + "desc": 2, + "kb_article_list": 3, + "kb_articles": 4, + "references": 5 + }, + "reserved": [] + }, + "Reporter": { + "fields": { + "hostname": 1, + "ip": 2, + "name": 3, + "org": 4, + "uid": 5 + }, + "reserved": [] + }, + "Reputation": { + "fields": { + "base_score": 1, + "provider": 2, + "score": 3, + "score_id": 4 + }, + "reserved": [] + }, + "Request": { + "fields": { + "containers": 1, + "data": 2, + "flags": 3, + "uid": 4 + }, + "reserved": [] + }, + "ResourceDetails": { + "fields": { + "agent_list": 1, + "cloud_partition": 2, + "created_time": 3, + "created_time_dt": 4, + "criticality": 5, + "data": 6, + "data_classification": 7, + "data_classifications": 8, + "group": 9, + "hostname": 10, + "ip": 11, + "is_backed_up": 12, + "labels": 13, + "modified_time": 14, + "modified_time_dt": 15, + "name": 16, + "namespace": 17, + "owner": 18, + "provider": 29, + "region": 19, + "resource_relationship": 20, + "role": 21, + "role_id": 22, + "tags": 23, + "type": 24, + "uid": 25, + "uid_alt": 26, + "version": 27, + "zone": 28 + }, + "reserved": [] + }, + "Response": { + "fields": { + "code": 1, + "containers": 2, + "data": 3, + "error": 4, + "error_message": 5, + "flags": 6, + "message": 7 + }, + "reserved": [] + }, + "Rule": { + "fields": { + "category": 1, + "desc": 2, + "name": 3, + "type": 4, + "uid": 5, + "version": 6 + }, + "reserved": [] + }, + "San": { + "fields": { + "name": 1, + "type": 2 + }, + "reserved": [] + }, + "Sbom": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "package": 3, + "product": 4, + "software_components": 5, + "type": 6, + "type_id": 7, + "uid": 8, + "version": 9 + }, + "reserved": [] + }, + "Scim": { + "fields": { + "auth_protocol": 1, + "auth_protocol_id": 2, + "created_time": 3, + "created_time_dt": 4, + "error_message": 5, + "is_group_provisioning_enabled": 6, + "is_user_provisioning_enabled": 7, + "last_run_time": 8, + "last_run_time_dt": 9, + "modified_time": 10, + "modified_time_dt": 11, + "name": 12, + "protocol_name": 13, + "rate_limit": 14, + "scim_group_schema": 15, + "scim_user_schema": 16, + "state": 17, + "state_id": 18, + "uid": 19, + "uid_alt": 20, + "url_string": 21, + "vendor_name": 22, + "version": 23 + }, + "reserved": [] + }, + "Script": { + "fields": { + "file": 1, + "hashes": 2, + "name": 3, + "parent_uid": 4, + "script_content": 5, + "type": 6, + "type_id": 7, + "uid": 8 + }, + "reserved": [] + }, + "Service": { + "fields": { + "labels": 1, + "name": 2, + "tags": 3, + "uid": 4, + "version": 5 + }, + "reserved": [] + }, + "Session": { + "fields": { + "count": 1, + "created_time": 2, + "created_time_dt": 3, + "credential_uid": 4, + "expiration_reason": 5, + "expiration_time": 6, + "expiration_time_dt": 7, + "is_mfa": 8, + "is_remote": 9, + "is_vpn": 10, + "issuer": 11, + "terminal": 12, + "uid": 13, + "uid_alt": 14, + "uuid": 15 + }, + "reserved": [] + }, + "SoftwareComponent": { + "fields": { + "author": 1, + "hash": 2, + "license": 3, + "name": 4, + "purl": 5, + "related_component": 6, + "relationship": 7, + "relationship_id": 8, + "type": 9, + "type_id": 10, + "version": 11 + }, + "reserved": [] + }, + "Span": { + "fields": { + "duration": 1, + "end_time": 2, + "end_time_dt": 3, + "message": 4, + "operation": 5, + "parent_uid": 6, + "service": 7, + "start_time": 8, + "start_time_dt": 9, + "status_code": 10, + "uid": 11 + }, + "reserved": [] + }, + "Sso": { + "fields": { + "auth_protocol": 1, + "auth_protocol_id": 2, + "certificate": 3, + "created_time": 4, + "created_time_dt": 5, + "duration_mins": 6, + "idle_timeout": 7, + "login_endpoint": 8, + "logout_endpoint": 9, + "metadata_endpoint": 10, + "modified_time": 11, + "modified_time_dt": 12, + "name": 13, + "protocol_name": 14, + "scopes": 15, + "uid": 16, + "vendor_name": 17 + }, + "reserved": [] + }, + "SubTechnique": { + "fields": { + "name": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "Tactic": { + "fields": { + "name": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "Technique": { + "fields": { + "name": 1, + "src_url": 2, + "uid": 3 + }, + "reserved": [] + }, + "ThreatActor": { + "fields": { + "name": 1, + "type": 2, + "type_id": 3 + }, + "reserved": [] + }, + "Timespan": { + "fields": { + "duration": 1, + "duration_days": 2, + "duration_hours": 3, + "duration_mins": 4, + "duration_months": 5, + "duration_secs": 6, + "duration_weeks": 7, + "duration_years": 8, + "end_time": 9, + "end_time_dt": 10, + "start_time": 11, + "start_time_dt": 12, + "type": 13, + "type_id": 14 + }, + "reserved": [] + }, + "Token": { + "fields": { + "created_time": 1, + "created_time_dt": 2, + "expiration_time": 3, + "expiration_time_dt": 4, + "is_renewable": 5, + "modified_time": 6, + "modified_time_dt": 7, + "name": 8, + "tenant_uid": 9, + "type": 10, + "type_id": 11, + "uid": 12, + "zone": 13 + }, + "reserved": [] + }, + "Trace": { + "fields": { + "duration": 1, + "end_time": 2, + "end_time_dt": 3, + "flags": 4, + "service": 5, + "span": 6, + "start_time": 7, + "start_time_dt": 8, + "uid": 9 + }, + "reserved": [] + }, + "TransformationInfo": { + "fields": { + "lang": 1, + "name": 2, + "product": 3, + "time": 4, + "time_dt": 5, + "uid": 6, + "url_string": 7 + }, + "reserved": [] + }, + "Url": { + "fields": { + "categories": 1, + "category_ids": 2, + "domain": 3, + "hostname": 4, + "path": 5, + "port": 6, + "query_string": 7, + "resource_type": 8, + "scheme": 9, + "subdomain": 10, + "url_string": 11 + }, + "reserved": [] + }, + "User": { + "fields": { + "account": 1, + "credential_uid": 2, + "display_name": 3, + "domain": 4, + "email_addr": 5, + "forward_addr": 6, + "full_name": 7, + "groups": 8, + "has_mfa": 9, + "ldap_person": 10, + "name": 11, + "org": 12, + "phone_number": 13, + "programmatic_credentials": 14, + "risk_level": 15, + "risk_level_id": 16, + "risk_score": 17, + "type": 18, + "type_id": 19, + "uid": 20, + "uid_alt": 21 + }, + "reserved": [] + }, + "Vulnerability": { + "fields": { + "advisory": 1, + "affected_code": 2, + "affected_packages": 3, + "category": 4, + "cve": 5, + "cwe": 6, + "dependency_chain": 7, + "desc": 8, + "exploit_last_seen_time": 9, + "exploit_last_seen_time_dt": 10, + "exploit_ref_url": 11, + "exploit_requirement": 12, + "exploit_type": 13, + "first_seen_time": 14, + "first_seen_time_dt": 15, + "fix_available": 16, + "fix_coverage": 17, + "fix_coverage_id": 18, + "is_exploit_available": 19, + "is_fix_available": 20, + "kb_article_list": 21, + "kb_articles": 22, + "last_seen_time": 23, + "last_seen_time_dt": 24, + "packages": 25, + "references": 26, + "related_vulnerabilities": 27, + "remediation": 28, + "severity": 29, + "title": 30, + "vendor_name": 31 + }, + "reserved": [] + }, + "Whois": { + "fields": { + "autonomous_system": 1, + "created_time": 2, + "created_time_dt": 3, + "dnssec_status": 4, + "dnssec_status_id": 5, + "domain": 6, + "domain_contacts": 7, + "email_addr": 8, + "isp": 9, + "isp_org": 10, + "last_seen_time": 11, + "last_seen_time_dt": 12, + "name_servers": 13, + "phone_number": 14, + "registrar": 15, + "status": 16, + "subdomains": 17, + "subnet": 18 + }, + "reserved": [] + }, + "WinService": { + "fields": { + "cmd_line": 1, + "hosting_process": 2, + "labels": 3, + "load_order_group": 4, + "name": 5, + "service_category": 6, + "service_category_id": 7, + "service_dependencies": 8, + "service_dll_file": 9, + "service_error_control": 10, + "service_error_control_id": 11, + "service_file": 12, + "service_start_name": 13, + "service_start_type": 14, + "service_start_type_id": 15, + "service_type": 16, + "service_type_id": 17, + "tags": 18, + "uid": 19, + "version": 20 + }, + "reserved": [] + } +} From cded9b7c9779071d3f77ba5bd51e2ee8861693ec Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:09:25 +0200 Subject: [PATCH 07/26] test(ocsf): validate generated events against the OCSF server End-to-end acceptance test: the generated 6003/3004 protos compile to Go, populated events round-trip through proto binary, and their OCSF-JSON export is validated live via POST /{version}/api/v2/validate (gating on error_count, checking HTTP status, skipping only on genuine connectivity failure). Events declare metadata.profiles for profile-gated attributes. genpb regenerates from the module root into conformance/genpb. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../ocsf/conformance/conformance_test.go | 720 + .../ocsf/conformance/genpb/api_entity.pb.go | 25107 ++++++++++++++++ .../ocsf/conformance/genpb/buf.gen.yaml | 28 + 3 files changed, 25855 insertions(+) create mode 100644 ocsf/internal/ocsf/conformance/conformance_test.go create mode 100644 ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go create mode 100644 ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml diff --git a/ocsf/internal/ocsf/conformance/conformance_test.go b/ocsf/internal/ocsf/conformance/conformance_test.go new file mode 100644 index 0000000..7fcd116 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/conformance_test.go @@ -0,0 +1,720 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Package conformance is an end-to-end acceptance test that verifies: +// +// 1. The generated Go bindings in genpb/ compile and can be instantiated +// (consumability of the generated proto). +// +// 2. Populated events round-trip through proto binary encoding +// (proto.Marshal → proto.Unmarshal → proto.Equal). +// +// 3. Exported OCSF JSON satisfies structural invariants derived from the +// OCSF 1.8.0 schema (required fields present, correct JSON types). +// +// 4. External server validation against the official OCSF validate endpoint +// at schema.ocsf.io. This step is skipped only when the endpoint is +// unreachable (no network). A 200 response with errors is a test failure. +package conformance_test + +import ( + "bytes" + "context" + "encoding/json" + "errors" + "fmt" + "io" + "net" + "net/http" + "testing" + "time" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" +) + +// ──────────────────────────────────────────────────────────────────────────── +// Event builders +// ──────────────────────────────────────────────────────────────────────────── + +// buildApiActivityAllowed builds an ApiActivity (class 6003) representing an +// authorisation decision that was allowed. It populates all required fields +// plus several recommended ones to produce a realistic event. +// +// The event declares metadata.profiles = ["cloud", "security_control"] because: +// - cloud belongs to the "cloud" profile +// - disposition_id and authorizations belong to the "security_control" profile +// +// Without declaring these profiles the OCSF validate endpoint returns +// attribute_unknown errors for all three fields. +func buildApiActivityAllowed() *ocsfv1.ApiActivity { + return &ocsfv1.ApiActivity{ + // ── Required class-level scalars ────────────────────────────────── + ClassUid: ocsfv1.ApiActivity_CLASS_UID_API_ACTIVITY, // 6003 + CategoryUid: ocsfv1.ApiActivity_CATEGORY_UID_APPLICATION_ACTIVITY, + TypeUid: ocsfv1.ApiActivity_TYPE_UID_API_ACTIVITY_READ, + ActivityId: ocsfv1.ApiActivity_ACTIVITY_ID_READ, + SeverityId: ocsfv1.ApiActivity_SEVERITY_ID_INFORMATIONAL, + Time: 1751313600000, // 2025-06-30T12:00:00.000Z in epoch-ms + + // ── Required: actor (at_least_one: user) ───────────────────────── + Actor: &ocsfv1.Actor{ + User: &ocsfv1.User{ + Uid: "user:alice@example.com", + Name: "alice", + }, + }, + + // ── Required: api ──────────────────────────────────────────────── + Api: &ocsfv1.Api{ + Operation: "DescribeTopics", + Service: &ocsfv1.Service{ + Name: "redpanda-cloud", + }, + }, + + // ── Required: cloud (from "cloud" profile) ─────────────────────── + Cloud: &ocsfv1.Cloud{ + Provider: "AWS", + Region: "us-east-1", + }, + + // ── Required: metadata ─────────────────────────────────────────── + // Profiles must be declared for profile-gated attributes to be + // accepted by the OCSF validate endpoint. + Metadata: &ocsfv1.Metadata{ + Version: "1.8.0", + Product: &ocsfv1.Product{ + Name: "Redpanda Cloud", + VendorName: "Redpanda Data", + }, + Profiles: []string{"cloud", "security_control"}, + }, + + // ── Required: osint (empty list satisfies the repeated-required field) ── + // OCSF proto marks osint as required, but the schema allows an empty list. + // We pass a nil slice here; the exporter omits empty repeated fields. + Osint: nil, + + // ── Required: src_endpoint (at_least_one satisfied by ip) ──────── + SrcEndpoint: &ocsfv1.NetworkEndpoint{ + Ip: "10.0.1.42", + }, + + // ── Authorization verdict fields (from "security_control" profile) ── + DispositionId: ocsfv1.ApiActivity_DISPOSITION_ID_ALLOWED, // 1 = Allowed + StatusId: ocsfv1.ApiActivity_STATUS_ID_SUCCESS, + + Authorizations: []*ocsfv1.Authorization{ + { + Decision: "Permit", + Policy: &ocsfv1.Policy{ + Uid: "policy:cluster-readonly-v1", + Name: "ClusterReadOnly", + }, + }, + }, + + Resources: []*ocsfv1.ResourceDetails{ + { + Uid: "rn:redpanda:cluster:prod-cluster-1", + Name: "prod-cluster-1", + Type: "cluster", + }, + }, + + Message: "DescribeTopics authorised for alice", + } +} + +// buildApiActivityUnauthorized builds an ApiActivity for an authorization +// denial (disposition_id = 26 UNAUTHORIZED, status_id = FAILURE). +func buildApiActivityUnauthorized() *ocsfv1.ApiActivity { + evt := buildApiActivityAllowed() + evt.DispositionId = ocsfv1.ApiActivity_DISPOSITION_ID_UNAUTHORIZED // 26 + evt.StatusId = ocsfv1.ApiActivity_STATUS_ID_FAILURE + evt.Message = "DescribeTopics denied for alice: missing CreateTopics role" + evt.Authorizations = []*ocsfv1.Authorization{ + { + Decision: "Deny", + Policy: &ocsfv1.Policy{ + Uid: "policy:cluster-readonly-v1", + Name: "ClusterReadOnly", + }, + }, + } + return evt +} + +// buildEntityManagement builds an EntityManagement (class 3004) event +// representing the creation of a new IAM policy. +// +// The event declares metadata.profiles = ["cloud"] because the cloud attribute +// belongs to the "cloud" profile and is rejected as attribute_unknown without it. +func buildEntityManagement() *ocsfv1.EntityManagement { + return &ocsfv1.EntityManagement{ + // ── Required class-level scalars ────────────────────────────────── + ClassUid: ocsfv1.EntityManagement_CLASS_UID_ENTITY_MANAGEMENT, // 3004 + CategoryUid: ocsfv1.EntityManagement_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT, + TypeUid: ocsfv1.EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_CREATE, + ActivityId: ocsfv1.EntityManagement_ACTIVITY_ID_CREATE, + SeverityId: ocsfv1.EntityManagement_SEVERITY_ID_INFORMATIONAL, + Time: 1751313600000, + + // ── Required: entity (at_least_one: policy) ────────────────────── + Entity: &ocsfv1.ManagedEntity{ + TypeId: ocsfv1.ManagedEntity_TYPE_ID_POLICY, + Type: "policy", + Name: "cluster-readonly-v1", + Uid: "policy:cluster-readonly-v1", + Policy: &ocsfv1.Policy{ + Uid: "policy:cluster-readonly-v1", + Name: "ClusterReadOnly", + }, + }, + + // ── cloud (from "cloud" profile) ───────────────────────────────── + Cloud: &ocsfv1.Cloud{ + Provider: "AWS", + Region: "us-east-1", + }, + + // ── Required: metadata ─────────────────────────────────────────── + // Declare "cloud" profile so the cloud attribute is accepted by the + // OCSF validate endpoint. + Metadata: &ocsfv1.Metadata{ + Version: "1.8.0", + Product: &ocsfv1.Product{ + Name: "Redpanda Cloud", + VendorName: "Redpanda Data", + }, + Profiles: []string{"cloud"}, + }, + + // ── Required: osint (repeated; nil means empty — omitted in JSON) ─ + Osint: nil, + + // ── Actor (optional for entity_management but realistic) ───────── + Actor: &ocsfv1.Actor{ + User: &ocsfv1.User{ + Uid: "user:admin@example.com", + Name: "admin", + }, + }, + + Message: "Policy cluster-readonly-v1 created", + } +} + +// ──────────────────────────────────────────────────────────────────────────── +// Round-trip test +// ──────────────────────────────────────────────────────────────────────────── + +// TestProtoRoundTrip marshals and unmarshals each event and asserts +// proto.Equal holds. This proves wire round-trip correctness on the generated +// types. +func TestProtoRoundTrip(t *testing.T) { + t.Run("ApiActivity/Allowed", func(t *testing.T) { + original := buildApiActivityAllowed() + roundtrip(t, original, &ocsfv1.ApiActivity{}) + }) + t.Run("ApiActivity/Unauthorized", func(t *testing.T) { + original := buildApiActivityUnauthorized() + roundtrip(t, original, &ocsfv1.ApiActivity{}) + }) + t.Run("EntityManagement/Create", func(t *testing.T) { + original := buildEntityManagement() + roundtrip(t, original, &ocsfv1.EntityManagement{}) + }) +} + +func roundtrip(t *testing.T, original, decoded proto.Message) { + t.Helper() + + wire, err := proto.Marshal(original) + require.NoError(t, err, "proto.Marshal must succeed") + require.NotEmpty(t, wire, "wire encoding must not be empty") + + err = proto.Unmarshal(wire, decoded) + require.NoError(t, err, "proto.Unmarshal must succeed") + + require.True(t, proto.Equal(original, decoded), + "proto.Equal(original, decoded) must hold after round-trip") +} + +// ──────────────────────────────────────────────────────────────────────────── +// OCSF JSON export + structural invariants +// ──────────────────────────────────────────────────────────────────────────── + +// TestOCSFJSONExport verifies that ToOCSFJSON produces valid JSON and that +// the key OCSF structural invariants hold on the output. +func TestOCSFJSONExport(t *testing.T) { + t.Run("ApiActivity/Allowed", func(t *testing.T) { + evt := buildApiActivityAllowed() + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + + assertApiActivityInvariants(t, m, 1 /* ALLOWED */, 1 /* SUCCESS */) + }) + + t.Run("ApiActivity/Unauthorized", func(t *testing.T) { + evt := buildApiActivityUnauthorized() + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + + assertApiActivityInvariants(t, m, 26 /* UNAUTHORIZED */, 2 /* FAILURE */) + }) + + t.Run("EntityManagement/Create", func(t *testing.T) { + evt := buildEntityManagement() + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + + assertEntityManagementInvariants(t, m) + }) +} + +// assertApiActivityInvariants checks the required OCSF fields and types for +// class 6003 (api_activity). +func assertApiActivityInvariants(t *testing.T, m map[string]any, wantDispositionID, wantStatusID float64) { + t.Helper() + + // class_uid must be the integer 6003. + requireJSONNumber(t, m, "class_uid", 6003) + // category_uid must be 6. + requireJSONNumber(t, m, "category_uid", 6) + // time must be a JSON number (not a string). + requireJSONNumberPresent(t, m, "time") + // severity_id must be an integer. + requireJSONNumberPresent(t, m, "severity_id") + // type_uid must be a JSON number. + requireJSONNumberPresent(t, m, "type_uid") + // activity_id must be a JSON number. + requireJSONNumberPresent(t, m, "activity_id") + + // disposition_id must match the expected value. + requireJSONNumber(t, m, "disposition_id", wantDispositionID) + // status_id must match. + requireJSONNumber(t, m, "status_id", wantStatusID) + + // Keys must be snake_case. + for _, camel := range []string{"classUid", "categoryUid", "severityId", "typeUid", "activityId", "dispositionId", "statusId"} { + require.NotContains(t, m, camel, "camelCase key %q must not appear in OCSF JSON output", camel) + } + + // actor must be a JSON object with a nested user. + actorRaw, ok := m["actor"] + require.True(t, ok, "actor must be present") + actor, ok := actorRaw.(map[string]any) + require.True(t, ok, "actor must be a JSON object, got %T", actorRaw) + userRaw, ok := actor["user"] + require.True(t, ok, "actor.user must be present") + user, ok := userRaw.(map[string]any) + require.True(t, ok, "actor.user must be a JSON object, got %T", userRaw) + require.NotEmpty(t, user["uid"], "actor.user.uid must be non-empty") + + // api must be a JSON object with operation. + apiRaw, ok := m["api"] + require.True(t, ok, "api must be present") + apiObj, ok := apiRaw.(map[string]any) + require.True(t, ok, "api must be a JSON object, got %T", apiRaw) + require.NotEmpty(t, apiObj["operation"], "api.operation must be non-empty") + + // cloud must be present with provider (from "cloud" profile). + cloudRaw, ok := m["cloud"] + require.True(t, ok, "cloud must be present") + cloud, ok := cloudRaw.(map[string]any) + require.True(t, ok, "cloud must be a JSON object, got %T", cloudRaw) + require.NotEmpty(t, cloud["provider"], "cloud.provider must be non-empty") + + // metadata must be present with version and product. + metaRaw, ok := m["metadata"] + require.True(t, ok, "metadata must be present") + meta, ok := metaRaw.(map[string]any) + require.True(t, ok, "metadata must be a JSON object, got %T", metaRaw) + require.NotEmpty(t, meta["version"], "metadata.version must be non-empty") + productRaw, ok := meta["product"] + require.True(t, ok, "metadata.product must be present") + product, ok := productRaw.(map[string]any) + require.True(t, ok, "metadata.product must be a JSON object, got %T", productRaw) + require.NotEmpty(t, product["name"], "metadata.product.name must be non-empty") + + // src_endpoint must be present. + seRaw, ok := m["src_endpoint"] + require.True(t, ok, "src_endpoint must be present") + se, ok := seRaw.(map[string]any) + require.True(t, ok, "src_endpoint must be a JSON object, got %T", seRaw) + require.NotEmpty(t, se["ip"], "src_endpoint.ip must be non-empty") + + // authorizations must be a JSON array (from "security_control" profile). + authRaw, ok := m["authorizations"] + require.True(t, ok, "authorizations must be present") + authArr, ok := authRaw.([]any) + require.True(t, ok, "authorizations must be a JSON array, got %T", authRaw) + require.NotEmpty(t, authArr, "authorizations must be non-empty") + + // First authorization must have a nested policy.uid. + firstAuth, ok := authArr[0].(map[string]any) + require.True(t, ok, "authorizations[0] must be a JSON object, got %T", authArr[0]) + policyRaw, ok := firstAuth["policy"] + require.True(t, ok, "authorizations[0].policy must be present") + policy, ok := policyRaw.(map[string]any) + require.True(t, ok, "authorizations[0].policy must be a JSON object, got %T", policyRaw) + require.NotEmpty(t, policy["uid"], "authorizations[0].policy.uid must be non-empty") +} + +// assertEntityManagementInvariants checks the required OCSF fields for +// class 3004 (entity_management). +func assertEntityManagementInvariants(t *testing.T, m map[string]any) { + t.Helper() + + requireJSONNumber(t, m, "class_uid", 3004) + requireJSONNumber(t, m, "category_uid", 3) + requireJSONNumberPresent(t, m, "time") + requireJSONNumberPresent(t, m, "severity_id") + requireJSONNumberPresent(t, m, "type_uid") + requireJSONNumberPresent(t, m, "activity_id") + + // entity must be a JSON object (at_least_one: policy is satisfied by uid+name). + entityRaw, ok := m["entity"] + require.True(t, ok, "entity must be present") + entity, ok := entityRaw.(map[string]any) + require.True(t, ok, "entity must be a JSON object, got %T", entityRaw) + require.NotEmpty(t, entity["uid"], "entity.uid must be non-empty") + // type_id must be an integer, not a string. + typeIDRaw, ok := entity["type_id"] + require.True(t, ok, "entity.type_id must be present") + _, isNum := typeIDRaw.(float64) + require.True(t, isNum, "entity.type_id must be a JSON number (OCSF enum = integer), got %T", typeIDRaw) + + // cloud must be present with provider (from "cloud" profile). + cloudRaw, ok := m["cloud"] + require.True(t, ok, "cloud must be present") + cloud, ok := cloudRaw.(map[string]any) + require.True(t, ok, "cloud must be a JSON object") + require.NotEmpty(t, cloud["provider"]) + + // metadata with version + product. + metaRaw, ok := m["metadata"] + require.True(t, ok, "metadata must be present") + meta, ok := metaRaw.(map[string]any) + require.True(t, ok, "metadata must be a JSON object, got %T", metaRaw) + require.NotEmpty(t, meta["version"]) +} + +// ──────────────────────────────────────────────────────────────────────────── +// External conformance validation (OCSF server validate endpoint) +// ──────────────────────────────────────────────────────────────────────────── + +// validationError is a single error entry from the OCSF validate response. +type validationError struct { + Error string `json:"error"` + Message string `json:"message"` + Attribute string `json:"attribute"` + AttributePath string `json:"attribute_path"` +} + +// validateResponse is the response body from POST /api/v2/validate. +type validateResponse struct { + Errors []validationError `json:"errors"` + Warnings []validationError `json:"warnings"` + ErrorCount int `json:"error_count"` + WarningCount int `json:"warning_count"` +} + +// ocsfValidateClient is a reusable HTTP client for the OCSF validate endpoint. +// It does not follow redirects to a different host. +var ocsfValidateClient = &http.Client{ + Timeout: 30 * time.Second, + CheckRedirect: func(req *http.Request, via []*http.Request) error { + if len(via) > 0 && req.URL.Host != via[0].URL.Host { + return fmt.Errorf("redirect to different host %q refused", req.URL.Host) + } + return nil + }, +} + +// validateAgainstOCSFServer POSTs eventJSON to the OCSF server validate +// endpoint for the given version and returns the parsed response. +// +// Transport-level failures (dial, timeout, DNS) return a non-nil err. +// A non-200 HTTP response also returns a non-nil err (server reachable but +// unhealthy — this is a test failure, not a skip). A 200 response that +// carries validation errors returns err == nil with errCount > 0. +func validateAgainstOCSFServer(t *testing.T, version string, eventJSON []byte) (errCount int, errs []validationError, err error) { + t.Helper() + + url := fmt.Sprintf("https://schema.ocsf.io/%s/api/v2/validate", version) + req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, url, bytes.NewReader(eventJSON)) + if err != nil { + return 0, nil, fmt.Errorf("creating request: %w", err) + } + req.Header.Set("Content-Type", "application/json") + resp, err := ocsfValidateClient.Do(req) + if err != nil { + return 0, nil, fmt.Errorf("POST %s: %w", url, err) + } + defer resp.Body.Close() + + body, err := io.ReadAll(resp.Body) + if err != nil { + return 0, nil, fmt.Errorf("reading response body: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return 0, nil, fmt.Errorf("OCSF validate returned HTTP %d; body: %s", resp.StatusCode, body) + } + + var vr validateResponse + if err := json.Unmarshal(body, &vr); err != nil { + return 0, nil, fmt.Errorf("parsing validate response (status %d): %w\nbody: %s", resp.StatusCode, err, body) + } + + return vr.ErrorCount, vr.Errors, nil +} + +// isConnectivityError reports whether err represents a genuine connectivity +// failure: a dial/timeout error, DNS failure, or context deadline exceeded. +// It returns false for any other error (redirect refused, non-200 HTTP, etc.), +// which must be treated as a hard test failure rather than a skip. +func isConnectivityError(err error) bool { + if err == nil { + return false + } + if errors.Is(err, context.DeadlineExceeded) { + return true + } + var netErr net.Error + if errors.As(err, &netErr) && netErr.Timeout() { + return true + } + // url.Error wraps net.OpError for dial/lookup failures. + var opErr *net.OpError + if errors.As(err, &opErr) { + return true + } + return false +} + +// TestServerConformance validates the exported OCSF JSON for each event +// against the official OCSF validate endpoint at schema.ocsf.io. +// +// The test is skipped only when the validate POST fails with a genuine +// connectivity error (dial/timeout/DNS) on the first event. Any other error +// (non-200 HTTP, redirect refused) is a hard test failure. A 200 response that +// carries validation errors is also a FAILURE, not a skip. +// +// Manual equivalent: +// +// curl -s -X POST https://schema.ocsf.io/1.8.0/api/v2/validate \ +// -H 'Content-Type: application/json' \ +// -d @event.json | jq . +func TestServerConformance(t *testing.T) { + const version = "1.8.0" + + cases := []struct { + name string + builder func() proto.Message + }{ + {"ApiActivity/Allowed", func() proto.Message { return buildApiActivityAllowed() }}, + {"ApiActivity/Unauthorized", func() proto.Message { return buildApiActivityUnauthorized() }}, + {"EntityManagement/Create", func() proto.Message { return buildEntityManagement() }}, + } + + networkUnavailable := false + + for _, tc := range cases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + if networkUnavailable { + t.Skip("schema.ocsf.io is unreachable; skipping remaining conformance cases") + return + } + + eventJSON, err := exporter.ToOCSFJSON(tc.builder()) + require.NoError(t, err, "ToOCSFJSON must succeed") + + t.Logf("event JSON: %s", eventJSON) + + errCount, errs, err := validateAgainstOCSFServer(t, version, eventJSON) + if err != nil { + if isConnectivityError(err) { + networkUnavailable = true + t.Skipf("OCSF server unreachable (connectivity): %v\nManual: curl -s -X POST https://schema.ocsf.io/%s/api/v2/validate -H 'Content-Type: application/json' -d @event.json", err, version) + return + } + t.Fatalf("OCSF server request failed (non-connectivity): %v", err) + } + + if errCount > 0 { + for _, e := range errs { + t.Errorf(" attribute_path=%q error=%q message=%q", e.AttributePath, e.Error, e.Message) + } + t.Fatalf("OCSF server validation: %d error(s) for %s", errCount, tc.name) + } + + t.Log("OCSF server validation: CLEAN (error_count=0)") + }) + } +} + +// ──────────────────────────────────────────────────────────────────────────── +// JSON Schema validation (Go-side raw schema check) +// ──────────────────────────────────────────────────────────────────────────── + +// TestOCSFSchemaRequiredFields validates the exported JSON against the +// required-field list from the OCSF 1.8.0 server validate endpoint. This is +// an offline, hermetic check that proves the exported events are not trivially +// wrong. +// +// cloud, disposition_id, and authorizations are profile-gated attributes. +// They are valid for these classes when the event declares the corresponding +// profiles in metadata.profiles ("cloud" and "security_control"). Our events +// do declare those profiles and populate the fields. +func TestOCSFSchemaRequiredFields(t *testing.T) { + // Required fields per class, as enforced by the OCSF 1.8.0 validate endpoint. + apiActivityRequired := []string{ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + // "osint" is required in the schema but our events have an empty list, which + // the exporter omits (proto3 empty repeated = zero value = omitted). + // The OCSF JSON Schema allows the field to be absent when the list is empty, + // so we do not assert its presence here. + "severity_id", + "src_endpoint", + "time", + "type_uid", + } + + entityManagementRequired := []string{ + "activity_id", + "category_uid", + "class_uid", + "entity", + "metadata", + // "osint" — same note as above. + "severity_id", + "time", + "type_uid", + } + + t.Run("ApiActivity/Allowed", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildApiActivityAllowed()) + require.NoError(t, err) + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + for _, field := range apiActivityRequired { + require.Contains(t, m, field, "required field %q must be present in api_activity JSON", field) + } + }) + + t.Run("ApiActivity/Unauthorized", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildApiActivityUnauthorized()) + require.NoError(t, err) + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + for _, field := range apiActivityRequired { + require.Contains(t, m, field, "required field %q must be present in api_activity JSON", field) + } + }) + + t.Run("EntityManagement/Create", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildEntityManagement()) + require.NoError(t, err) + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + for _, field := range entityManagementRequired { + require.Contains(t, m, field, "required field %q must be present in entity_management JSON", field) + } + }) +} + +// TestRawJSONBytes verifies key byte-level invariants: integer enums, unquoted +// int64 timestamps, and snake_case keys. These are the three divergence +// points between ToOCSFJSON and stock protojson. +func TestRawJSONBytes(t *testing.T) { + t.Run("ApiActivity", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildApiActivityAllowed()) + require.NoError(t, err) + + // class_uid must be the integer 6003, not a string or the enum name. + require.True(t, bytes.Contains(b, []byte(`"class_uid":6003`)), + "class_uid must be emitted as integer 6003; raw: %s", b) + // time must be an unquoted integer. + require.True(t, bytes.Contains(b, []byte(`"time":1751313600000`)), + "time must be an unquoted integer; raw: %s", b) + // No camelCase keys in the output. + require.False(t, bytes.Contains(b, []byte(`classUid`)), + "camelCase key classUid must not appear; raw: %s", b) + // status_id = 1 as integer (SUCCESS). + require.True(t, bytes.Contains(b, []byte(`"status_id":1`)), + "status_id must be emitted as integer 1 (Success); raw: %s", b) + }) + + t.Run("ApiActivity/Unauthorized", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildApiActivityUnauthorized()) + require.NoError(t, err) + + // disposition_id = 26 (UNAUTHORIZED). + require.True(t, bytes.Contains(b, []byte(`"disposition_id":26`)), + "disposition_id must be 26 (Unauthorized); raw: %s", b) + // status_id = 2 (FAILURE). + require.True(t, bytes.Contains(b, []byte(`"status_id":2`)), + "status_id must be 2 (Failure); raw: %s", b) + }) + + t.Run("EntityManagement", func(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildEntityManagement()) + require.NoError(t, err) + + require.True(t, bytes.Contains(b, []byte(`"class_uid":3004`)), + "class_uid must be 3004; raw: %s", b) + require.True(t, bytes.Contains(b, []byte(`"category_uid":3`)), + "category_uid must be 3; raw: %s", b) + }) +} + +// ──────────────────────────────────────────────────────────────────────────── +// Helpers +// ──────────────────────────────────────────────────────────────────────────── + +// requireJSONNumber asserts that m[key] is a JSON number equal to want. +func requireJSONNumber(t *testing.T, m map[string]any, key string, want float64) { + t.Helper() + raw, ok := m[key] + require.True(t, ok, "key %q must be present", key) + f, isFloat := raw.(float64) + require.True(t, isFloat, "key %q must be a JSON number, got %T", key, raw) + require.Equal(t, want, f, "key %q must equal %.0f", key, want) +} + +// requireJSONNumberPresent asserts that m[key] exists and is a JSON number. +func requireJSONNumberPresent(t *testing.T, m map[string]any, key string) { + t.Helper() + raw, ok := m[key] + require.True(t, ok, "key %q must be present", key) + _, isFloat := raw.(float64) + require.True(t, isFloat, "key %q must be a JSON number, got %T", key, raw) +} diff --git a/ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go b/ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go new file mode 100644 index 0000000..c7c1b15 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go @@ -0,0 +1,25107 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.6 +// protoc (unknown) +// source: api_entity.proto + +package ocsfv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + structpb "google.golang.org/protobuf/types/known/structpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type ApiActivity_ActionId int32 + +const ( + ApiActivity_ACTION_ID_UNKNOWN ApiActivity_ActionId = 0 + ApiActivity_ACTION_ID_ALLOWED ApiActivity_ActionId = 1 + ApiActivity_ACTION_ID_DENIED ApiActivity_ActionId = 2 + ApiActivity_ACTION_ID_OBSERVED ApiActivity_ActionId = 3 + ApiActivity_ACTION_ID_MODIFIED ApiActivity_ActionId = 4 + ApiActivity_ACTION_ID_OTHER ApiActivity_ActionId = 99 +) + +// Enum value maps for ApiActivity_ActionId. +var ( + ApiActivity_ActionId_name = map[int32]string{ + 0: "ACTION_ID_UNKNOWN", + 1: "ACTION_ID_ALLOWED", + 2: "ACTION_ID_DENIED", + 3: "ACTION_ID_OBSERVED", + 4: "ACTION_ID_MODIFIED", + 99: "ACTION_ID_OTHER", + } + ApiActivity_ActionId_value = map[string]int32{ + "ACTION_ID_UNKNOWN": 0, + "ACTION_ID_ALLOWED": 1, + "ACTION_ID_DENIED": 2, + "ACTION_ID_OBSERVED": 3, + "ACTION_ID_MODIFIED": 4, + "ACTION_ID_OTHER": 99, + } +) + +func (x ApiActivity_ActionId) Enum() *ApiActivity_ActionId { + p := new(ApiActivity_ActionId) + *p = x + return p +} + +func (x ApiActivity_ActionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ActionId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[0].Descriptor() +} + +func (ApiActivity_ActionId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[0] +} + +func (x ApiActivity_ActionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ActionId.Descriptor instead. +func (ApiActivity_ActionId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 0} +} + +type ApiActivity_ActivityId int32 + +const ( + ApiActivity_ACTIVITY_ID_UNKNOWN ApiActivity_ActivityId = 0 + ApiActivity_ACTIVITY_ID_CREATE ApiActivity_ActivityId = 1 + ApiActivity_ACTIVITY_ID_READ ApiActivity_ActivityId = 2 + ApiActivity_ACTIVITY_ID_UPDATE ApiActivity_ActivityId = 3 + ApiActivity_ACTIVITY_ID_DELETE ApiActivity_ActivityId = 4 + ApiActivity_ACTIVITY_ID_OTHER ApiActivity_ActivityId = 99 +) + +// Enum value maps for ApiActivity_ActivityId. +var ( + ApiActivity_ActivityId_name = map[int32]string{ + 0: "ACTIVITY_ID_UNKNOWN", + 1: "ACTIVITY_ID_CREATE", + 2: "ACTIVITY_ID_READ", + 3: "ACTIVITY_ID_UPDATE", + 4: "ACTIVITY_ID_DELETE", + 99: "ACTIVITY_ID_OTHER", + } + ApiActivity_ActivityId_value = map[string]int32{ + "ACTIVITY_ID_UNKNOWN": 0, + "ACTIVITY_ID_CREATE": 1, + "ACTIVITY_ID_READ": 2, + "ACTIVITY_ID_UPDATE": 3, + "ACTIVITY_ID_DELETE": 4, + "ACTIVITY_ID_OTHER": 99, + } +) + +func (x ApiActivity_ActivityId) Enum() *ApiActivity_ActivityId { + p := new(ApiActivity_ActivityId) + *p = x + return p +} + +func (x ApiActivity_ActivityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ActivityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[1].Descriptor() +} + +func (ApiActivity_ActivityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[1] +} + +func (x ApiActivity_ActivityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ActivityId.Descriptor instead. +func (ApiActivity_ActivityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 1} +} + +type ApiActivity_CategoryUid int32 + +const ( + ApiActivity_CATEGORY_UID_UNKNOWN ApiActivity_CategoryUid = 0 + ApiActivity_CATEGORY_UID_APPLICATION_ACTIVITY ApiActivity_CategoryUid = 6 +) + +// Enum value maps for ApiActivity_CategoryUid. +var ( + ApiActivity_CategoryUid_name = map[int32]string{ + 0: "CATEGORY_UID_UNKNOWN", + 6: "CATEGORY_UID_APPLICATION_ACTIVITY", + } + ApiActivity_CategoryUid_value = map[string]int32{ + "CATEGORY_UID_UNKNOWN": 0, + "CATEGORY_UID_APPLICATION_ACTIVITY": 6, + } +) + +func (x ApiActivity_CategoryUid) Enum() *ApiActivity_CategoryUid { + p := new(ApiActivity_CategoryUid) + *p = x + return p +} + +func (x ApiActivity_CategoryUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_CategoryUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[2].Descriptor() +} + +func (ApiActivity_CategoryUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[2] +} + +func (x ApiActivity_CategoryUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_CategoryUid.Descriptor instead. +func (ApiActivity_CategoryUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 2} +} + +type ApiActivity_ClassUid int32 + +const ( + ApiActivity_CLASS_UID_UNKNOWN ApiActivity_ClassUid = 0 + ApiActivity_CLASS_UID_API_ACTIVITY ApiActivity_ClassUid = 6003 +) + +// Enum value maps for ApiActivity_ClassUid. +var ( + ApiActivity_ClassUid_name = map[int32]string{ + 0: "CLASS_UID_UNKNOWN", + 6003: "CLASS_UID_API_ACTIVITY", + } + ApiActivity_ClassUid_value = map[string]int32{ + "CLASS_UID_UNKNOWN": 0, + "CLASS_UID_API_ACTIVITY": 6003, + } +) + +func (x ApiActivity_ClassUid) Enum() *ApiActivity_ClassUid { + p := new(ApiActivity_ClassUid) + *p = x + return p +} + +func (x ApiActivity_ClassUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ClassUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[3].Descriptor() +} + +func (ApiActivity_ClassUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[3] +} + +func (x ApiActivity_ClassUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ClassUid.Descriptor instead. +func (ApiActivity_ClassUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 3} +} + +type ApiActivity_ConfidenceId int32 + +const ( + ApiActivity_CONFIDENCE_ID_UNKNOWN ApiActivity_ConfidenceId = 0 + ApiActivity_CONFIDENCE_ID_LOW ApiActivity_ConfidenceId = 1 + ApiActivity_CONFIDENCE_ID_MEDIUM ApiActivity_ConfidenceId = 2 + ApiActivity_CONFIDENCE_ID_HIGH ApiActivity_ConfidenceId = 3 + ApiActivity_CONFIDENCE_ID_OTHER ApiActivity_ConfidenceId = 99 +) + +// Enum value maps for ApiActivity_ConfidenceId. +var ( + ApiActivity_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + ApiActivity_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x ApiActivity_ConfidenceId) Enum() *ApiActivity_ConfidenceId { + p := new(ApiActivity_ConfidenceId) + *p = x + return p +} + +func (x ApiActivity_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[4].Descriptor() +} + +func (ApiActivity_ConfidenceId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[4] +} + +func (x ApiActivity_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ConfidenceId.Descriptor instead. +func (ApiActivity_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 4} +} + +type ApiActivity_DispositionId int32 + +const ( + ApiActivity_DISPOSITION_ID_UNKNOWN ApiActivity_DispositionId = 0 + ApiActivity_DISPOSITION_ID_ALLOWED ApiActivity_DispositionId = 1 + ApiActivity_DISPOSITION_ID_BLOCKED ApiActivity_DispositionId = 2 + ApiActivity_DISPOSITION_ID_QUARANTINED ApiActivity_DispositionId = 3 + ApiActivity_DISPOSITION_ID_ISOLATED ApiActivity_DispositionId = 4 + ApiActivity_DISPOSITION_ID_DELETED ApiActivity_DispositionId = 5 + ApiActivity_DISPOSITION_ID_DROPPED ApiActivity_DispositionId = 6 + ApiActivity_DISPOSITION_ID_CUSTOM_ACTION ApiActivity_DispositionId = 7 + ApiActivity_DISPOSITION_ID_APPROVED ApiActivity_DispositionId = 8 + ApiActivity_DISPOSITION_ID_RESTORED ApiActivity_DispositionId = 9 + ApiActivity_DISPOSITION_ID_EXONERATED ApiActivity_DispositionId = 10 + ApiActivity_DISPOSITION_ID_CORRECTED ApiActivity_DispositionId = 11 + ApiActivity_DISPOSITION_ID_PARTIALLY_CORRECTED ApiActivity_DispositionId = 12 + ApiActivity_DISPOSITION_ID_UNCORRECTED ApiActivity_DispositionId = 13 + ApiActivity_DISPOSITION_ID_DELAYED ApiActivity_DispositionId = 14 + ApiActivity_DISPOSITION_ID_DETECTED ApiActivity_DispositionId = 15 + ApiActivity_DISPOSITION_ID_NO_ACTION ApiActivity_DispositionId = 16 + ApiActivity_DISPOSITION_ID_LOGGED ApiActivity_DispositionId = 17 + ApiActivity_DISPOSITION_ID_TAGGED ApiActivity_DispositionId = 18 + ApiActivity_DISPOSITION_ID_ALERT ApiActivity_DispositionId = 19 + ApiActivity_DISPOSITION_ID_COUNT ApiActivity_DispositionId = 20 + ApiActivity_DISPOSITION_ID_RESET ApiActivity_DispositionId = 21 + ApiActivity_DISPOSITION_ID_CAPTCHA ApiActivity_DispositionId = 22 + ApiActivity_DISPOSITION_ID_CHALLENGE ApiActivity_DispositionId = 23 + ApiActivity_DISPOSITION_ID_ACCESS_REVOKED ApiActivity_DispositionId = 24 + ApiActivity_DISPOSITION_ID_REJECTED ApiActivity_DispositionId = 25 + ApiActivity_DISPOSITION_ID_UNAUTHORIZED ApiActivity_DispositionId = 26 + ApiActivity_DISPOSITION_ID_ERROR ApiActivity_DispositionId = 27 + ApiActivity_DISPOSITION_ID_OTHER ApiActivity_DispositionId = 99 +) + +// Enum value maps for ApiActivity_DispositionId. +var ( + ApiActivity_DispositionId_name = map[int32]string{ + 0: "DISPOSITION_ID_UNKNOWN", + 1: "DISPOSITION_ID_ALLOWED", + 2: "DISPOSITION_ID_BLOCKED", + 3: "DISPOSITION_ID_QUARANTINED", + 4: "DISPOSITION_ID_ISOLATED", + 5: "DISPOSITION_ID_DELETED", + 6: "DISPOSITION_ID_DROPPED", + 7: "DISPOSITION_ID_CUSTOM_ACTION", + 8: "DISPOSITION_ID_APPROVED", + 9: "DISPOSITION_ID_RESTORED", + 10: "DISPOSITION_ID_EXONERATED", + 11: "DISPOSITION_ID_CORRECTED", + 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", + 13: "DISPOSITION_ID_UNCORRECTED", + 14: "DISPOSITION_ID_DELAYED", + 15: "DISPOSITION_ID_DETECTED", + 16: "DISPOSITION_ID_NO_ACTION", + 17: "DISPOSITION_ID_LOGGED", + 18: "DISPOSITION_ID_TAGGED", + 19: "DISPOSITION_ID_ALERT", + 20: "DISPOSITION_ID_COUNT", + 21: "DISPOSITION_ID_RESET", + 22: "DISPOSITION_ID_CAPTCHA", + 23: "DISPOSITION_ID_CHALLENGE", + 24: "DISPOSITION_ID_ACCESS_REVOKED", + 25: "DISPOSITION_ID_REJECTED", + 26: "DISPOSITION_ID_UNAUTHORIZED", + 27: "DISPOSITION_ID_ERROR", + 99: "DISPOSITION_ID_OTHER", + } + ApiActivity_DispositionId_value = map[string]int32{ + "DISPOSITION_ID_UNKNOWN": 0, + "DISPOSITION_ID_ALLOWED": 1, + "DISPOSITION_ID_BLOCKED": 2, + "DISPOSITION_ID_QUARANTINED": 3, + "DISPOSITION_ID_ISOLATED": 4, + "DISPOSITION_ID_DELETED": 5, + "DISPOSITION_ID_DROPPED": 6, + "DISPOSITION_ID_CUSTOM_ACTION": 7, + "DISPOSITION_ID_APPROVED": 8, + "DISPOSITION_ID_RESTORED": 9, + "DISPOSITION_ID_EXONERATED": 10, + "DISPOSITION_ID_CORRECTED": 11, + "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, + "DISPOSITION_ID_UNCORRECTED": 13, + "DISPOSITION_ID_DELAYED": 14, + "DISPOSITION_ID_DETECTED": 15, + "DISPOSITION_ID_NO_ACTION": 16, + "DISPOSITION_ID_LOGGED": 17, + "DISPOSITION_ID_TAGGED": 18, + "DISPOSITION_ID_ALERT": 19, + "DISPOSITION_ID_COUNT": 20, + "DISPOSITION_ID_RESET": 21, + "DISPOSITION_ID_CAPTCHA": 22, + "DISPOSITION_ID_CHALLENGE": 23, + "DISPOSITION_ID_ACCESS_REVOKED": 24, + "DISPOSITION_ID_REJECTED": 25, + "DISPOSITION_ID_UNAUTHORIZED": 26, + "DISPOSITION_ID_ERROR": 27, + "DISPOSITION_ID_OTHER": 99, + } +) + +func (x ApiActivity_DispositionId) Enum() *ApiActivity_DispositionId { + p := new(ApiActivity_DispositionId) + *p = x + return p +} + +func (x ApiActivity_DispositionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_DispositionId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[5].Descriptor() +} + +func (ApiActivity_DispositionId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[5] +} + +func (x ApiActivity_DispositionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_DispositionId.Descriptor instead. +func (ApiActivity_DispositionId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 5} +} + +type ApiActivity_RiskLevelId int32 + +const ( + ApiActivity_RISK_LEVEL_ID_INFO ApiActivity_RiskLevelId = 0 + ApiActivity_RISK_LEVEL_ID_LOW ApiActivity_RiskLevelId = 1 + ApiActivity_RISK_LEVEL_ID_MEDIUM ApiActivity_RiskLevelId = 2 + ApiActivity_RISK_LEVEL_ID_HIGH ApiActivity_RiskLevelId = 3 + ApiActivity_RISK_LEVEL_ID_CRITICAL ApiActivity_RiskLevelId = 4 + ApiActivity_RISK_LEVEL_ID_OTHER ApiActivity_RiskLevelId = 99 +) + +// Enum value maps for ApiActivity_RiskLevelId. +var ( + ApiActivity_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + ApiActivity_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x ApiActivity_RiskLevelId) Enum() *ApiActivity_RiskLevelId { + p := new(ApiActivity_RiskLevelId) + *p = x + return p +} + +func (x ApiActivity_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[6].Descriptor() +} + +func (ApiActivity_RiskLevelId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[6] +} + +func (x ApiActivity_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_RiskLevelId.Descriptor instead. +func (ApiActivity_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 6} +} + +type ApiActivity_SeverityId int32 + +const ( + ApiActivity_SEVERITY_ID_UNKNOWN ApiActivity_SeverityId = 0 + ApiActivity_SEVERITY_ID_INFORMATIONAL ApiActivity_SeverityId = 1 + ApiActivity_SEVERITY_ID_LOW ApiActivity_SeverityId = 2 + ApiActivity_SEVERITY_ID_MEDIUM ApiActivity_SeverityId = 3 + ApiActivity_SEVERITY_ID_HIGH ApiActivity_SeverityId = 4 + ApiActivity_SEVERITY_ID_CRITICAL ApiActivity_SeverityId = 5 + ApiActivity_SEVERITY_ID_FATAL ApiActivity_SeverityId = 6 + ApiActivity_SEVERITY_ID_OTHER ApiActivity_SeverityId = 99 +) + +// Enum value maps for ApiActivity_SeverityId. +var ( + ApiActivity_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + ApiActivity_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x ApiActivity_SeverityId) Enum() *ApiActivity_SeverityId { + p := new(ApiActivity_SeverityId) + *p = x + return p +} + +func (x ApiActivity_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[7].Descriptor() +} + +func (ApiActivity_SeverityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[7] +} + +func (x ApiActivity_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_SeverityId.Descriptor instead. +func (ApiActivity_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 7} +} + +type ApiActivity_StatusId int32 + +const ( + ApiActivity_STATUS_ID_UNKNOWN ApiActivity_StatusId = 0 + ApiActivity_STATUS_ID_SUCCESS ApiActivity_StatusId = 1 + ApiActivity_STATUS_ID_FAILURE ApiActivity_StatusId = 2 + ApiActivity_STATUS_ID_OTHER ApiActivity_StatusId = 99 +) + +// Enum value maps for ApiActivity_StatusId. +var ( + ApiActivity_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_SUCCESS", + 2: "STATUS_ID_FAILURE", + 99: "STATUS_ID_OTHER", + } + ApiActivity_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_SUCCESS": 1, + "STATUS_ID_FAILURE": 2, + "STATUS_ID_OTHER": 99, + } +) + +func (x ApiActivity_StatusId) Enum() *ApiActivity_StatusId { + p := new(ApiActivity_StatusId) + *p = x + return p +} + +func (x ApiActivity_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[8].Descriptor() +} + +func (ApiActivity_StatusId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[8] +} + +func (x ApiActivity_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_StatusId.Descriptor instead. +func (ApiActivity_StatusId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 8} +} + +type ApiActivity_TypeUid int32 + +const ( + ApiActivity_TYPE_UID_UNKNOWN ApiActivity_TypeUid = 0 + ApiActivity_TYPE_UID_API_ACTIVITY_UNKNOWN ApiActivity_TypeUid = 600300 + ApiActivity_TYPE_UID_API_ACTIVITY_CREATE ApiActivity_TypeUid = 600301 + ApiActivity_TYPE_UID_API_ACTIVITY_READ ApiActivity_TypeUid = 600302 + ApiActivity_TYPE_UID_API_ACTIVITY_UPDATE ApiActivity_TypeUid = 600303 + ApiActivity_TYPE_UID_API_ACTIVITY_DELETE ApiActivity_TypeUid = 600304 + ApiActivity_TYPE_UID_API_ACTIVITY_OTHER ApiActivity_TypeUid = 600399 +) + +// Enum value maps for ApiActivity_TypeUid. +var ( + ApiActivity_TypeUid_name = map[int32]string{ + 0: "TYPE_UID_UNKNOWN", + 600300: "TYPE_UID_API_ACTIVITY_UNKNOWN", + 600301: "TYPE_UID_API_ACTIVITY_CREATE", + 600302: "TYPE_UID_API_ACTIVITY_READ", + 600303: "TYPE_UID_API_ACTIVITY_UPDATE", + 600304: "TYPE_UID_API_ACTIVITY_DELETE", + 600399: "TYPE_UID_API_ACTIVITY_OTHER", + } + ApiActivity_TypeUid_value = map[string]int32{ + "TYPE_UID_UNKNOWN": 0, + "TYPE_UID_API_ACTIVITY_UNKNOWN": 600300, + "TYPE_UID_API_ACTIVITY_CREATE": 600301, + "TYPE_UID_API_ACTIVITY_READ": 600302, + "TYPE_UID_API_ACTIVITY_UPDATE": 600303, + "TYPE_UID_API_ACTIVITY_DELETE": 600304, + "TYPE_UID_API_ACTIVITY_OTHER": 600399, + } +) + +func (x ApiActivity_TypeUid) Enum() *ApiActivity_TypeUid { + p := new(ApiActivity_TypeUid) + *p = x + return p +} + +func (x ApiActivity_TypeUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_TypeUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[9].Descriptor() +} + +func (ApiActivity_TypeUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[9] +} + +func (x ApiActivity_TypeUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_TypeUid.Descriptor instead. +func (ApiActivity_TypeUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0, 9} +} + +type EntityManagement_ActionId int32 + +const ( + EntityManagement_ACTION_ID_UNKNOWN EntityManagement_ActionId = 0 + EntityManagement_ACTION_ID_ALLOWED EntityManagement_ActionId = 1 + EntityManagement_ACTION_ID_DENIED EntityManagement_ActionId = 2 + EntityManagement_ACTION_ID_OBSERVED EntityManagement_ActionId = 3 + EntityManagement_ACTION_ID_MODIFIED EntityManagement_ActionId = 4 + EntityManagement_ACTION_ID_OTHER EntityManagement_ActionId = 99 +) + +// Enum value maps for EntityManagement_ActionId. +var ( + EntityManagement_ActionId_name = map[int32]string{ + 0: "ACTION_ID_UNKNOWN", + 1: "ACTION_ID_ALLOWED", + 2: "ACTION_ID_DENIED", + 3: "ACTION_ID_OBSERVED", + 4: "ACTION_ID_MODIFIED", + 99: "ACTION_ID_OTHER", + } + EntityManagement_ActionId_value = map[string]int32{ + "ACTION_ID_UNKNOWN": 0, + "ACTION_ID_ALLOWED": 1, + "ACTION_ID_DENIED": 2, + "ACTION_ID_OBSERVED": 3, + "ACTION_ID_MODIFIED": 4, + "ACTION_ID_OTHER": 99, + } +) + +func (x EntityManagement_ActionId) Enum() *EntityManagement_ActionId { + p := new(EntityManagement_ActionId) + *p = x + return p +} + +func (x EntityManagement_ActionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ActionId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[10].Descriptor() +} + +func (EntityManagement_ActionId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[10] +} + +func (x EntityManagement_ActionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ActionId.Descriptor instead. +func (EntityManagement_ActionId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 0} +} + +type EntityManagement_ActivityId int32 + +const ( + EntityManagement_ACTIVITY_ID_UNKNOWN EntityManagement_ActivityId = 0 + EntityManagement_ACTIVITY_ID_CREATE EntityManagement_ActivityId = 1 + EntityManagement_ACTIVITY_ID_READ EntityManagement_ActivityId = 2 + EntityManagement_ACTIVITY_ID_UPDATE EntityManagement_ActivityId = 3 + EntityManagement_ACTIVITY_ID_DELETE EntityManagement_ActivityId = 4 + EntityManagement_ACTIVITY_ID_MOVE EntityManagement_ActivityId = 5 + EntityManagement_ACTIVITY_ID_ENROLL EntityManagement_ActivityId = 6 + EntityManagement_ACTIVITY_ID_UNENROLL EntityManagement_ActivityId = 7 + EntityManagement_ACTIVITY_ID_ENABLE EntityManagement_ActivityId = 8 + EntityManagement_ACTIVITY_ID_DISABLE EntityManagement_ActivityId = 9 + EntityManagement_ACTIVITY_ID_ACTIVATE EntityManagement_ActivityId = 10 + EntityManagement_ACTIVITY_ID_DEACTIVATE EntityManagement_ActivityId = 11 + EntityManagement_ACTIVITY_ID_SUSPEND EntityManagement_ActivityId = 12 + EntityManagement_ACTIVITY_ID_RESUME EntityManagement_ActivityId = 13 + EntityManagement_ACTIVITY_ID_OTHER EntityManagement_ActivityId = 99 +) + +// Enum value maps for EntityManagement_ActivityId. +var ( + EntityManagement_ActivityId_name = map[int32]string{ + 0: "ACTIVITY_ID_UNKNOWN", + 1: "ACTIVITY_ID_CREATE", + 2: "ACTIVITY_ID_READ", + 3: "ACTIVITY_ID_UPDATE", + 4: "ACTIVITY_ID_DELETE", + 5: "ACTIVITY_ID_MOVE", + 6: "ACTIVITY_ID_ENROLL", + 7: "ACTIVITY_ID_UNENROLL", + 8: "ACTIVITY_ID_ENABLE", + 9: "ACTIVITY_ID_DISABLE", + 10: "ACTIVITY_ID_ACTIVATE", + 11: "ACTIVITY_ID_DEACTIVATE", + 12: "ACTIVITY_ID_SUSPEND", + 13: "ACTIVITY_ID_RESUME", + 99: "ACTIVITY_ID_OTHER", + } + EntityManagement_ActivityId_value = map[string]int32{ + "ACTIVITY_ID_UNKNOWN": 0, + "ACTIVITY_ID_CREATE": 1, + "ACTIVITY_ID_READ": 2, + "ACTIVITY_ID_UPDATE": 3, + "ACTIVITY_ID_DELETE": 4, + "ACTIVITY_ID_MOVE": 5, + "ACTIVITY_ID_ENROLL": 6, + "ACTIVITY_ID_UNENROLL": 7, + "ACTIVITY_ID_ENABLE": 8, + "ACTIVITY_ID_DISABLE": 9, + "ACTIVITY_ID_ACTIVATE": 10, + "ACTIVITY_ID_DEACTIVATE": 11, + "ACTIVITY_ID_SUSPEND": 12, + "ACTIVITY_ID_RESUME": 13, + "ACTIVITY_ID_OTHER": 99, + } +) + +func (x EntityManagement_ActivityId) Enum() *EntityManagement_ActivityId { + p := new(EntityManagement_ActivityId) + *p = x + return p +} + +func (x EntityManagement_ActivityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ActivityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[11].Descriptor() +} + +func (EntityManagement_ActivityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[11] +} + +func (x EntityManagement_ActivityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ActivityId.Descriptor instead. +func (EntityManagement_ActivityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 1} +} + +type EntityManagement_CategoryUid int32 + +const ( + EntityManagement_CATEGORY_UID_UNKNOWN EntityManagement_CategoryUid = 0 + EntityManagement_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT EntityManagement_CategoryUid = 3 +) + +// Enum value maps for EntityManagement_CategoryUid. +var ( + EntityManagement_CategoryUid_name = map[int32]string{ + 0: "CATEGORY_UID_UNKNOWN", + 3: "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT", + } + EntityManagement_CategoryUid_value = map[string]int32{ + "CATEGORY_UID_UNKNOWN": 0, + "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT": 3, + } +) + +func (x EntityManagement_CategoryUid) Enum() *EntityManagement_CategoryUid { + p := new(EntityManagement_CategoryUid) + *p = x + return p +} + +func (x EntityManagement_CategoryUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_CategoryUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[12].Descriptor() +} + +func (EntityManagement_CategoryUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[12] +} + +func (x EntityManagement_CategoryUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_CategoryUid.Descriptor instead. +func (EntityManagement_CategoryUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 2} +} + +type EntityManagement_ClassUid int32 + +const ( + EntityManagement_CLASS_UID_UNKNOWN EntityManagement_ClassUid = 0 + EntityManagement_CLASS_UID_ENTITY_MANAGEMENT EntityManagement_ClassUid = 3004 +) + +// Enum value maps for EntityManagement_ClassUid. +var ( + EntityManagement_ClassUid_name = map[int32]string{ + 0: "CLASS_UID_UNKNOWN", + 3004: "CLASS_UID_ENTITY_MANAGEMENT", + } + EntityManagement_ClassUid_value = map[string]int32{ + "CLASS_UID_UNKNOWN": 0, + "CLASS_UID_ENTITY_MANAGEMENT": 3004, + } +) + +func (x EntityManagement_ClassUid) Enum() *EntityManagement_ClassUid { + p := new(EntityManagement_ClassUid) + *p = x + return p +} + +func (x EntityManagement_ClassUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ClassUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[13].Descriptor() +} + +func (EntityManagement_ClassUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[13] +} + +func (x EntityManagement_ClassUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ClassUid.Descriptor instead. +func (EntityManagement_ClassUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 3} +} + +type EntityManagement_ConfidenceId int32 + +const ( + EntityManagement_CONFIDENCE_ID_UNKNOWN EntityManagement_ConfidenceId = 0 + EntityManagement_CONFIDENCE_ID_LOW EntityManagement_ConfidenceId = 1 + EntityManagement_CONFIDENCE_ID_MEDIUM EntityManagement_ConfidenceId = 2 + EntityManagement_CONFIDENCE_ID_HIGH EntityManagement_ConfidenceId = 3 + EntityManagement_CONFIDENCE_ID_OTHER EntityManagement_ConfidenceId = 99 +) + +// Enum value maps for EntityManagement_ConfidenceId. +var ( + EntityManagement_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + EntityManagement_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x EntityManagement_ConfidenceId) Enum() *EntityManagement_ConfidenceId { + p := new(EntityManagement_ConfidenceId) + *p = x + return p +} + +func (x EntityManagement_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[14].Descriptor() +} + +func (EntityManagement_ConfidenceId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[14] +} + +func (x EntityManagement_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ConfidenceId.Descriptor instead. +func (EntityManagement_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 4} +} + +type EntityManagement_DispositionId int32 + +const ( + EntityManagement_DISPOSITION_ID_UNKNOWN EntityManagement_DispositionId = 0 + EntityManagement_DISPOSITION_ID_ALLOWED EntityManagement_DispositionId = 1 + EntityManagement_DISPOSITION_ID_BLOCKED EntityManagement_DispositionId = 2 + EntityManagement_DISPOSITION_ID_QUARANTINED EntityManagement_DispositionId = 3 + EntityManagement_DISPOSITION_ID_ISOLATED EntityManagement_DispositionId = 4 + EntityManagement_DISPOSITION_ID_DELETED EntityManagement_DispositionId = 5 + EntityManagement_DISPOSITION_ID_DROPPED EntityManagement_DispositionId = 6 + EntityManagement_DISPOSITION_ID_CUSTOM_ACTION EntityManagement_DispositionId = 7 + EntityManagement_DISPOSITION_ID_APPROVED EntityManagement_DispositionId = 8 + EntityManagement_DISPOSITION_ID_RESTORED EntityManagement_DispositionId = 9 + EntityManagement_DISPOSITION_ID_EXONERATED EntityManagement_DispositionId = 10 + EntityManagement_DISPOSITION_ID_CORRECTED EntityManagement_DispositionId = 11 + EntityManagement_DISPOSITION_ID_PARTIALLY_CORRECTED EntityManagement_DispositionId = 12 + EntityManagement_DISPOSITION_ID_UNCORRECTED EntityManagement_DispositionId = 13 + EntityManagement_DISPOSITION_ID_DELAYED EntityManagement_DispositionId = 14 + EntityManagement_DISPOSITION_ID_DETECTED EntityManagement_DispositionId = 15 + EntityManagement_DISPOSITION_ID_NO_ACTION EntityManagement_DispositionId = 16 + EntityManagement_DISPOSITION_ID_LOGGED EntityManagement_DispositionId = 17 + EntityManagement_DISPOSITION_ID_TAGGED EntityManagement_DispositionId = 18 + EntityManagement_DISPOSITION_ID_ALERT EntityManagement_DispositionId = 19 + EntityManagement_DISPOSITION_ID_COUNT EntityManagement_DispositionId = 20 + EntityManagement_DISPOSITION_ID_RESET EntityManagement_DispositionId = 21 + EntityManagement_DISPOSITION_ID_CAPTCHA EntityManagement_DispositionId = 22 + EntityManagement_DISPOSITION_ID_CHALLENGE EntityManagement_DispositionId = 23 + EntityManagement_DISPOSITION_ID_ACCESS_REVOKED EntityManagement_DispositionId = 24 + EntityManagement_DISPOSITION_ID_REJECTED EntityManagement_DispositionId = 25 + EntityManagement_DISPOSITION_ID_UNAUTHORIZED EntityManagement_DispositionId = 26 + EntityManagement_DISPOSITION_ID_ERROR EntityManagement_DispositionId = 27 + EntityManagement_DISPOSITION_ID_OTHER EntityManagement_DispositionId = 99 +) + +// Enum value maps for EntityManagement_DispositionId. +var ( + EntityManagement_DispositionId_name = map[int32]string{ + 0: "DISPOSITION_ID_UNKNOWN", + 1: "DISPOSITION_ID_ALLOWED", + 2: "DISPOSITION_ID_BLOCKED", + 3: "DISPOSITION_ID_QUARANTINED", + 4: "DISPOSITION_ID_ISOLATED", + 5: "DISPOSITION_ID_DELETED", + 6: "DISPOSITION_ID_DROPPED", + 7: "DISPOSITION_ID_CUSTOM_ACTION", + 8: "DISPOSITION_ID_APPROVED", + 9: "DISPOSITION_ID_RESTORED", + 10: "DISPOSITION_ID_EXONERATED", + 11: "DISPOSITION_ID_CORRECTED", + 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", + 13: "DISPOSITION_ID_UNCORRECTED", + 14: "DISPOSITION_ID_DELAYED", + 15: "DISPOSITION_ID_DETECTED", + 16: "DISPOSITION_ID_NO_ACTION", + 17: "DISPOSITION_ID_LOGGED", + 18: "DISPOSITION_ID_TAGGED", + 19: "DISPOSITION_ID_ALERT", + 20: "DISPOSITION_ID_COUNT", + 21: "DISPOSITION_ID_RESET", + 22: "DISPOSITION_ID_CAPTCHA", + 23: "DISPOSITION_ID_CHALLENGE", + 24: "DISPOSITION_ID_ACCESS_REVOKED", + 25: "DISPOSITION_ID_REJECTED", + 26: "DISPOSITION_ID_UNAUTHORIZED", + 27: "DISPOSITION_ID_ERROR", + 99: "DISPOSITION_ID_OTHER", + } + EntityManagement_DispositionId_value = map[string]int32{ + "DISPOSITION_ID_UNKNOWN": 0, + "DISPOSITION_ID_ALLOWED": 1, + "DISPOSITION_ID_BLOCKED": 2, + "DISPOSITION_ID_QUARANTINED": 3, + "DISPOSITION_ID_ISOLATED": 4, + "DISPOSITION_ID_DELETED": 5, + "DISPOSITION_ID_DROPPED": 6, + "DISPOSITION_ID_CUSTOM_ACTION": 7, + "DISPOSITION_ID_APPROVED": 8, + "DISPOSITION_ID_RESTORED": 9, + "DISPOSITION_ID_EXONERATED": 10, + "DISPOSITION_ID_CORRECTED": 11, + "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, + "DISPOSITION_ID_UNCORRECTED": 13, + "DISPOSITION_ID_DELAYED": 14, + "DISPOSITION_ID_DETECTED": 15, + "DISPOSITION_ID_NO_ACTION": 16, + "DISPOSITION_ID_LOGGED": 17, + "DISPOSITION_ID_TAGGED": 18, + "DISPOSITION_ID_ALERT": 19, + "DISPOSITION_ID_COUNT": 20, + "DISPOSITION_ID_RESET": 21, + "DISPOSITION_ID_CAPTCHA": 22, + "DISPOSITION_ID_CHALLENGE": 23, + "DISPOSITION_ID_ACCESS_REVOKED": 24, + "DISPOSITION_ID_REJECTED": 25, + "DISPOSITION_ID_UNAUTHORIZED": 26, + "DISPOSITION_ID_ERROR": 27, + "DISPOSITION_ID_OTHER": 99, + } +) + +func (x EntityManagement_DispositionId) Enum() *EntityManagement_DispositionId { + p := new(EntityManagement_DispositionId) + *p = x + return p +} + +func (x EntityManagement_DispositionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_DispositionId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[15].Descriptor() +} + +func (EntityManagement_DispositionId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[15] +} + +func (x EntityManagement_DispositionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_DispositionId.Descriptor instead. +func (EntityManagement_DispositionId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 5} +} + +type EntityManagement_RiskLevelId int32 + +const ( + EntityManagement_RISK_LEVEL_ID_INFO EntityManagement_RiskLevelId = 0 + EntityManagement_RISK_LEVEL_ID_LOW EntityManagement_RiskLevelId = 1 + EntityManagement_RISK_LEVEL_ID_MEDIUM EntityManagement_RiskLevelId = 2 + EntityManagement_RISK_LEVEL_ID_HIGH EntityManagement_RiskLevelId = 3 + EntityManagement_RISK_LEVEL_ID_CRITICAL EntityManagement_RiskLevelId = 4 + EntityManagement_RISK_LEVEL_ID_OTHER EntityManagement_RiskLevelId = 99 +) + +// Enum value maps for EntityManagement_RiskLevelId. +var ( + EntityManagement_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + EntityManagement_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x EntityManagement_RiskLevelId) Enum() *EntityManagement_RiskLevelId { + p := new(EntityManagement_RiskLevelId) + *p = x + return p +} + +func (x EntityManagement_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[16].Descriptor() +} + +func (EntityManagement_RiskLevelId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[16] +} + +func (x EntityManagement_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_RiskLevelId.Descriptor instead. +func (EntityManagement_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 6} +} + +type EntityManagement_SeverityId int32 + +const ( + EntityManagement_SEVERITY_ID_UNKNOWN EntityManagement_SeverityId = 0 + EntityManagement_SEVERITY_ID_INFORMATIONAL EntityManagement_SeverityId = 1 + EntityManagement_SEVERITY_ID_LOW EntityManagement_SeverityId = 2 + EntityManagement_SEVERITY_ID_MEDIUM EntityManagement_SeverityId = 3 + EntityManagement_SEVERITY_ID_HIGH EntityManagement_SeverityId = 4 + EntityManagement_SEVERITY_ID_CRITICAL EntityManagement_SeverityId = 5 + EntityManagement_SEVERITY_ID_FATAL EntityManagement_SeverityId = 6 + EntityManagement_SEVERITY_ID_OTHER EntityManagement_SeverityId = 99 +) + +// Enum value maps for EntityManagement_SeverityId. +var ( + EntityManagement_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + EntityManagement_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x EntityManagement_SeverityId) Enum() *EntityManagement_SeverityId { + p := new(EntityManagement_SeverityId) + *p = x + return p +} + +func (x EntityManagement_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[17].Descriptor() +} + +func (EntityManagement_SeverityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[17] +} + +func (x EntityManagement_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_SeverityId.Descriptor instead. +func (EntityManagement_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 7} +} + +type EntityManagement_StatusId int32 + +const ( + EntityManagement_STATUS_ID_UNKNOWN EntityManagement_StatusId = 0 + EntityManagement_STATUS_ID_SUCCESS EntityManagement_StatusId = 1 + EntityManagement_STATUS_ID_FAILURE EntityManagement_StatusId = 2 + EntityManagement_STATUS_ID_OTHER EntityManagement_StatusId = 99 +) + +// Enum value maps for EntityManagement_StatusId. +var ( + EntityManagement_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_SUCCESS", + 2: "STATUS_ID_FAILURE", + 99: "STATUS_ID_OTHER", + } + EntityManagement_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_SUCCESS": 1, + "STATUS_ID_FAILURE": 2, + "STATUS_ID_OTHER": 99, + } +) + +func (x EntityManagement_StatusId) Enum() *EntityManagement_StatusId { + p := new(EntityManagement_StatusId) + *p = x + return p +} + +func (x EntityManagement_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[18].Descriptor() +} + +func (EntityManagement_StatusId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[18] +} + +func (x EntityManagement_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_StatusId.Descriptor instead. +func (EntityManagement_StatusId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 8} +} + +type EntityManagement_TypeUid int32 + +const ( + EntityManagement_TYPE_UID_UNKNOWN EntityManagement_TypeUid = 0 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN EntityManagement_TypeUid = 300400 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_CREATE EntityManagement_TypeUid = 300401 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_READ EntityManagement_TypeUid = 300402 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UPDATE EntityManagement_TypeUid = 300403 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DELETE EntityManagement_TypeUid = 300404 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_MOVE EntityManagement_TypeUid = 300405 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENROLL EntityManagement_TypeUid = 300406 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNENROLL EntityManagement_TypeUid = 300407 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENABLE EntityManagement_TypeUid = 300408 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DISABLE EntityManagement_TypeUid = 300409 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE EntityManagement_TypeUid = 300410 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE EntityManagement_TypeUid = 300411 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_SUSPEND EntityManagement_TypeUid = 300412 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_RESUME EntityManagement_TypeUid = 300413 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_OTHER EntityManagement_TypeUid = 300499 +) + +// Enum value maps for EntityManagement_TypeUid. +var ( + EntityManagement_TypeUid_name = map[int32]string{ + 0: "TYPE_UID_UNKNOWN", + 300400: "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN", + 300401: "TYPE_UID_ENTITY_MANAGEMENT_CREATE", + 300402: "TYPE_UID_ENTITY_MANAGEMENT_READ", + 300403: "TYPE_UID_ENTITY_MANAGEMENT_UPDATE", + 300404: "TYPE_UID_ENTITY_MANAGEMENT_DELETE", + 300405: "TYPE_UID_ENTITY_MANAGEMENT_MOVE", + 300406: "TYPE_UID_ENTITY_MANAGEMENT_ENROLL", + 300407: "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL", + 300408: "TYPE_UID_ENTITY_MANAGEMENT_ENABLE", + 300409: "TYPE_UID_ENTITY_MANAGEMENT_DISABLE", + 300410: "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE", + 300411: "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE", + 300412: "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND", + 300413: "TYPE_UID_ENTITY_MANAGEMENT_RESUME", + 300499: "TYPE_UID_ENTITY_MANAGEMENT_OTHER", + } + EntityManagement_TypeUid_value = map[string]int32{ + "TYPE_UID_UNKNOWN": 0, + "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN": 300400, + "TYPE_UID_ENTITY_MANAGEMENT_CREATE": 300401, + "TYPE_UID_ENTITY_MANAGEMENT_READ": 300402, + "TYPE_UID_ENTITY_MANAGEMENT_UPDATE": 300403, + "TYPE_UID_ENTITY_MANAGEMENT_DELETE": 300404, + "TYPE_UID_ENTITY_MANAGEMENT_MOVE": 300405, + "TYPE_UID_ENTITY_MANAGEMENT_ENROLL": 300406, + "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL": 300407, + "TYPE_UID_ENTITY_MANAGEMENT_ENABLE": 300408, + "TYPE_UID_ENTITY_MANAGEMENT_DISABLE": 300409, + "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE": 300410, + "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE": 300411, + "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND": 300412, + "TYPE_UID_ENTITY_MANAGEMENT_RESUME": 300413, + "TYPE_UID_ENTITY_MANAGEMENT_OTHER": 300499, + } +) + +func (x EntityManagement_TypeUid) Enum() *EntityManagement_TypeUid { + p := new(EntityManagement_TypeUid) + *p = x + return p +} + +func (x EntityManagement_TypeUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_TypeUid) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[19].Descriptor() +} + +func (EntityManagement_TypeUid) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[19] +} + +func (x EntityManagement_TypeUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_TypeUid.Descriptor instead. +func (EntityManagement_TypeUid) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1, 9} +} + +type Account_TypeId int32 + +const ( + Account_TYPE_ID_UNKNOWN Account_TypeId = 0 + Account_TYPE_ID_LDAP_ACCOUNT Account_TypeId = 1 + Account_TYPE_ID_WINDOWS_ACCOUNT Account_TypeId = 2 + Account_TYPE_ID_AWS_IAM_USER Account_TypeId = 3 + Account_TYPE_ID_AWS_IAM_ROLE Account_TypeId = 4 + Account_TYPE_ID_GCP_ACCOUNT Account_TypeId = 5 + Account_TYPE_ID_AZURE_AD_ACCOUNT Account_TypeId = 6 + Account_TYPE_ID_MAC_OS_ACCOUNT Account_TypeId = 7 + Account_TYPE_ID_APPLE_ACCOUNT Account_TypeId = 8 + Account_TYPE_ID_LINUX_ACCOUNT Account_TypeId = 9 + Account_TYPE_ID_AWS_ACCOUNT Account_TypeId = 10 + Account_TYPE_ID_GCP_PROJECT Account_TypeId = 11 + Account_TYPE_ID_OCI_COMPARTMENT Account_TypeId = 12 + Account_TYPE_ID_AZURE_SUBSCRIPTION Account_TypeId = 13 + Account_TYPE_ID_SALESFORCE_ACCOUNT Account_TypeId = 14 + Account_TYPE_ID_GOOGLE_WORKSPACE Account_TypeId = 15 + Account_TYPE_ID_SERVICENOW_INSTANCE Account_TypeId = 16 + Account_TYPE_ID_M365_TENANT Account_TypeId = 17 + Account_TYPE_ID_EMAIL_ACCOUNT Account_TypeId = 18 + Account_TYPE_ID_ACTIVEDIRECTORY_ACCOUNT Account_TypeId = 19 + Account_TYPE_ID_OTHER Account_TypeId = 99 +) + +// Enum value maps for Account_TypeId. +var ( + Account_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_LDAP_ACCOUNT", + 2: "TYPE_ID_WINDOWS_ACCOUNT", + 3: "TYPE_ID_AWS_IAM_USER", + 4: "TYPE_ID_AWS_IAM_ROLE", + 5: "TYPE_ID_GCP_ACCOUNT", + 6: "TYPE_ID_AZURE_AD_ACCOUNT", + 7: "TYPE_ID_MAC_OS_ACCOUNT", + 8: "TYPE_ID_APPLE_ACCOUNT", + 9: "TYPE_ID_LINUX_ACCOUNT", + 10: "TYPE_ID_AWS_ACCOUNT", + 11: "TYPE_ID_GCP_PROJECT", + 12: "TYPE_ID_OCI_COMPARTMENT", + 13: "TYPE_ID_AZURE_SUBSCRIPTION", + 14: "TYPE_ID_SALESFORCE_ACCOUNT", + 15: "TYPE_ID_GOOGLE_WORKSPACE", + 16: "TYPE_ID_SERVICENOW_INSTANCE", + 17: "TYPE_ID_M365_TENANT", + 18: "TYPE_ID_EMAIL_ACCOUNT", + 19: "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT", + 99: "TYPE_ID_OTHER", + } + Account_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_LDAP_ACCOUNT": 1, + "TYPE_ID_WINDOWS_ACCOUNT": 2, + "TYPE_ID_AWS_IAM_USER": 3, + "TYPE_ID_AWS_IAM_ROLE": 4, + "TYPE_ID_GCP_ACCOUNT": 5, + "TYPE_ID_AZURE_AD_ACCOUNT": 6, + "TYPE_ID_MAC_OS_ACCOUNT": 7, + "TYPE_ID_APPLE_ACCOUNT": 8, + "TYPE_ID_LINUX_ACCOUNT": 9, + "TYPE_ID_AWS_ACCOUNT": 10, + "TYPE_ID_GCP_PROJECT": 11, + "TYPE_ID_OCI_COMPARTMENT": 12, + "TYPE_ID_AZURE_SUBSCRIPTION": 13, + "TYPE_ID_SALESFORCE_ACCOUNT": 14, + "TYPE_ID_GOOGLE_WORKSPACE": 15, + "TYPE_ID_SERVICENOW_INSTANCE": 16, + "TYPE_ID_M365_TENANT": 17, + "TYPE_ID_EMAIL_ACCOUNT": 18, + "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT": 19, + "TYPE_ID_OTHER": 99, + } +) + +func (x Account_TypeId) Enum() *Account_TypeId { + p := new(Account_TypeId) + *p = x + return p +} + +func (x Account_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Account_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[20].Descriptor() +} + +func (Account_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[20] +} + +func (x Account_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Account_TypeId.Descriptor instead. +func (Account_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{2, 0} +} + +type Advisory_InstallStateId int32 + +const ( + Advisory_INSTALL_STATE_ID_UNKNOWN Advisory_InstallStateId = 0 + Advisory_INSTALL_STATE_ID_INSTALLED Advisory_InstallStateId = 1 + Advisory_INSTALL_STATE_ID_NOT_INSTALLED Advisory_InstallStateId = 2 + Advisory_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT Advisory_InstallStateId = 3 + Advisory_INSTALL_STATE_ID_OTHER Advisory_InstallStateId = 99 +) + +// Enum value maps for Advisory_InstallStateId. +var ( + Advisory_InstallStateId_name = map[int32]string{ + 0: "INSTALL_STATE_ID_UNKNOWN", + 1: "INSTALL_STATE_ID_INSTALLED", + 2: "INSTALL_STATE_ID_NOT_INSTALLED", + 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", + 99: "INSTALL_STATE_ID_OTHER", + } + Advisory_InstallStateId_value = map[string]int32{ + "INSTALL_STATE_ID_UNKNOWN": 0, + "INSTALL_STATE_ID_INSTALLED": 1, + "INSTALL_STATE_ID_NOT_INSTALLED": 2, + "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, + "INSTALL_STATE_ID_OTHER": 99, + } +) + +func (x Advisory_InstallStateId) Enum() *Advisory_InstallStateId { + p := new(Advisory_InstallStateId) + *p = x + return p +} + +func (x Advisory_InstallStateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Advisory_InstallStateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[21].Descriptor() +} + +func (Advisory_InstallStateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[21] +} + +func (x Advisory_InstallStateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Advisory_InstallStateId.Descriptor instead. +func (Advisory_InstallStateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{4, 0} +} + +type AffectedPackage_TypeId int32 + +const ( + AffectedPackage_TYPE_ID_UNKNOWN AffectedPackage_TypeId = 0 + AffectedPackage_TYPE_ID_APPLICATION AffectedPackage_TypeId = 1 + AffectedPackage_TYPE_ID_OPERATING_SYSTEM AffectedPackage_TypeId = 2 + AffectedPackage_TYPE_ID_OTHER AffectedPackage_TypeId = 99 +) + +// Enum value maps for AffectedPackage_TypeId. +var ( + AffectedPackage_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_APPLICATION", + 2: "TYPE_ID_OPERATING_SYSTEM", + 99: "TYPE_ID_OTHER", + } + AffectedPackage_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_APPLICATION": 1, + "TYPE_ID_OPERATING_SYSTEM": 2, + "TYPE_ID_OTHER": 99, + } +) + +func (x AffectedPackage_TypeId) Enum() *AffectedPackage_TypeId { + p := new(AffectedPackage_TypeId) + *p = x + return p +} + +func (x AffectedPackage_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AffectedPackage_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[22].Descriptor() +} + +func (AffectedPackage_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[22] +} + +func (x AffectedPackage_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AffectedPackage_TypeId.Descriptor instead. +func (AffectedPackage_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{6, 0} +} + +type Agent_TypeId int32 + +const ( + Agent_TYPE_ID_UNKNOWN Agent_TypeId = 0 + Agent_TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE Agent_TypeId = 1 + Agent_TYPE_ID_DATA_LOSS_PREVENTION Agent_TypeId = 2 + Agent_TYPE_ID_BACKUP_RECOVERY Agent_TypeId = 3 + Agent_TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY Agent_TypeId = 4 + Agent_TYPE_ID_VULNERABILITY_MANAGEMENT Agent_TypeId = 5 + Agent_TYPE_ID_LOG_FORWARDING Agent_TypeId = 6 + Agent_TYPE_ID_MOBILE_DEVICE_MANAGEMENT Agent_TypeId = 7 + Agent_TYPE_ID_CONFIGURATION_MANAGEMENT Agent_TypeId = 8 + Agent_TYPE_ID_REMOTE_ACCESS Agent_TypeId = 9 + Agent_TYPE_ID_OTHER Agent_TypeId = 99 +) + +// Enum value maps for Agent_TypeId. +var ( + Agent_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE", + 2: "TYPE_ID_DATA_LOSS_PREVENTION", + 3: "TYPE_ID_BACKUP_RECOVERY", + 4: "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY", + 5: "TYPE_ID_VULNERABILITY_MANAGEMENT", + 6: "TYPE_ID_LOG_FORWARDING", + 7: "TYPE_ID_MOBILE_DEVICE_MANAGEMENT", + 8: "TYPE_ID_CONFIGURATION_MANAGEMENT", + 9: "TYPE_ID_REMOTE_ACCESS", + 99: "TYPE_ID_OTHER", + } + Agent_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE": 1, + "TYPE_ID_DATA_LOSS_PREVENTION": 2, + "TYPE_ID_BACKUP_RECOVERY": 3, + "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY": 4, + "TYPE_ID_VULNERABILITY_MANAGEMENT": 5, + "TYPE_ID_LOG_FORWARDING": 6, + "TYPE_ID_MOBILE_DEVICE_MANAGEMENT": 7, + "TYPE_ID_CONFIGURATION_MANAGEMENT": 8, + "TYPE_ID_REMOTE_ACCESS": 9, + "TYPE_ID_OTHER": 99, + } +) + +func (x Agent_TypeId) Enum() *Agent_TypeId { + p := new(Agent_TypeId) + *p = x + return p +} + +func (x Agent_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Agent_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[23].Descriptor() +} + +func (Agent_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[23] +} + +func (x Agent_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Agent_TypeId.Descriptor instead. +func (Agent_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{7, 0} +} + +type Analytic_StateId int32 + +const ( + Analytic_STATE_ID_UNKNOWN Analytic_StateId = 0 + Analytic_STATE_ID_ACTIVE Analytic_StateId = 1 + Analytic_STATE_ID_SUPPRESSED Analytic_StateId = 2 + Analytic_STATE_ID_EXPERIMENTAL Analytic_StateId = 3 + Analytic_STATE_ID_OTHER Analytic_StateId = 99 +) + +// Enum value maps for Analytic_StateId. +var ( + Analytic_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_ACTIVE", + 2: "STATE_ID_SUPPRESSED", + 3: "STATE_ID_EXPERIMENTAL", + 99: "STATE_ID_OTHER", + } + Analytic_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_ACTIVE": 1, + "STATE_ID_SUPPRESSED": 2, + "STATE_ID_EXPERIMENTAL": 3, + "STATE_ID_OTHER": 99, + } +) + +func (x Analytic_StateId) Enum() *Analytic_StateId { + p := new(Analytic_StateId) + *p = x + return p +} + +func (x Analytic_StateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Analytic_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[24].Descriptor() +} + +func (Analytic_StateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[24] +} + +func (x Analytic_StateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Analytic_StateId.Descriptor instead. +func (Analytic_StateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{9, 0} +} + +type Analytic_TypeId int32 + +const ( + Analytic_TYPE_ID_UNKNOWN Analytic_TypeId = 0 + Analytic_TYPE_ID_RULE Analytic_TypeId = 1 + Analytic_TYPE_ID_BEHAVIORAL Analytic_TypeId = 2 + Analytic_TYPE_ID_STATISTICAL Analytic_TypeId = 3 + Analytic_TYPE_ID_LEARNING_ML_DL Analytic_TypeId = 4 + Analytic_TYPE_ID_FINGERPRINTING Analytic_TypeId = 5 + Analytic_TYPE_ID_TAGGING Analytic_TypeId = 6 + Analytic_TYPE_ID_KEYWORD_MATCH Analytic_TypeId = 7 + Analytic_TYPE_ID_REGULAR_EXPRESSIONS Analytic_TypeId = 8 + Analytic_TYPE_ID_EXACT_DATA_MATCH Analytic_TypeId = 9 + Analytic_TYPE_ID_PARTIAL_DATA_MATCH Analytic_TypeId = 10 + Analytic_TYPE_ID_INDEXED_DATA_MATCH Analytic_TypeId = 11 + Analytic_TYPE_ID_OTHER Analytic_TypeId = 99 +) + +// Enum value maps for Analytic_TypeId. +var ( + Analytic_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_RULE", + 2: "TYPE_ID_BEHAVIORAL", + 3: "TYPE_ID_STATISTICAL", + 4: "TYPE_ID_LEARNING_ML_DL", + 5: "TYPE_ID_FINGERPRINTING", + 6: "TYPE_ID_TAGGING", + 7: "TYPE_ID_KEYWORD_MATCH", + 8: "TYPE_ID_REGULAR_EXPRESSIONS", + 9: "TYPE_ID_EXACT_DATA_MATCH", + 10: "TYPE_ID_PARTIAL_DATA_MATCH", + 11: "TYPE_ID_INDEXED_DATA_MATCH", + 99: "TYPE_ID_OTHER", + } + Analytic_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_RULE": 1, + "TYPE_ID_BEHAVIORAL": 2, + "TYPE_ID_STATISTICAL": 3, + "TYPE_ID_LEARNING_ML_DL": 4, + "TYPE_ID_FINGERPRINTING": 5, + "TYPE_ID_TAGGING": 6, + "TYPE_ID_KEYWORD_MATCH": 7, + "TYPE_ID_REGULAR_EXPRESSIONS": 8, + "TYPE_ID_EXACT_DATA_MATCH": 9, + "TYPE_ID_PARTIAL_DATA_MATCH": 10, + "TYPE_ID_INDEXED_DATA_MATCH": 11, + "TYPE_ID_OTHER": 99, + } +) + +func (x Analytic_TypeId) Enum() *Analytic_TypeId { + p := new(Analytic_TypeId) + *p = x + return p +} + +func (x Analytic_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Analytic_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[25].Descriptor() +} + +func (Analytic_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[25] +} + +func (x Analytic_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Analytic_TypeId.Descriptor instead. +func (Analytic_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{9, 1} +} + +type Application_RiskLevelId int32 + +const ( + Application_RISK_LEVEL_ID_INFO Application_RiskLevelId = 0 + Application_RISK_LEVEL_ID_LOW Application_RiskLevelId = 1 + Application_RISK_LEVEL_ID_MEDIUM Application_RiskLevelId = 2 + Application_RISK_LEVEL_ID_HIGH Application_RiskLevelId = 3 + Application_RISK_LEVEL_ID_CRITICAL Application_RiskLevelId = 4 + Application_RISK_LEVEL_ID_OTHER Application_RiskLevelId = 99 +) + +// Enum value maps for Application_RiskLevelId. +var ( + Application_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + Application_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x Application_RiskLevelId) Enum() *Application_RiskLevelId { + p := new(Application_RiskLevelId) + *p = x + return p +} + +func (x Application_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Application_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[26].Descriptor() +} + +func (Application_RiskLevelId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[26] +} + +func (x Application_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Application_RiskLevelId.Descriptor instead. +func (Application_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{11, 0} +} + +type AuthFactor_FactorTypeId int32 + +const ( + AuthFactor_FACTOR_TYPE_ID_UNKNOWN AuthFactor_FactorTypeId = 0 + AuthFactor_FACTOR_TYPE_ID_SMS AuthFactor_FactorTypeId = 1 + AuthFactor_FACTOR_TYPE_ID_SECURITY_QUESTION AuthFactor_FactorTypeId = 2 + AuthFactor_FACTOR_TYPE_ID_PHONE_CALL AuthFactor_FactorTypeId = 3 + AuthFactor_FACTOR_TYPE_ID_BIOMETRIC AuthFactor_FactorTypeId = 4 + AuthFactor_FACTOR_TYPE_ID_PUSH_NOTIFICATION AuthFactor_FactorTypeId = 5 + AuthFactor_FACTOR_TYPE_ID_HARDWARE_TOKEN AuthFactor_FactorTypeId = 6 + AuthFactor_FACTOR_TYPE_ID_OTP AuthFactor_FactorTypeId = 7 + AuthFactor_FACTOR_TYPE_ID_EMAIL AuthFactor_FactorTypeId = 8 + AuthFactor_FACTOR_TYPE_ID_U2F AuthFactor_FactorTypeId = 9 + AuthFactor_FACTOR_TYPE_ID_WEBAUTHN AuthFactor_FactorTypeId = 10 + AuthFactor_FACTOR_TYPE_ID_PASSWORD AuthFactor_FactorTypeId = 11 + AuthFactor_FACTOR_TYPE_ID_OTHER AuthFactor_FactorTypeId = 99 +) + +// Enum value maps for AuthFactor_FactorTypeId. +var ( + AuthFactor_FactorTypeId_name = map[int32]string{ + 0: "FACTOR_TYPE_ID_UNKNOWN", + 1: "FACTOR_TYPE_ID_SMS", + 2: "FACTOR_TYPE_ID_SECURITY_QUESTION", + 3: "FACTOR_TYPE_ID_PHONE_CALL", + 4: "FACTOR_TYPE_ID_BIOMETRIC", + 5: "FACTOR_TYPE_ID_PUSH_NOTIFICATION", + 6: "FACTOR_TYPE_ID_HARDWARE_TOKEN", + 7: "FACTOR_TYPE_ID_OTP", + 8: "FACTOR_TYPE_ID_EMAIL", + 9: "FACTOR_TYPE_ID_U2F", + 10: "FACTOR_TYPE_ID_WEBAUTHN", + 11: "FACTOR_TYPE_ID_PASSWORD", + 99: "FACTOR_TYPE_ID_OTHER", + } + AuthFactor_FactorTypeId_value = map[string]int32{ + "FACTOR_TYPE_ID_UNKNOWN": 0, + "FACTOR_TYPE_ID_SMS": 1, + "FACTOR_TYPE_ID_SECURITY_QUESTION": 2, + "FACTOR_TYPE_ID_PHONE_CALL": 3, + "FACTOR_TYPE_ID_BIOMETRIC": 4, + "FACTOR_TYPE_ID_PUSH_NOTIFICATION": 5, + "FACTOR_TYPE_ID_HARDWARE_TOKEN": 6, + "FACTOR_TYPE_ID_OTP": 7, + "FACTOR_TYPE_ID_EMAIL": 8, + "FACTOR_TYPE_ID_U2F": 9, + "FACTOR_TYPE_ID_WEBAUTHN": 10, + "FACTOR_TYPE_ID_PASSWORD": 11, + "FACTOR_TYPE_ID_OTHER": 99, + } +) + +func (x AuthFactor_FactorTypeId) Enum() *AuthFactor_FactorTypeId { + p := new(AuthFactor_FactorTypeId) + *p = x + return p +} + +func (x AuthFactor_FactorTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuthFactor_FactorTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[27].Descriptor() +} + +func (AuthFactor_FactorTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[27] +} + +func (x AuthFactor_FactorTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuthFactor_FactorTypeId.Descriptor instead. +func (AuthFactor_FactorTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{13, 0} +} + +type DataClassification_CategoryId int32 + +const ( + DataClassification_CATEGORY_ID_UNKNOWN DataClassification_CategoryId = 0 + DataClassification_CATEGORY_ID_PERSONAL DataClassification_CategoryId = 1 + DataClassification_CATEGORY_ID_GOVERNMENTAL DataClassification_CategoryId = 2 + DataClassification_CATEGORY_ID_FINANCIAL DataClassification_CategoryId = 3 + DataClassification_CATEGORY_ID_BUSINESS DataClassification_CategoryId = 4 + DataClassification_CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT DataClassification_CategoryId = 5 + DataClassification_CATEGORY_ID_SECURITY DataClassification_CategoryId = 6 + DataClassification_CATEGORY_ID_OTHER DataClassification_CategoryId = 99 +) + +// Enum value maps for DataClassification_CategoryId. +var ( + DataClassification_CategoryId_name = map[int32]string{ + 0: "CATEGORY_ID_UNKNOWN", + 1: "CATEGORY_ID_PERSONAL", + 2: "CATEGORY_ID_GOVERNMENTAL", + 3: "CATEGORY_ID_FINANCIAL", + 4: "CATEGORY_ID_BUSINESS", + 5: "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT", + 6: "CATEGORY_ID_SECURITY", + 99: "CATEGORY_ID_OTHER", + } + DataClassification_CategoryId_value = map[string]int32{ + "CATEGORY_ID_UNKNOWN": 0, + "CATEGORY_ID_PERSONAL": 1, + "CATEGORY_ID_GOVERNMENTAL": 2, + "CATEGORY_ID_FINANCIAL": 3, + "CATEGORY_ID_BUSINESS": 4, + "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT": 5, + "CATEGORY_ID_SECURITY": 6, + "CATEGORY_ID_OTHER": 99, + } +) + +func (x DataClassification_CategoryId) Enum() *DataClassification_CategoryId { + p := new(DataClassification_CategoryId) + *p = x + return p +} + +func (x DataClassification_CategoryId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DataClassification_CategoryId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[28].Descriptor() +} + +func (DataClassification_CategoryId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[28] +} + +func (x DataClassification_CategoryId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DataClassification_CategoryId.Descriptor instead. +func (DataClassification_CategoryId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{28, 0} +} + +type DataClassification_ConfidentialityId int32 + +const ( + DataClassification_CONFIDENTIALITY_ID_UNKNOWN DataClassification_ConfidentialityId = 0 + DataClassification_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL DataClassification_ConfidentialityId = 1 + DataClassification_CONFIDENTIALITY_ID_CONFIDENTIAL DataClassification_ConfidentialityId = 2 + DataClassification_CONFIDENTIALITY_ID_SECRET DataClassification_ConfidentialityId = 3 + DataClassification_CONFIDENTIALITY_ID_TOP_SECRET DataClassification_ConfidentialityId = 4 + DataClassification_CONFIDENTIALITY_ID_PRIVATE DataClassification_ConfidentialityId = 5 + DataClassification_CONFIDENTIALITY_ID_RESTRICTED DataClassification_ConfidentialityId = 6 + DataClassification_CONFIDENTIALITY_ID_OTHER DataClassification_ConfidentialityId = 99 +) + +// Enum value maps for DataClassification_ConfidentialityId. +var ( + DataClassification_ConfidentialityId_name = map[int32]string{ + 0: "CONFIDENTIALITY_ID_UNKNOWN", + 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", + 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", + 3: "CONFIDENTIALITY_ID_SECRET", + 4: "CONFIDENTIALITY_ID_TOP_SECRET", + 5: "CONFIDENTIALITY_ID_PRIVATE", + 6: "CONFIDENTIALITY_ID_RESTRICTED", + 99: "CONFIDENTIALITY_ID_OTHER", + } + DataClassification_ConfidentialityId_value = map[string]int32{ + "CONFIDENTIALITY_ID_UNKNOWN": 0, + "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, + "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, + "CONFIDENTIALITY_ID_SECRET": 3, + "CONFIDENTIALITY_ID_TOP_SECRET": 4, + "CONFIDENTIALITY_ID_PRIVATE": 5, + "CONFIDENTIALITY_ID_RESTRICTED": 6, + "CONFIDENTIALITY_ID_OTHER": 99, + } +) + +func (x DataClassification_ConfidentialityId) Enum() *DataClassification_ConfidentialityId { + p := new(DataClassification_ConfidentialityId) + *p = x + return p +} + +func (x DataClassification_ConfidentialityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DataClassification_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[29].Descriptor() +} + +func (DataClassification_ConfidentialityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[29] +} + +func (x DataClassification_ConfidentialityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DataClassification_ConfidentialityId.Descriptor instead. +func (DataClassification_ConfidentialityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{28, 1} +} + +type DataClassification_StatusId int32 + +const ( + DataClassification_STATUS_ID_UNKNOWN DataClassification_StatusId = 0 + DataClassification_STATUS_ID_COMPLETE DataClassification_StatusId = 1 + DataClassification_STATUS_ID_PARTIAL DataClassification_StatusId = 2 + DataClassification_STATUS_ID_FAIL DataClassification_StatusId = 3 + DataClassification_STATUS_ID_OTHER DataClassification_StatusId = 99 +) + +// Enum value maps for DataClassification_StatusId. +var ( + DataClassification_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_COMPLETE", + 2: "STATUS_ID_PARTIAL", + 3: "STATUS_ID_FAIL", + 99: "STATUS_ID_OTHER", + } + DataClassification_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_COMPLETE": 1, + "STATUS_ID_PARTIAL": 2, + "STATUS_ID_FAIL": 3, + "STATUS_ID_OTHER": 99, + } +) + +func (x DataClassification_StatusId) Enum() *DataClassification_StatusId { + p := new(DataClassification_StatusId) + *p = x + return p +} + +func (x DataClassification_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DataClassification_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[30].Descriptor() +} + +func (DataClassification_StatusId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[30] +} + +func (x DataClassification_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DataClassification_StatusId.Descriptor instead. +func (DataClassification_StatusId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{28, 2} +} + +type Device_RiskLevelId int32 + +const ( + Device_RISK_LEVEL_ID_INFO Device_RiskLevelId = 0 + Device_RISK_LEVEL_ID_LOW Device_RiskLevelId = 1 + Device_RISK_LEVEL_ID_MEDIUM Device_RiskLevelId = 2 + Device_RISK_LEVEL_ID_HIGH Device_RiskLevelId = 3 + Device_RISK_LEVEL_ID_CRITICAL Device_RiskLevelId = 4 + Device_RISK_LEVEL_ID_OTHER Device_RiskLevelId = 99 +) + +// Enum value maps for Device_RiskLevelId. +var ( + Device_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + Device_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x Device_RiskLevelId) Enum() *Device_RiskLevelId { + p := new(Device_RiskLevelId) + *p = x + return p +} + +func (x Device_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Device_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[31].Descriptor() +} + +func (Device_RiskLevelId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[31] +} + +func (x Device_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Device_RiskLevelId.Descriptor instead. +func (Device_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{29, 0} +} + +type Device_TypeId int32 + +const ( + Device_TYPE_ID_UNKNOWN Device_TypeId = 0 + Device_TYPE_ID_SERVER Device_TypeId = 1 + Device_TYPE_ID_DESKTOP Device_TypeId = 2 + Device_TYPE_ID_LAPTOP Device_TypeId = 3 + Device_TYPE_ID_TABLET Device_TypeId = 4 + Device_TYPE_ID_MOBILE Device_TypeId = 5 + Device_TYPE_ID_VIRTUAL Device_TypeId = 6 + Device_TYPE_ID_IOT Device_TypeId = 7 + Device_TYPE_ID_BROWSER Device_TypeId = 8 + Device_TYPE_ID_FIREWALL Device_TypeId = 9 + Device_TYPE_ID_SWITCH Device_TypeId = 10 + Device_TYPE_ID_HUB Device_TypeId = 11 + Device_TYPE_ID_ROUTER Device_TypeId = 12 + Device_TYPE_ID_IDS Device_TypeId = 13 + Device_TYPE_ID_IPS Device_TypeId = 14 + Device_TYPE_ID_LOAD_BALANCER Device_TypeId = 15 + Device_TYPE_ID_OTHER Device_TypeId = 99 +) + +// Enum value maps for Device_TypeId. +var ( + Device_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", + } + Device_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, + } +) + +func (x Device_TypeId) Enum() *Device_TypeId { + p := new(Device_TypeId) + *p = x + return p +} + +func (x Device_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Device_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[32].Descriptor() +} + +func (Device_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[32] +} + +func (x Device_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Device_TypeId.Descriptor instead. +func (Device_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{29, 1} +} + +type DeviceHwInfo_CpuArchitectureId int32 + +const ( + DeviceHwInfo_CPU_ARCHITECTURE_ID_UNKNOWN DeviceHwInfo_CpuArchitectureId = 0 + DeviceHwInfo_CPU_ARCHITECTURE_ID_X86 DeviceHwInfo_CpuArchitectureId = 1 + DeviceHwInfo_CPU_ARCHITECTURE_ID_ARM DeviceHwInfo_CpuArchitectureId = 2 + DeviceHwInfo_CPU_ARCHITECTURE_ID_RISC_V DeviceHwInfo_CpuArchitectureId = 3 + DeviceHwInfo_CPU_ARCHITECTURE_ID_OTHER DeviceHwInfo_CpuArchitectureId = 99 +) + +// Enum value maps for DeviceHwInfo_CpuArchitectureId. +var ( + DeviceHwInfo_CpuArchitectureId_name = map[int32]string{ + 0: "CPU_ARCHITECTURE_ID_UNKNOWN", + 1: "CPU_ARCHITECTURE_ID_X86", + 2: "CPU_ARCHITECTURE_ID_ARM", + 3: "CPU_ARCHITECTURE_ID_RISC_V", + 99: "CPU_ARCHITECTURE_ID_OTHER", + } + DeviceHwInfo_CpuArchitectureId_value = map[string]int32{ + "CPU_ARCHITECTURE_ID_UNKNOWN": 0, + "CPU_ARCHITECTURE_ID_X86": 1, + "CPU_ARCHITECTURE_ID_ARM": 2, + "CPU_ARCHITECTURE_ID_RISC_V": 3, + "CPU_ARCHITECTURE_ID_OTHER": 99, + } +) + +func (x DeviceHwInfo_CpuArchitectureId) Enum() *DeviceHwInfo_CpuArchitectureId { + p := new(DeviceHwInfo_CpuArchitectureId) + *p = x + return p +} + +func (x DeviceHwInfo_CpuArchitectureId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DeviceHwInfo_CpuArchitectureId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[33].Descriptor() +} + +func (DeviceHwInfo_CpuArchitectureId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[33] +} + +func (x DeviceHwInfo_CpuArchitectureId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DeviceHwInfo_CpuArchitectureId.Descriptor instead. +func (DeviceHwInfo_CpuArchitectureId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{30, 0} +} + +type DigitalSignature_AlgorithmId int32 + +const ( + DigitalSignature_ALGORITHM_ID_UNKNOWN DigitalSignature_AlgorithmId = 0 + DigitalSignature_ALGORITHM_ID_DSA DigitalSignature_AlgorithmId = 1 + DigitalSignature_ALGORITHM_ID_RSA DigitalSignature_AlgorithmId = 2 + DigitalSignature_ALGORITHM_ID_ECDSA DigitalSignature_AlgorithmId = 3 + DigitalSignature_ALGORITHM_ID_AUTHENTICODE DigitalSignature_AlgorithmId = 4 + DigitalSignature_ALGORITHM_ID_OTHER DigitalSignature_AlgorithmId = 99 +) + +// Enum value maps for DigitalSignature_AlgorithmId. +var ( + DigitalSignature_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_DSA", + 2: "ALGORITHM_ID_RSA", + 3: "ALGORITHM_ID_ECDSA", + 4: "ALGORITHM_ID_AUTHENTICODE", + 99: "ALGORITHM_ID_OTHER", + } + DigitalSignature_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_DSA": 1, + "ALGORITHM_ID_RSA": 2, + "ALGORITHM_ID_ECDSA": 3, + "ALGORITHM_ID_AUTHENTICODE": 4, + "ALGORITHM_ID_OTHER": 99, + } +) + +func (x DigitalSignature_AlgorithmId) Enum() *DigitalSignature_AlgorithmId { + p := new(DigitalSignature_AlgorithmId) + *p = x + return p +} + +func (x DigitalSignature_AlgorithmId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DigitalSignature_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[34].Descriptor() +} + +func (DigitalSignature_AlgorithmId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[34] +} + +func (x DigitalSignature_AlgorithmId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DigitalSignature_AlgorithmId.Descriptor instead. +func (DigitalSignature_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{31, 0} +} + +type DigitalSignature_StateId int32 + +const ( + DigitalSignature_STATE_ID_UNKNOWN DigitalSignature_StateId = 0 + DigitalSignature_STATE_ID_VALID DigitalSignature_StateId = 1 + DigitalSignature_STATE_ID_EXPIRED DigitalSignature_StateId = 2 + DigitalSignature_STATE_ID_REVOKED DigitalSignature_StateId = 3 + DigitalSignature_STATE_ID_SUSPENDED DigitalSignature_StateId = 4 + DigitalSignature_STATE_ID_PENDING DigitalSignature_StateId = 5 + DigitalSignature_STATE_ID_UNTRUSTED DigitalSignature_StateId = 6 + DigitalSignature_STATE_ID_DISTRUSTED DigitalSignature_StateId = 7 + DigitalSignature_STATE_ID_WRONGUSAGE DigitalSignature_StateId = 8 + DigitalSignature_STATE_ID_BAD DigitalSignature_StateId = 9 + DigitalSignature_STATE_ID_BROKEN DigitalSignature_StateId = 10 + DigitalSignature_STATE_ID_OTHER DigitalSignature_StateId = 99 +) + +// Enum value maps for DigitalSignature_StateId. +var ( + DigitalSignature_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_VALID", + 2: "STATE_ID_EXPIRED", + 3: "STATE_ID_REVOKED", + 4: "STATE_ID_SUSPENDED", + 5: "STATE_ID_PENDING", + 6: "STATE_ID_UNTRUSTED", + 7: "STATE_ID_DISTRUSTED", + 8: "STATE_ID_WRONGUSAGE", + 9: "STATE_ID_BAD", + 10: "STATE_ID_BROKEN", + 99: "STATE_ID_OTHER", + } + DigitalSignature_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_VALID": 1, + "STATE_ID_EXPIRED": 2, + "STATE_ID_REVOKED": 3, + "STATE_ID_SUSPENDED": 4, + "STATE_ID_PENDING": 5, + "STATE_ID_UNTRUSTED": 6, + "STATE_ID_DISTRUSTED": 7, + "STATE_ID_WRONGUSAGE": 8, + "STATE_ID_BAD": 9, + "STATE_ID_BROKEN": 10, + "STATE_ID_OTHER": 99, + } +) + +func (x DigitalSignature_StateId) Enum() *DigitalSignature_StateId { + p := new(DigitalSignature_StateId) + *p = x + return p +} + +func (x DigitalSignature_StateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DigitalSignature_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[35].Descriptor() +} + +func (DigitalSignature_StateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[35] +} + +func (x DigitalSignature_StateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DigitalSignature_StateId.Descriptor instead. +func (DigitalSignature_StateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{31, 1} +} + +type DnsAnswer_FlagIds int32 + +const ( + DnsAnswer_FLAG_IDS_UNKNOWN DnsAnswer_FlagIds = 0 + DnsAnswer_FLAG_IDS_AUTHORITATIVE_ANSWER DnsAnswer_FlagIds = 1 + DnsAnswer_FLAG_IDS_TRUNCATED_RESPONSE DnsAnswer_FlagIds = 2 + DnsAnswer_FLAG_IDS_RECURSION_DESIRED DnsAnswer_FlagIds = 3 + DnsAnswer_FLAG_IDS_RECURSION_AVAILABLE DnsAnswer_FlagIds = 4 + DnsAnswer_FLAG_IDS_AUTHENTIC_DATA DnsAnswer_FlagIds = 5 + DnsAnswer_FLAG_IDS_CHECKING_DISABLED DnsAnswer_FlagIds = 6 + DnsAnswer_FLAG_IDS_OTHER DnsAnswer_FlagIds = 99 +) + +// Enum value maps for DnsAnswer_FlagIds. +var ( + DnsAnswer_FlagIds_name = map[int32]string{ + 0: "FLAG_IDS_UNKNOWN", + 1: "FLAG_IDS_AUTHORITATIVE_ANSWER", + 2: "FLAG_IDS_TRUNCATED_RESPONSE", + 3: "FLAG_IDS_RECURSION_DESIRED", + 4: "FLAG_IDS_RECURSION_AVAILABLE", + 5: "FLAG_IDS_AUTHENTIC_DATA", + 6: "FLAG_IDS_CHECKING_DISABLED", + 99: "FLAG_IDS_OTHER", + } + DnsAnswer_FlagIds_value = map[string]int32{ + "FLAG_IDS_UNKNOWN": 0, + "FLAG_IDS_AUTHORITATIVE_ANSWER": 1, + "FLAG_IDS_TRUNCATED_RESPONSE": 2, + "FLAG_IDS_RECURSION_DESIRED": 3, + "FLAG_IDS_RECURSION_AVAILABLE": 4, + "FLAG_IDS_AUTHENTIC_DATA": 5, + "FLAG_IDS_CHECKING_DISABLED": 6, + "FLAG_IDS_OTHER": 99, + } +) + +func (x DnsAnswer_FlagIds) Enum() *DnsAnswer_FlagIds { + p := new(DnsAnswer_FlagIds) + *p = x + return p +} + +func (x DnsAnswer_FlagIds) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DnsAnswer_FlagIds) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[36].Descriptor() +} + +func (DnsAnswer_FlagIds) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[36] +} + +func (x DnsAnswer_FlagIds) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DnsAnswer_FlagIds.Descriptor instead. +func (DnsAnswer_FlagIds) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{34, 0} +} + +type DomainContact_TypeId int32 + +const ( + DomainContact_TYPE_ID_UNKNOWN DomainContact_TypeId = 0 + DomainContact_TYPE_ID_REGISTRANT DomainContact_TypeId = 1 + DomainContact_TYPE_ID_ADMINISTRATIVE DomainContact_TypeId = 2 + DomainContact_TYPE_ID_TECHNICAL DomainContact_TypeId = 3 + DomainContact_TYPE_ID_BILLING DomainContact_TypeId = 4 + DomainContact_TYPE_ID_ABUSE DomainContact_TypeId = 5 + DomainContact_TYPE_ID_OTHER DomainContact_TypeId = 99 +) + +// Enum value maps for DomainContact_TypeId. +var ( + DomainContact_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_REGISTRANT", + 2: "TYPE_ID_ADMINISTRATIVE", + 3: "TYPE_ID_TECHNICAL", + 4: "TYPE_ID_BILLING", + 5: "TYPE_ID_ABUSE", + 99: "TYPE_ID_OTHER", + } + DomainContact_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_REGISTRANT": 1, + "TYPE_ID_ADMINISTRATIVE": 2, + "TYPE_ID_TECHNICAL": 3, + "TYPE_ID_BILLING": 4, + "TYPE_ID_ABUSE": 5, + "TYPE_ID_OTHER": 99, + } +) + +func (x DomainContact_TypeId) Enum() *DomainContact_TypeId { + p := new(DomainContact_TypeId) + *p = x + return p +} + +func (x DomainContact_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (DomainContact_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[37].Descriptor() +} + +func (DomainContact_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[37] +} + +func (x DomainContact_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use DomainContact_TypeId.Descriptor instead. +func (DomainContact_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{35, 0} +} + +type EncryptionDetails_AlgorithmId int32 + +const ( + EncryptionDetails_ALGORITHM_ID_UNKNOWN EncryptionDetails_AlgorithmId = 0 + EncryptionDetails_ALGORITHM_ID_DES EncryptionDetails_AlgorithmId = 1 + EncryptionDetails_ALGORITHM_ID_TRIPLEDES EncryptionDetails_AlgorithmId = 2 + EncryptionDetails_ALGORITHM_ID_AES EncryptionDetails_AlgorithmId = 3 + EncryptionDetails_ALGORITHM_ID_RSA EncryptionDetails_AlgorithmId = 4 + EncryptionDetails_ALGORITHM_ID_ECC EncryptionDetails_AlgorithmId = 5 + EncryptionDetails_ALGORITHM_ID_SM2 EncryptionDetails_AlgorithmId = 6 + EncryptionDetails_ALGORITHM_ID_OTHER EncryptionDetails_AlgorithmId = 99 +) + +// Enum value maps for EncryptionDetails_AlgorithmId. +var ( + EncryptionDetails_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_DES", + 2: "ALGORITHM_ID_TRIPLEDES", + 3: "ALGORITHM_ID_AES", + 4: "ALGORITHM_ID_RSA", + 5: "ALGORITHM_ID_ECC", + 6: "ALGORITHM_ID_SM2", + 99: "ALGORITHM_ID_OTHER", + } + EncryptionDetails_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_DES": 1, + "ALGORITHM_ID_TRIPLEDES": 2, + "ALGORITHM_ID_AES": 3, + "ALGORITHM_ID_RSA": 4, + "ALGORITHM_ID_ECC": 5, + "ALGORITHM_ID_SM2": 6, + "ALGORITHM_ID_OTHER": 99, + } +) + +func (x EncryptionDetails_AlgorithmId) Enum() *EncryptionDetails_AlgorithmId { + p := new(EncryptionDetails_AlgorithmId) + *p = x + return p +} + +func (x EncryptionDetails_AlgorithmId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EncryptionDetails_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[38].Descriptor() +} + +func (EncryptionDetails_AlgorithmId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[38] +} + +func (x EncryptionDetails_AlgorithmId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EncryptionDetails_AlgorithmId.Descriptor instead. +func (EncryptionDetails_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{39, 0} +} + +type File_ConfidentialityId int32 + +const ( + File_CONFIDENTIALITY_ID_UNKNOWN File_ConfidentialityId = 0 + File_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL File_ConfidentialityId = 1 + File_CONFIDENTIALITY_ID_CONFIDENTIAL File_ConfidentialityId = 2 + File_CONFIDENTIALITY_ID_SECRET File_ConfidentialityId = 3 + File_CONFIDENTIALITY_ID_TOP_SECRET File_ConfidentialityId = 4 + File_CONFIDENTIALITY_ID_PRIVATE File_ConfidentialityId = 5 + File_CONFIDENTIALITY_ID_RESTRICTED File_ConfidentialityId = 6 + File_CONFIDENTIALITY_ID_OTHER File_ConfidentialityId = 99 +) + +// Enum value maps for File_ConfidentialityId. +var ( + File_ConfidentialityId_name = map[int32]string{ + 0: "CONFIDENTIALITY_ID_UNKNOWN", + 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", + 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", + 3: "CONFIDENTIALITY_ID_SECRET", + 4: "CONFIDENTIALITY_ID_TOP_SECRET", + 5: "CONFIDENTIALITY_ID_PRIVATE", + 6: "CONFIDENTIALITY_ID_RESTRICTED", + 99: "CONFIDENTIALITY_ID_OTHER", + } + File_ConfidentialityId_value = map[string]int32{ + "CONFIDENTIALITY_ID_UNKNOWN": 0, + "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, + "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, + "CONFIDENTIALITY_ID_SECRET": 3, + "CONFIDENTIALITY_ID_TOP_SECRET": 4, + "CONFIDENTIALITY_ID_PRIVATE": 5, + "CONFIDENTIALITY_ID_RESTRICTED": 6, + "CONFIDENTIALITY_ID_OTHER": 99, + } +) + +func (x File_ConfidentialityId) Enum() *File_ConfidentialityId { + p := new(File_ConfidentialityId) + *p = x + return p +} + +func (x File_ConfidentialityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (File_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[39].Descriptor() +} + +func (File_ConfidentialityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[39] +} + +func (x File_ConfidentialityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use File_ConfidentialityId.Descriptor instead. +func (File_ConfidentialityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{45, 0} +} + +type File_DriveTypeId int32 + +const ( + File_DRIVE_TYPE_ID_UNKNOWN File_DriveTypeId = 0 + File_DRIVE_TYPE_ID_REMOVABLE File_DriveTypeId = 1 + File_DRIVE_TYPE_ID_FIXED File_DriveTypeId = 2 + File_DRIVE_TYPE_ID_REMOTE File_DriveTypeId = 3 + File_DRIVE_TYPE_ID_CD_ROM File_DriveTypeId = 4 + File_DRIVE_TYPE_ID_RAM_DISK File_DriveTypeId = 5 + File_DRIVE_TYPE_ID_OTHER File_DriveTypeId = 99 +) + +// Enum value maps for File_DriveTypeId. +var ( + File_DriveTypeId_name = map[int32]string{ + 0: "DRIVE_TYPE_ID_UNKNOWN", + 1: "DRIVE_TYPE_ID_REMOVABLE", + 2: "DRIVE_TYPE_ID_FIXED", + 3: "DRIVE_TYPE_ID_REMOTE", + 4: "DRIVE_TYPE_ID_CD_ROM", + 5: "DRIVE_TYPE_ID_RAM_DISK", + 99: "DRIVE_TYPE_ID_OTHER", + } + File_DriveTypeId_value = map[string]int32{ + "DRIVE_TYPE_ID_UNKNOWN": 0, + "DRIVE_TYPE_ID_REMOVABLE": 1, + "DRIVE_TYPE_ID_FIXED": 2, + "DRIVE_TYPE_ID_REMOTE": 3, + "DRIVE_TYPE_ID_CD_ROM": 4, + "DRIVE_TYPE_ID_RAM_DISK": 5, + "DRIVE_TYPE_ID_OTHER": 99, + } +) + +func (x File_DriveTypeId) Enum() *File_DriveTypeId { + p := new(File_DriveTypeId) + *p = x + return p +} + +func (x File_DriveTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (File_DriveTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[40].Descriptor() +} + +func (File_DriveTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[40] +} + +func (x File_DriveTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use File_DriveTypeId.Descriptor instead. +func (File_DriveTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{45, 1} +} + +type File_TypeId int32 + +const ( + File_TYPE_ID_UNKNOWN File_TypeId = 0 + File_TYPE_ID_REGULAR_FILE File_TypeId = 1 + File_TYPE_ID_FOLDER File_TypeId = 2 + File_TYPE_ID_CHARACTER_DEVICE File_TypeId = 3 + File_TYPE_ID_BLOCK_DEVICE File_TypeId = 4 + File_TYPE_ID_LOCAL_SOCKET File_TypeId = 5 + File_TYPE_ID_NAMED_PIPE File_TypeId = 6 + File_TYPE_ID_SYMBOLIC_LINK File_TypeId = 7 + File_TYPE_ID_EXECUTABLE_FILE File_TypeId = 8 + File_TYPE_ID_OTHER File_TypeId = 99 +) + +// Enum value maps for File_TypeId. +var ( + File_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_REGULAR_FILE", + 2: "TYPE_ID_FOLDER", + 3: "TYPE_ID_CHARACTER_DEVICE", + 4: "TYPE_ID_BLOCK_DEVICE", + 5: "TYPE_ID_LOCAL_SOCKET", + 6: "TYPE_ID_NAMED_PIPE", + 7: "TYPE_ID_SYMBOLIC_LINK", + 8: "TYPE_ID_EXECUTABLE_FILE", + 99: "TYPE_ID_OTHER", + } + File_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_REGULAR_FILE": 1, + "TYPE_ID_FOLDER": 2, + "TYPE_ID_CHARACTER_DEVICE": 3, + "TYPE_ID_BLOCK_DEVICE": 4, + "TYPE_ID_LOCAL_SOCKET": 5, + "TYPE_ID_NAMED_PIPE": 6, + "TYPE_ID_SYMBOLIC_LINK": 7, + "TYPE_ID_EXECUTABLE_FILE": 8, + "TYPE_ID_OTHER": 99, + } +) + +func (x File_TypeId) Enum() *File_TypeId { + p := new(File_TypeId) + *p = x + return p +} + +func (x File_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (File_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[41].Descriptor() +} + +func (File_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[41] +} + +func (x File_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use File_TypeId.Descriptor instead. +func (File_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{45, 2} +} + +type Fingerprint_AlgorithmId int32 + +const ( + Fingerprint_ALGORITHM_ID_UNKNOWN Fingerprint_AlgorithmId = 0 + Fingerprint_ALGORITHM_ID_MD5 Fingerprint_AlgorithmId = 1 + Fingerprint_ALGORITHM_ID_SHA_1 Fingerprint_AlgorithmId = 2 + Fingerprint_ALGORITHM_ID_SHA_256 Fingerprint_AlgorithmId = 3 + Fingerprint_ALGORITHM_ID_SHA_512 Fingerprint_AlgorithmId = 4 + Fingerprint_ALGORITHM_ID_CTPH Fingerprint_AlgorithmId = 5 + Fingerprint_ALGORITHM_ID_TLSH Fingerprint_AlgorithmId = 6 + Fingerprint_ALGORITHM_ID_QUICKXORHASH Fingerprint_AlgorithmId = 7 + Fingerprint_ALGORITHM_ID_SHA_224 Fingerprint_AlgorithmId = 8 + Fingerprint_ALGORITHM_ID_SHA_384 Fingerprint_AlgorithmId = 9 + Fingerprint_ALGORITHM_ID_SHA_512_224 Fingerprint_AlgorithmId = 10 + Fingerprint_ALGORITHM_ID_SHA_512_256 Fingerprint_AlgorithmId = 11 + Fingerprint_ALGORITHM_ID_SHA3_224 Fingerprint_AlgorithmId = 12 + Fingerprint_ALGORITHM_ID_SHA3_256 Fingerprint_AlgorithmId = 13 + Fingerprint_ALGORITHM_ID_SHA3_384 Fingerprint_AlgorithmId = 14 + Fingerprint_ALGORITHM_ID_SHA3_512 Fingerprint_AlgorithmId = 15 + Fingerprint_ALGORITHM_ID_XXHASH_H3_64_BIT Fingerprint_AlgorithmId = 16 + Fingerprint_ALGORITHM_ID_XXHASH_H3_128_BIT Fingerprint_AlgorithmId = 17 + Fingerprint_ALGORITHM_ID_IMPHASH Fingerprint_AlgorithmId = 18 + Fingerprint_ALGORITHM_ID_NPF Fingerprint_AlgorithmId = 19 + Fingerprint_ALGORITHM_ID_HASSH Fingerprint_AlgorithmId = 20 + Fingerprint_ALGORITHM_ID_OTHER Fingerprint_AlgorithmId = 99 +) + +// Enum value maps for Fingerprint_AlgorithmId. +var ( + Fingerprint_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_MD5", + 2: "ALGORITHM_ID_SHA_1", + 3: "ALGORITHM_ID_SHA_256", + 4: "ALGORITHM_ID_SHA_512", + 5: "ALGORITHM_ID_CTPH", + 6: "ALGORITHM_ID_TLSH", + 7: "ALGORITHM_ID_QUICKXORHASH", + 8: "ALGORITHM_ID_SHA_224", + 9: "ALGORITHM_ID_SHA_384", + 10: "ALGORITHM_ID_SHA_512_224", + 11: "ALGORITHM_ID_SHA_512_256", + 12: "ALGORITHM_ID_SHA3_224", + 13: "ALGORITHM_ID_SHA3_256", + 14: "ALGORITHM_ID_SHA3_384", + 15: "ALGORITHM_ID_SHA3_512", + 16: "ALGORITHM_ID_XXHASH_H3_64_BIT", + 17: "ALGORITHM_ID_XXHASH_H3_128_BIT", + 18: "ALGORITHM_ID_IMPHASH", + 19: "ALGORITHM_ID_NPF", + 20: "ALGORITHM_ID_HASSH", + 99: "ALGORITHM_ID_OTHER", + } + Fingerprint_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_MD5": 1, + "ALGORITHM_ID_SHA_1": 2, + "ALGORITHM_ID_SHA_256": 3, + "ALGORITHM_ID_SHA_512": 4, + "ALGORITHM_ID_CTPH": 5, + "ALGORITHM_ID_TLSH": 6, + "ALGORITHM_ID_QUICKXORHASH": 7, + "ALGORITHM_ID_SHA_224": 8, + "ALGORITHM_ID_SHA_384": 9, + "ALGORITHM_ID_SHA_512_224": 10, + "ALGORITHM_ID_SHA_512_256": 11, + "ALGORITHM_ID_SHA3_224": 12, + "ALGORITHM_ID_SHA3_256": 13, + "ALGORITHM_ID_SHA3_384": 14, + "ALGORITHM_ID_SHA3_512": 15, + "ALGORITHM_ID_XXHASH_H3_64_BIT": 16, + "ALGORITHM_ID_XXHASH_H3_128_BIT": 17, + "ALGORITHM_ID_IMPHASH": 18, + "ALGORITHM_ID_NPF": 19, + "ALGORITHM_ID_HASSH": 20, + "ALGORITHM_ID_OTHER": 99, + } +) + +func (x Fingerprint_AlgorithmId) Enum() *Fingerprint_AlgorithmId { + p := new(Fingerprint_AlgorithmId) + *p = x + return p +} + +func (x Fingerprint_AlgorithmId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Fingerprint_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[42].Descriptor() +} + +func (Fingerprint_AlgorithmId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[42] +} + +func (x Fingerprint_AlgorithmId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Fingerprint_AlgorithmId.Descriptor instead. +func (Fingerprint_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{46, 0} +} + +type GpuInfo_BusTypeId int32 + +const ( + GpuInfo_BUS_TYPE_ID_UNKNOWN GpuInfo_BusTypeId = 0 + GpuInfo_BUS_TYPE_ID_ONBOARD GpuInfo_BusTypeId = 1 + GpuInfo_BUS_TYPE_ID_PCIE_X16 GpuInfo_BusTypeId = 2 + GpuInfo_BUS_TYPE_ID_PCIE_X8 GpuInfo_BusTypeId = 3 + GpuInfo_BUS_TYPE_ID_MXM_TYPE_A GpuInfo_BusTypeId = 4 + GpuInfo_BUS_TYPE_ID_MXM_TYPE_B GpuInfo_BusTypeId = 5 + GpuInfo_BUS_TYPE_ID_M_2 GpuInfo_BusTypeId = 6 + GpuInfo_BUS_TYPE_ID_CXL GpuInfo_BusTypeId = 7 + GpuInfo_BUS_TYPE_ID_OTHER GpuInfo_BusTypeId = 99 +) + +// Enum value maps for GpuInfo_BusTypeId. +var ( + GpuInfo_BusTypeId_name = map[int32]string{ + 0: "BUS_TYPE_ID_UNKNOWN", + 1: "BUS_TYPE_ID_ONBOARD", + 2: "BUS_TYPE_ID_PCIE_X16", + 3: "BUS_TYPE_ID_PCIE_X8", + 4: "BUS_TYPE_ID_MXM_TYPE_A", + 5: "BUS_TYPE_ID_MXM_TYPE_B", + 6: "BUS_TYPE_ID_M_2", + 7: "BUS_TYPE_ID_CXL", + 99: "BUS_TYPE_ID_OTHER", + } + GpuInfo_BusTypeId_value = map[string]int32{ + "BUS_TYPE_ID_UNKNOWN": 0, + "BUS_TYPE_ID_ONBOARD": 1, + "BUS_TYPE_ID_PCIE_X16": 2, + "BUS_TYPE_ID_PCIE_X8": 3, + "BUS_TYPE_ID_MXM_TYPE_A": 4, + "BUS_TYPE_ID_MXM_TYPE_B": 5, + "BUS_TYPE_ID_M_2": 6, + "BUS_TYPE_ID_CXL": 7, + "BUS_TYPE_ID_OTHER": 99, + } +) + +func (x GpuInfo_BusTypeId) Enum() *GpuInfo_BusTypeId { + p := new(GpuInfo_BusTypeId) + *p = x + return p +} + +func (x GpuInfo_BusTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (GpuInfo_BusTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[43].Descriptor() +} + +func (GpuInfo_BusTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[43] +} + +func (x GpuInfo_BusTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use GpuInfo_BusTypeId.Descriptor instead. +func (GpuInfo_BusTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{48, 0} +} + +type GpuInfo_VramModeId int32 + +const ( + GpuInfo_VRAM_MODE_ID_UNKNOWN GpuInfo_VramModeId = 0 + GpuInfo_VRAM_MODE_ID_SHARED GpuInfo_VramModeId = 1 + GpuInfo_VRAM_MODE_ID_DEDICATED GpuInfo_VramModeId = 2 + GpuInfo_VRAM_MODE_ID_OTHER GpuInfo_VramModeId = 99 +) + +// Enum value maps for GpuInfo_VramModeId. +var ( + GpuInfo_VramModeId_name = map[int32]string{ + 0: "VRAM_MODE_ID_UNKNOWN", + 1: "VRAM_MODE_ID_SHARED", + 2: "VRAM_MODE_ID_DEDICATED", + 99: "VRAM_MODE_ID_OTHER", + } + GpuInfo_VramModeId_value = map[string]int32{ + "VRAM_MODE_ID_UNKNOWN": 0, + "VRAM_MODE_ID_SHARED": 1, + "VRAM_MODE_ID_DEDICATED": 2, + "VRAM_MODE_ID_OTHER": 99, + } +) + +func (x GpuInfo_VramModeId) Enum() *GpuInfo_VramModeId { + p := new(GpuInfo_VramModeId) + *p = x + return p +} + +func (x GpuInfo_VramModeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (GpuInfo_VramModeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[44].Descriptor() +} + +func (GpuInfo_VramModeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[44] +} + +func (x GpuInfo_VramModeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use GpuInfo_VramModeId.Descriptor instead. +func (GpuInfo_VramModeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{48, 1} +} + +type Graph_QueryLanguageId int32 + +const ( + Graph_QUERY_LANGUAGE_ID_UNKNOWN Graph_QueryLanguageId = 0 + Graph_QUERY_LANGUAGE_ID_CYPHER Graph_QueryLanguageId = 1 + Graph_QUERY_LANGUAGE_ID_GRAPHQL Graph_QueryLanguageId = 2 + Graph_QUERY_LANGUAGE_ID_GREMLIN Graph_QueryLanguageId = 3 + Graph_QUERY_LANGUAGE_ID_GQL Graph_QueryLanguageId = 4 + Graph_QUERY_LANGUAGE_ID_G_CORE Graph_QueryLanguageId = 5 + Graph_QUERY_LANGUAGE_ID_PGQL Graph_QueryLanguageId = 6 + Graph_QUERY_LANGUAGE_ID_SPARQL Graph_QueryLanguageId = 7 + Graph_QUERY_LANGUAGE_ID_OTHER Graph_QueryLanguageId = 99 +) + +// Enum value maps for Graph_QueryLanguageId. +var ( + Graph_QueryLanguageId_name = map[int32]string{ + 0: "QUERY_LANGUAGE_ID_UNKNOWN", + 1: "QUERY_LANGUAGE_ID_CYPHER", + 2: "QUERY_LANGUAGE_ID_GRAPHQL", + 3: "QUERY_LANGUAGE_ID_GREMLIN", + 4: "QUERY_LANGUAGE_ID_GQL", + 5: "QUERY_LANGUAGE_ID_G_CORE", + 6: "QUERY_LANGUAGE_ID_PGQL", + 7: "QUERY_LANGUAGE_ID_SPARQL", + 99: "QUERY_LANGUAGE_ID_OTHER", + } + Graph_QueryLanguageId_value = map[string]int32{ + "QUERY_LANGUAGE_ID_UNKNOWN": 0, + "QUERY_LANGUAGE_ID_CYPHER": 1, + "QUERY_LANGUAGE_ID_GRAPHQL": 2, + "QUERY_LANGUAGE_ID_GREMLIN": 3, + "QUERY_LANGUAGE_ID_GQL": 4, + "QUERY_LANGUAGE_ID_G_CORE": 5, + "QUERY_LANGUAGE_ID_PGQL": 6, + "QUERY_LANGUAGE_ID_SPARQL": 7, + "QUERY_LANGUAGE_ID_OTHER": 99, + } +) + +func (x Graph_QueryLanguageId) Enum() *Graph_QueryLanguageId { + p := new(Graph_QueryLanguageId) + *p = x + return p +} + +func (x Graph_QueryLanguageId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Graph_QueryLanguageId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[45].Descriptor() +} + +func (Graph_QueryLanguageId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[45] +} + +func (x Graph_QueryLanguageId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Graph_QueryLanguageId.Descriptor instead. +func (Graph_QueryLanguageId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{49, 0} +} + +type Idp_StateId int32 + +const ( + Idp_STATE_ID_UNKNOWN Idp_StateId = 0 + Idp_STATE_ID_ACTIVE Idp_StateId = 1 + Idp_STATE_ID_SUSPENDED Idp_StateId = 2 + Idp_STATE_ID_DEPRECATED Idp_StateId = 3 + Idp_STATE_ID_DELETED Idp_StateId = 4 + Idp_STATE_ID_OTHER Idp_StateId = 99 +) + +// Enum value maps for Idp_StateId. +var ( + Idp_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_ACTIVE", + 2: "STATE_ID_SUSPENDED", + 3: "STATE_ID_DEPRECATED", + 4: "STATE_ID_DELETED", + 99: "STATE_ID_OTHER", + } + Idp_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_ACTIVE": 1, + "STATE_ID_SUSPENDED": 2, + "STATE_ID_DEPRECATED": 3, + "STATE_ID_DELETED": 4, + "STATE_ID_OTHER": 99, + } +) + +func (x Idp_StateId) Enum() *Idp_StateId { + p := new(Idp_StateId) + *p = x + return p +} + +func (x Idp_StateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Idp_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[46].Descriptor() +} + +func (Idp_StateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[46] +} + +func (x Idp_StateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Idp_StateId.Descriptor instead. +func (Idp_StateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{54, 0} +} + +type KbArticle_InstallStateId int32 + +const ( + KbArticle_INSTALL_STATE_ID_UNKNOWN KbArticle_InstallStateId = 0 + KbArticle_INSTALL_STATE_ID_INSTALLED KbArticle_InstallStateId = 1 + KbArticle_INSTALL_STATE_ID_NOT_INSTALLED KbArticle_InstallStateId = 2 + KbArticle_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT KbArticle_InstallStateId = 3 + KbArticle_INSTALL_STATE_ID_OTHER KbArticle_InstallStateId = 99 +) + +// Enum value maps for KbArticle_InstallStateId. +var ( + KbArticle_InstallStateId_name = map[int32]string{ + 0: "INSTALL_STATE_ID_UNKNOWN", + 1: "INSTALL_STATE_ID_INSTALLED", + 2: "INSTALL_STATE_ID_NOT_INSTALLED", + 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", + 99: "INSTALL_STATE_ID_OTHER", + } + KbArticle_InstallStateId_value = map[string]int32{ + "INSTALL_STATE_ID_UNKNOWN": 0, + "INSTALL_STATE_ID_INSTALLED": 1, + "INSTALL_STATE_ID_NOT_INSTALLED": 2, + "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, + "INSTALL_STATE_ID_OTHER": 99, + } +) + +func (x KbArticle_InstallStateId) Enum() *KbArticle_InstallStateId { + p := new(KbArticle_InstallStateId) + *p = x + return p +} + +func (x KbArticle_InstallStateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (KbArticle_InstallStateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[47].Descriptor() +} + +func (KbArticle_InstallStateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[47] +} + +func (x KbArticle_InstallStateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use KbArticle_InstallStateId.Descriptor instead. +func (KbArticle_InstallStateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{56, 0} +} + +type KillChainPhase_PhaseId int32 + +const ( + KillChainPhase_PHASE_ID_UNKNOWN KillChainPhase_PhaseId = 0 + KillChainPhase_PHASE_ID_RECONNAISSANCE KillChainPhase_PhaseId = 1 + KillChainPhase_PHASE_ID_WEAPONIZATION KillChainPhase_PhaseId = 2 + KillChainPhase_PHASE_ID_DELIVERY KillChainPhase_PhaseId = 3 + KillChainPhase_PHASE_ID_EXPLOITATION KillChainPhase_PhaseId = 4 + KillChainPhase_PHASE_ID_INSTALLATION KillChainPhase_PhaseId = 5 + KillChainPhase_PHASE_ID_COMMAND_CONTROL KillChainPhase_PhaseId = 6 + KillChainPhase_PHASE_ID_ACTIONS_ON_OBJECTIVES KillChainPhase_PhaseId = 7 + KillChainPhase_PHASE_ID_OTHER KillChainPhase_PhaseId = 99 +) + +// Enum value maps for KillChainPhase_PhaseId. +var ( + KillChainPhase_PhaseId_name = map[int32]string{ + 0: "PHASE_ID_UNKNOWN", + 1: "PHASE_ID_RECONNAISSANCE", + 2: "PHASE_ID_WEAPONIZATION", + 3: "PHASE_ID_DELIVERY", + 4: "PHASE_ID_EXPLOITATION", + 5: "PHASE_ID_INSTALLATION", + 6: "PHASE_ID_COMMAND_CONTROL", + 7: "PHASE_ID_ACTIONS_ON_OBJECTIVES", + 99: "PHASE_ID_OTHER", + } + KillChainPhase_PhaseId_value = map[string]int32{ + "PHASE_ID_UNKNOWN": 0, + "PHASE_ID_RECONNAISSANCE": 1, + "PHASE_ID_WEAPONIZATION": 2, + "PHASE_ID_DELIVERY": 3, + "PHASE_ID_EXPLOITATION": 4, + "PHASE_ID_INSTALLATION": 5, + "PHASE_ID_COMMAND_CONTROL": 6, + "PHASE_ID_ACTIONS_ON_OBJECTIVES": 7, + "PHASE_ID_OTHER": 99, + } +) + +func (x KillChainPhase_PhaseId) Enum() *KillChainPhase_PhaseId { + p := new(KillChainPhase_PhaseId) + *p = x + return p +} + +func (x KillChainPhase_PhaseId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (KillChainPhase_PhaseId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[48].Descriptor() +} + +func (KillChainPhase_PhaseId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[48] +} + +func (x KillChainPhase_PhaseId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use KillChainPhase_PhaseId.Descriptor instead. +func (KillChainPhase_PhaseId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{59, 0} +} + +type Malware_ClassificationIds int32 + +const ( + Malware_CLASSIFICATION_IDS_UNKNOWN Malware_ClassificationIds = 0 + Malware_CLASSIFICATION_IDS_ADWARE Malware_ClassificationIds = 1 + Malware_CLASSIFICATION_IDS_BACKDOOR Malware_ClassificationIds = 2 + Malware_CLASSIFICATION_IDS_BOT Malware_ClassificationIds = 3 + Malware_CLASSIFICATION_IDS_BOOTKIT Malware_ClassificationIds = 4 + Malware_CLASSIFICATION_IDS_DDOS Malware_ClassificationIds = 5 + Malware_CLASSIFICATION_IDS_DOWNLOADER Malware_ClassificationIds = 6 + Malware_CLASSIFICATION_IDS_DROPPER Malware_ClassificationIds = 7 + Malware_CLASSIFICATION_IDS_EXPLOIT_KIT Malware_ClassificationIds = 8 + Malware_CLASSIFICATION_IDS_KEYLOGGER Malware_ClassificationIds = 9 + Malware_CLASSIFICATION_IDS_RANSOMWARE Malware_ClassificationIds = 10 + Malware_CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN Malware_ClassificationIds = 11 + Malware_CLASSIFICATION_IDS_RESOURCE_EXPLOITATION Malware_ClassificationIds = 13 + Malware_CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE Malware_ClassificationIds = 14 + Malware_CLASSIFICATION_IDS_ROOTKIT Malware_ClassificationIds = 15 + Malware_CLASSIFICATION_IDS_SCREEN_CAPTURE Malware_ClassificationIds = 16 + Malware_CLASSIFICATION_IDS_SPYWARE Malware_ClassificationIds = 17 + Malware_CLASSIFICATION_IDS_TROJAN Malware_ClassificationIds = 18 + Malware_CLASSIFICATION_IDS_VIRUS Malware_ClassificationIds = 19 + Malware_CLASSIFICATION_IDS_WEBSHELL Malware_ClassificationIds = 20 + Malware_CLASSIFICATION_IDS_WIPER Malware_ClassificationIds = 21 + Malware_CLASSIFICATION_IDS_WORM Malware_ClassificationIds = 22 + Malware_CLASSIFICATION_IDS_OTHER Malware_ClassificationIds = 99 +) + +// Enum value maps for Malware_ClassificationIds. +var ( + Malware_ClassificationIds_name = map[int32]string{ + 0: "CLASSIFICATION_IDS_UNKNOWN", + 1: "CLASSIFICATION_IDS_ADWARE", + 2: "CLASSIFICATION_IDS_BACKDOOR", + 3: "CLASSIFICATION_IDS_BOT", + 4: "CLASSIFICATION_IDS_BOOTKIT", + 5: "CLASSIFICATION_IDS_DDOS", + 6: "CLASSIFICATION_IDS_DOWNLOADER", + 7: "CLASSIFICATION_IDS_DROPPER", + 8: "CLASSIFICATION_IDS_EXPLOIT_KIT", + 9: "CLASSIFICATION_IDS_KEYLOGGER", + 10: "CLASSIFICATION_IDS_RANSOMWARE", + 11: "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN", + 13: "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION", + 14: "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE", + 15: "CLASSIFICATION_IDS_ROOTKIT", + 16: "CLASSIFICATION_IDS_SCREEN_CAPTURE", + 17: "CLASSIFICATION_IDS_SPYWARE", + 18: "CLASSIFICATION_IDS_TROJAN", + 19: "CLASSIFICATION_IDS_VIRUS", + 20: "CLASSIFICATION_IDS_WEBSHELL", + 21: "CLASSIFICATION_IDS_WIPER", + 22: "CLASSIFICATION_IDS_WORM", + 99: "CLASSIFICATION_IDS_OTHER", + } + Malware_ClassificationIds_value = map[string]int32{ + "CLASSIFICATION_IDS_UNKNOWN": 0, + "CLASSIFICATION_IDS_ADWARE": 1, + "CLASSIFICATION_IDS_BACKDOOR": 2, + "CLASSIFICATION_IDS_BOT": 3, + "CLASSIFICATION_IDS_BOOTKIT": 4, + "CLASSIFICATION_IDS_DDOS": 5, + "CLASSIFICATION_IDS_DOWNLOADER": 6, + "CLASSIFICATION_IDS_DROPPER": 7, + "CLASSIFICATION_IDS_EXPLOIT_KIT": 8, + "CLASSIFICATION_IDS_KEYLOGGER": 9, + "CLASSIFICATION_IDS_RANSOMWARE": 10, + "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN": 11, + "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION": 13, + "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE": 14, + "CLASSIFICATION_IDS_ROOTKIT": 15, + "CLASSIFICATION_IDS_SCREEN_CAPTURE": 16, + "CLASSIFICATION_IDS_SPYWARE": 17, + "CLASSIFICATION_IDS_TROJAN": 18, + "CLASSIFICATION_IDS_VIRUS": 19, + "CLASSIFICATION_IDS_WEBSHELL": 20, + "CLASSIFICATION_IDS_WIPER": 21, + "CLASSIFICATION_IDS_WORM": 22, + "CLASSIFICATION_IDS_OTHER": 99, + } +) + +func (x Malware_ClassificationIds) Enum() *Malware_ClassificationIds { + p := new(Malware_ClassificationIds) + *p = x + return p +} + +func (x Malware_ClassificationIds) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Malware_ClassificationIds) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[49].Descriptor() +} + +func (Malware_ClassificationIds) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[49] +} + +func (x Malware_ClassificationIds) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Malware_ClassificationIds.Descriptor instead. +func (Malware_ClassificationIds) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{64, 0} +} + +type Malware_SeverityId int32 + +const ( + Malware_SEVERITY_ID_UNKNOWN Malware_SeverityId = 0 + Malware_SEVERITY_ID_INFORMATIONAL Malware_SeverityId = 1 + Malware_SEVERITY_ID_LOW Malware_SeverityId = 2 + Malware_SEVERITY_ID_MEDIUM Malware_SeverityId = 3 + Malware_SEVERITY_ID_HIGH Malware_SeverityId = 4 + Malware_SEVERITY_ID_CRITICAL Malware_SeverityId = 5 + Malware_SEVERITY_ID_FATAL Malware_SeverityId = 6 + Malware_SEVERITY_ID_OTHER Malware_SeverityId = 99 +) + +// Enum value maps for Malware_SeverityId. +var ( + Malware_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + Malware_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x Malware_SeverityId) Enum() *Malware_SeverityId { + p := new(Malware_SeverityId) + *p = x + return p +} + +func (x Malware_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Malware_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[50].Descriptor() +} + +func (Malware_SeverityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[50] +} + +func (x Malware_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Malware_SeverityId.Descriptor instead. +func (Malware_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{64, 1} +} + +type MalwareScanInfo_TypeId int32 + +const ( + MalwareScanInfo_TYPE_ID_UNKNOWN MalwareScanInfo_TypeId = 0 + MalwareScanInfo_TYPE_ID_MANUAL MalwareScanInfo_TypeId = 1 + MalwareScanInfo_TYPE_ID_SCHEDULED MalwareScanInfo_TypeId = 2 + MalwareScanInfo_TYPE_ID_UPDATED_CONTENT MalwareScanInfo_TypeId = 3 + MalwareScanInfo_TYPE_ID_QUARANTINED_ITEMS MalwareScanInfo_TypeId = 4 + MalwareScanInfo_TYPE_ID_ATTACHED_MEDIA MalwareScanInfo_TypeId = 5 + MalwareScanInfo_TYPE_ID_USER_LOGON MalwareScanInfo_TypeId = 6 + MalwareScanInfo_TYPE_ID_ELAM MalwareScanInfo_TypeId = 7 + MalwareScanInfo_TYPE_ID_OTHER MalwareScanInfo_TypeId = 99 +) + +// Enum value maps for MalwareScanInfo_TypeId. +var ( + MalwareScanInfo_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_MANUAL", + 2: "TYPE_ID_SCHEDULED", + 3: "TYPE_ID_UPDATED_CONTENT", + 4: "TYPE_ID_QUARANTINED_ITEMS", + 5: "TYPE_ID_ATTACHED_MEDIA", + 6: "TYPE_ID_USER_LOGON", + 7: "TYPE_ID_ELAM", + 99: "TYPE_ID_OTHER", + } + MalwareScanInfo_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_MANUAL": 1, + "TYPE_ID_SCHEDULED": 2, + "TYPE_ID_UPDATED_CONTENT": 3, + "TYPE_ID_QUARANTINED_ITEMS": 4, + "TYPE_ID_ATTACHED_MEDIA": 5, + "TYPE_ID_USER_LOGON": 6, + "TYPE_ID_ELAM": 7, + "TYPE_ID_OTHER": 99, + } +) + +func (x MalwareScanInfo_TypeId) Enum() *MalwareScanInfo_TypeId { + p := new(MalwareScanInfo_TypeId) + *p = x + return p +} + +func (x MalwareScanInfo_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (MalwareScanInfo_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[51].Descriptor() +} + +func (MalwareScanInfo_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[51] +} + +func (x MalwareScanInfo_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use MalwareScanInfo_TypeId.Descriptor instead. +func (MalwareScanInfo_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{65, 0} +} + +type ManagedEntity_TypeId int32 + +const ( + ManagedEntity_TYPE_ID_UNKNOWN ManagedEntity_TypeId = 0 + ManagedEntity_TYPE_ID_DEVICE ManagedEntity_TypeId = 1 + ManagedEntity_TYPE_ID_USER ManagedEntity_TypeId = 2 + ManagedEntity_TYPE_ID_GROUP ManagedEntity_TypeId = 3 + ManagedEntity_TYPE_ID_ORGANIZATION ManagedEntity_TypeId = 4 + ManagedEntity_TYPE_ID_POLICY ManagedEntity_TypeId = 5 + ManagedEntity_TYPE_ID_EMAIL ManagedEntity_TypeId = 6 + ManagedEntity_TYPE_ID_NETWORK_ZONE ManagedEntity_TypeId = 7 + ManagedEntity_TYPE_ID_OTHER ManagedEntity_TypeId = 99 +) + +// Enum value maps for ManagedEntity_TypeId. +var ( + ManagedEntity_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_DEVICE", + 2: "TYPE_ID_USER", + 3: "TYPE_ID_GROUP", + 4: "TYPE_ID_ORGANIZATION", + 5: "TYPE_ID_POLICY", + 6: "TYPE_ID_EMAIL", + 7: "TYPE_ID_NETWORK_ZONE", + 99: "TYPE_ID_OTHER", + } + ManagedEntity_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_DEVICE": 1, + "TYPE_ID_USER": 2, + "TYPE_ID_GROUP": 3, + "TYPE_ID_ORGANIZATION": 4, + "TYPE_ID_POLICY": 5, + "TYPE_ID_EMAIL": 6, + "TYPE_ID_NETWORK_ZONE": 7, + "TYPE_ID_OTHER": 99, + } +) + +func (x ManagedEntity_TypeId) Enum() *ManagedEntity_TypeId { + p := new(ManagedEntity_TypeId) + *p = x + return p +} + +func (x ManagedEntity_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ManagedEntity_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[52].Descriptor() +} + +func (ManagedEntity_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[52] +} + +func (x ManagedEntity_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ManagedEntity_TypeId.Descriptor instead. +func (ManagedEntity_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{66, 0} +} + +type MessageContext_AiRoleId int32 + +const ( + MessageContext_AI_ROLE_ID_UNKNOWN MessageContext_AiRoleId = 0 + MessageContext_AI_ROLE_ID_USER MessageContext_AiRoleId = 1 + MessageContext_AI_ROLE_ID_ASSISTANT MessageContext_AiRoleId = 2 + MessageContext_AI_ROLE_ID_TOOL MessageContext_AiRoleId = 3 + MessageContext_AI_ROLE_ID_AGENT MessageContext_AiRoleId = 4 + MessageContext_AI_ROLE_ID_ORCHESTRATOR MessageContext_AiRoleId = 5 + MessageContext_AI_ROLE_ID_RETRIEVER MessageContext_AiRoleId = 6 + MessageContext_AI_ROLE_ID_OTHER MessageContext_AiRoleId = 99 +) + +// Enum value maps for MessageContext_AiRoleId. +var ( + MessageContext_AiRoleId_name = map[int32]string{ + 0: "AI_ROLE_ID_UNKNOWN", + 1: "AI_ROLE_ID_USER", + 2: "AI_ROLE_ID_ASSISTANT", + 3: "AI_ROLE_ID_TOOL", + 4: "AI_ROLE_ID_AGENT", + 5: "AI_ROLE_ID_ORCHESTRATOR", + 6: "AI_ROLE_ID_RETRIEVER", + 99: "AI_ROLE_ID_OTHER", + } + MessageContext_AiRoleId_value = map[string]int32{ + "AI_ROLE_ID_UNKNOWN": 0, + "AI_ROLE_ID_USER": 1, + "AI_ROLE_ID_ASSISTANT": 2, + "AI_ROLE_ID_TOOL": 3, + "AI_ROLE_ID_AGENT": 4, + "AI_ROLE_ID_ORCHESTRATOR": 5, + "AI_ROLE_ID_RETRIEVER": 6, + "AI_ROLE_ID_OTHER": 99, + } +) + +func (x MessageContext_AiRoleId) Enum() *MessageContext_AiRoleId { + p := new(MessageContext_AiRoleId) + *p = x + return p +} + +func (x MessageContext_AiRoleId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (MessageContext_AiRoleId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[53].Descriptor() +} + +func (MessageContext_AiRoleId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[53] +} + +func (x MessageContext_AiRoleId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use MessageContext_AiRoleId.Descriptor instead. +func (MessageContext_AiRoleId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{67, 0} +} + +type NetworkEndpoint_NetworkScopeId int32 + +const ( + NetworkEndpoint_NETWORK_SCOPE_ID_UNKNOWN NetworkEndpoint_NetworkScopeId = 0 + NetworkEndpoint_NETWORK_SCOPE_ID_INTERNAL NetworkEndpoint_NetworkScopeId = 1 + NetworkEndpoint_NETWORK_SCOPE_ID_EXTERNAL NetworkEndpoint_NetworkScopeId = 2 + NetworkEndpoint_NETWORK_SCOPE_ID_OTHER NetworkEndpoint_NetworkScopeId = 99 +) + +// Enum value maps for NetworkEndpoint_NetworkScopeId. +var ( + NetworkEndpoint_NetworkScopeId_name = map[int32]string{ + 0: "NETWORK_SCOPE_ID_UNKNOWN", + 1: "NETWORK_SCOPE_ID_INTERNAL", + 2: "NETWORK_SCOPE_ID_EXTERNAL", + 99: "NETWORK_SCOPE_ID_OTHER", + } + NetworkEndpoint_NetworkScopeId_value = map[string]int32{ + "NETWORK_SCOPE_ID_UNKNOWN": 0, + "NETWORK_SCOPE_ID_INTERNAL": 1, + "NETWORK_SCOPE_ID_EXTERNAL": 2, + "NETWORK_SCOPE_ID_OTHER": 99, + } +) + +func (x NetworkEndpoint_NetworkScopeId) Enum() *NetworkEndpoint_NetworkScopeId { + p := new(NetworkEndpoint_NetworkScopeId) + *p = x + return p +} + +func (x NetworkEndpoint_NetworkScopeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (NetworkEndpoint_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[54].Descriptor() +} + +func (NetworkEndpoint_NetworkScopeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[54] +} + +func (x NetworkEndpoint_NetworkScopeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use NetworkEndpoint_NetworkScopeId.Descriptor instead. +func (NetworkEndpoint_NetworkScopeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{71, 0} +} + +type NetworkEndpoint_TypeId int32 + +const ( + NetworkEndpoint_TYPE_ID_UNKNOWN NetworkEndpoint_TypeId = 0 + NetworkEndpoint_TYPE_ID_SERVER NetworkEndpoint_TypeId = 1 + NetworkEndpoint_TYPE_ID_DESKTOP NetworkEndpoint_TypeId = 2 + NetworkEndpoint_TYPE_ID_LAPTOP NetworkEndpoint_TypeId = 3 + NetworkEndpoint_TYPE_ID_TABLET NetworkEndpoint_TypeId = 4 + NetworkEndpoint_TYPE_ID_MOBILE NetworkEndpoint_TypeId = 5 + NetworkEndpoint_TYPE_ID_VIRTUAL NetworkEndpoint_TypeId = 6 + NetworkEndpoint_TYPE_ID_IOT NetworkEndpoint_TypeId = 7 + NetworkEndpoint_TYPE_ID_BROWSER NetworkEndpoint_TypeId = 8 + NetworkEndpoint_TYPE_ID_FIREWALL NetworkEndpoint_TypeId = 9 + NetworkEndpoint_TYPE_ID_SWITCH NetworkEndpoint_TypeId = 10 + NetworkEndpoint_TYPE_ID_HUB NetworkEndpoint_TypeId = 11 + NetworkEndpoint_TYPE_ID_ROUTER NetworkEndpoint_TypeId = 12 + NetworkEndpoint_TYPE_ID_IDS NetworkEndpoint_TypeId = 13 + NetworkEndpoint_TYPE_ID_IPS NetworkEndpoint_TypeId = 14 + NetworkEndpoint_TYPE_ID_LOAD_BALANCER NetworkEndpoint_TypeId = 15 + NetworkEndpoint_TYPE_ID_OTHER NetworkEndpoint_TypeId = 99 +) + +// Enum value maps for NetworkEndpoint_TypeId. +var ( + NetworkEndpoint_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", + } + NetworkEndpoint_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, + } +) + +func (x NetworkEndpoint_TypeId) Enum() *NetworkEndpoint_TypeId { + p := new(NetworkEndpoint_TypeId) + *p = x + return p +} + +func (x NetworkEndpoint_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (NetworkEndpoint_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[55].Descriptor() +} + +func (NetworkEndpoint_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[55] +} + +func (x NetworkEndpoint_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use NetworkEndpoint_TypeId.Descriptor instead. +func (NetworkEndpoint_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{71, 1} +} + +type NetworkInterface_TypeId int32 + +const ( + NetworkInterface_TYPE_ID_UNKNOWN NetworkInterface_TypeId = 0 + NetworkInterface_TYPE_ID_WIRED NetworkInterface_TypeId = 1 + NetworkInterface_TYPE_ID_WIRELESS NetworkInterface_TypeId = 2 + NetworkInterface_TYPE_ID_MOBILE NetworkInterface_TypeId = 3 + NetworkInterface_TYPE_ID_TUNNEL NetworkInterface_TypeId = 4 + NetworkInterface_TYPE_ID_OTHER NetworkInterface_TypeId = 99 +) + +// Enum value maps for NetworkInterface_TypeId. +var ( + NetworkInterface_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_WIRED", + 2: "TYPE_ID_WIRELESS", + 3: "TYPE_ID_MOBILE", + 4: "TYPE_ID_TUNNEL", + 99: "TYPE_ID_OTHER", + } + NetworkInterface_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_WIRED": 1, + "TYPE_ID_WIRELESS": 2, + "TYPE_ID_MOBILE": 3, + "TYPE_ID_TUNNEL": 4, + "TYPE_ID_OTHER": 99, + } +) + +func (x NetworkInterface_TypeId) Enum() *NetworkInterface_TypeId { + p := new(NetworkInterface_TypeId) + *p = x + return p +} + +func (x NetworkInterface_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (NetworkInterface_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[56].Descriptor() +} + +func (NetworkInterface_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[56] +} + +func (x NetworkInterface_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use NetworkInterface_TypeId.Descriptor instead. +func (NetworkInterface_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{72, 0} +} + +type NetworkProxy_NetworkScopeId int32 + +const ( + NetworkProxy_NETWORK_SCOPE_ID_UNKNOWN NetworkProxy_NetworkScopeId = 0 + NetworkProxy_NETWORK_SCOPE_ID_INTERNAL NetworkProxy_NetworkScopeId = 1 + NetworkProxy_NETWORK_SCOPE_ID_EXTERNAL NetworkProxy_NetworkScopeId = 2 + NetworkProxy_NETWORK_SCOPE_ID_OTHER NetworkProxy_NetworkScopeId = 99 +) + +// Enum value maps for NetworkProxy_NetworkScopeId. +var ( + NetworkProxy_NetworkScopeId_name = map[int32]string{ + 0: "NETWORK_SCOPE_ID_UNKNOWN", + 1: "NETWORK_SCOPE_ID_INTERNAL", + 2: "NETWORK_SCOPE_ID_EXTERNAL", + 99: "NETWORK_SCOPE_ID_OTHER", + } + NetworkProxy_NetworkScopeId_value = map[string]int32{ + "NETWORK_SCOPE_ID_UNKNOWN": 0, + "NETWORK_SCOPE_ID_INTERNAL": 1, + "NETWORK_SCOPE_ID_EXTERNAL": 2, + "NETWORK_SCOPE_ID_OTHER": 99, + } +) + +func (x NetworkProxy_NetworkScopeId) Enum() *NetworkProxy_NetworkScopeId { + p := new(NetworkProxy_NetworkScopeId) + *p = x + return p +} + +func (x NetworkProxy_NetworkScopeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (NetworkProxy_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[57].Descriptor() +} + +func (NetworkProxy_NetworkScopeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[57] +} + +func (x NetworkProxy_NetworkScopeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use NetworkProxy_NetworkScopeId.Descriptor instead. +func (NetworkProxy_NetworkScopeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{73, 0} +} + +type NetworkProxy_TypeId int32 + +const ( + NetworkProxy_TYPE_ID_UNKNOWN NetworkProxy_TypeId = 0 + NetworkProxy_TYPE_ID_SERVER NetworkProxy_TypeId = 1 + NetworkProxy_TYPE_ID_DESKTOP NetworkProxy_TypeId = 2 + NetworkProxy_TYPE_ID_LAPTOP NetworkProxy_TypeId = 3 + NetworkProxy_TYPE_ID_TABLET NetworkProxy_TypeId = 4 + NetworkProxy_TYPE_ID_MOBILE NetworkProxy_TypeId = 5 + NetworkProxy_TYPE_ID_VIRTUAL NetworkProxy_TypeId = 6 + NetworkProxy_TYPE_ID_IOT NetworkProxy_TypeId = 7 + NetworkProxy_TYPE_ID_BROWSER NetworkProxy_TypeId = 8 + NetworkProxy_TYPE_ID_FIREWALL NetworkProxy_TypeId = 9 + NetworkProxy_TYPE_ID_SWITCH NetworkProxy_TypeId = 10 + NetworkProxy_TYPE_ID_HUB NetworkProxy_TypeId = 11 + NetworkProxy_TYPE_ID_ROUTER NetworkProxy_TypeId = 12 + NetworkProxy_TYPE_ID_IDS NetworkProxy_TypeId = 13 + NetworkProxy_TYPE_ID_IPS NetworkProxy_TypeId = 14 + NetworkProxy_TYPE_ID_LOAD_BALANCER NetworkProxy_TypeId = 15 + NetworkProxy_TYPE_ID_OTHER NetworkProxy_TypeId = 99 +) + +// Enum value maps for NetworkProxy_TypeId. +var ( + NetworkProxy_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", + } + NetworkProxy_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, + } +) + +func (x NetworkProxy_TypeId) Enum() *NetworkProxy_TypeId { + p := new(NetworkProxy_TypeId) + *p = x + return p +} + +func (x NetworkProxy_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (NetworkProxy_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[58].Descriptor() +} + +func (NetworkProxy_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[58] +} + +func (x NetworkProxy_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use NetworkProxy_TypeId.Descriptor instead. +func (NetworkProxy_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{73, 1} +} + +type Observable_TypeId int32 + +const ( + Observable_TYPE_ID_UNKNOWN Observable_TypeId = 0 + Observable_TYPE_ID_HOSTNAME Observable_TypeId = 1 + Observable_TYPE_ID_IP_ADDRESS Observable_TypeId = 2 + Observable_TYPE_ID_MAC_ADDRESS Observable_TypeId = 3 + Observable_TYPE_ID_USER_NAME Observable_TypeId = 4 + Observable_TYPE_ID_EMAIL_ADDRESS Observable_TypeId = 5 + Observable_TYPE_ID_URL_STRING Observable_TypeId = 6 + Observable_TYPE_ID_FILE_NAME Observable_TypeId = 7 + Observable_TYPE_ID_HASH Observable_TypeId = 8 + Observable_TYPE_ID_PROCESS_NAME Observable_TypeId = 9 + Observable_TYPE_ID_RESOURCE_UID Observable_TypeId = 10 + Observable_TYPE_ID_PORT Observable_TypeId = 11 + Observable_TYPE_ID_SUBNET Observable_TypeId = 12 + Observable_TYPE_ID_COMMAND_LINE Observable_TypeId = 13 + Observable_TYPE_ID_COUNTRY Observable_TypeId = 14 + Observable_TYPE_ID_PROCESS_ID Observable_TypeId = 15 + Observable_TYPE_ID_HTTP_USER_AGENT Observable_TypeId = 16 + Observable_TYPE_ID_CWE_OBJECT_UID Observable_TypeId = 17 + Observable_TYPE_ID_CVE_OBJECT_UID Observable_TypeId = 18 + Observable_TYPE_ID_USER_CREDENTIAL_ID Observable_TypeId = 19 + Observable_TYPE_ID_ENDPOINT Observable_TypeId = 20 + Observable_TYPE_ID_USER Observable_TypeId = 21 + Observable_TYPE_ID_EMAIL Observable_TypeId = 22 + Observable_TYPE_ID_UNIFORM_RESOURCE_LOCATOR Observable_TypeId = 23 + Observable_TYPE_ID_FILE Observable_TypeId = 24 + Observable_TYPE_ID_PROCESS Observable_TypeId = 25 + Observable_TYPE_ID_GEO_LOCATION Observable_TypeId = 26 + Observable_TYPE_ID_CONTAINER Observable_TypeId = 27 + Observable_TYPE_ID_REGISTRY_KEY Observable_TypeId = 28 + Observable_TYPE_ID_REGISTRY_VALUE Observable_TypeId = 29 + Observable_TYPE_ID_FINGERPRINT Observable_TypeId = 30 + Observable_TYPE_ID_USER_OBJECT_UID Observable_TypeId = 31 + Observable_TYPE_ID_GROUP_OBJECT_NAME Observable_TypeId = 32 + Observable_TYPE_ID_GROUP_OBJECT_UID Observable_TypeId = 33 + Observable_TYPE_ID_ACCOUNT_OBJECT_NAME Observable_TypeId = 34 + Observable_TYPE_ID_ACCOUNT_OBJECT_UID Observable_TypeId = 35 + Observable_TYPE_ID_SCRIPT_CONTENT Observable_TypeId = 36 + Observable_TYPE_ID_SERIAL_NUMBER Observable_TypeId = 37 + Observable_TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME Observable_TypeId = 38 + Observable_TYPE_ID_PROCESS_ENTITY_OBJECT_UID Observable_TypeId = 39 + Observable_TYPE_ID_EMAIL_OBJECT_SUBJECT Observable_TypeId = 40 + Observable_TYPE_ID_EMAIL_OBJECT_UID Observable_TypeId = 41 + Observable_TYPE_ID_MESSAGE_UID Observable_TypeId = 42 + Observable_TYPE_ID_REGISTRY_VALUE_OBJECT_NAME Observable_TypeId = 43 + Observable_TYPE_ID_ADVISORY_OBJECT_UID Observable_TypeId = 44 + Observable_TYPE_ID_FILE_PATH Observable_TypeId = 45 + Observable_TYPE_ID_REGISTRY_KEY_PATH Observable_TypeId = 46 + Observable_TYPE_ID_DEVICE_OBJECT_UID Observable_TypeId = 47 + Observable_TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID Observable_TypeId = 48 + Observable_TYPE_ID_OTHER Observable_TypeId = 99 +) + +// Enum value maps for Observable_TypeId. +var ( + Observable_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_HOSTNAME", + 2: "TYPE_ID_IP_ADDRESS", + 3: "TYPE_ID_MAC_ADDRESS", + 4: "TYPE_ID_USER_NAME", + 5: "TYPE_ID_EMAIL_ADDRESS", + 6: "TYPE_ID_URL_STRING", + 7: "TYPE_ID_FILE_NAME", + 8: "TYPE_ID_HASH", + 9: "TYPE_ID_PROCESS_NAME", + 10: "TYPE_ID_RESOURCE_UID", + 11: "TYPE_ID_PORT", + 12: "TYPE_ID_SUBNET", + 13: "TYPE_ID_COMMAND_LINE", + 14: "TYPE_ID_COUNTRY", + 15: "TYPE_ID_PROCESS_ID", + 16: "TYPE_ID_HTTP_USER_AGENT", + 17: "TYPE_ID_CWE_OBJECT_UID", + 18: "TYPE_ID_CVE_OBJECT_UID", + 19: "TYPE_ID_USER_CREDENTIAL_ID", + 20: "TYPE_ID_ENDPOINT", + 21: "TYPE_ID_USER", + 22: "TYPE_ID_EMAIL", + 23: "TYPE_ID_UNIFORM_RESOURCE_LOCATOR", + 24: "TYPE_ID_FILE", + 25: "TYPE_ID_PROCESS", + 26: "TYPE_ID_GEO_LOCATION", + 27: "TYPE_ID_CONTAINER", + 28: "TYPE_ID_REGISTRY_KEY", + 29: "TYPE_ID_REGISTRY_VALUE", + 30: "TYPE_ID_FINGERPRINT", + 31: "TYPE_ID_USER_OBJECT_UID", + 32: "TYPE_ID_GROUP_OBJECT_NAME", + 33: "TYPE_ID_GROUP_OBJECT_UID", + 34: "TYPE_ID_ACCOUNT_OBJECT_NAME", + 35: "TYPE_ID_ACCOUNT_OBJECT_UID", + 36: "TYPE_ID_SCRIPT_CONTENT", + 37: "TYPE_ID_SERIAL_NUMBER", + 38: "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME", + 39: "TYPE_ID_PROCESS_ENTITY_OBJECT_UID", + 40: "TYPE_ID_EMAIL_OBJECT_SUBJECT", + 41: "TYPE_ID_EMAIL_OBJECT_UID", + 42: "TYPE_ID_MESSAGE_UID", + 43: "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME", + 44: "TYPE_ID_ADVISORY_OBJECT_UID", + 45: "TYPE_ID_FILE_PATH", + 46: "TYPE_ID_REGISTRY_KEY_PATH", + 47: "TYPE_ID_DEVICE_OBJECT_UID", + 48: "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID", + 99: "TYPE_ID_OTHER", + } + Observable_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_HOSTNAME": 1, + "TYPE_ID_IP_ADDRESS": 2, + "TYPE_ID_MAC_ADDRESS": 3, + "TYPE_ID_USER_NAME": 4, + "TYPE_ID_EMAIL_ADDRESS": 5, + "TYPE_ID_URL_STRING": 6, + "TYPE_ID_FILE_NAME": 7, + "TYPE_ID_HASH": 8, + "TYPE_ID_PROCESS_NAME": 9, + "TYPE_ID_RESOURCE_UID": 10, + "TYPE_ID_PORT": 11, + "TYPE_ID_SUBNET": 12, + "TYPE_ID_COMMAND_LINE": 13, + "TYPE_ID_COUNTRY": 14, + "TYPE_ID_PROCESS_ID": 15, + "TYPE_ID_HTTP_USER_AGENT": 16, + "TYPE_ID_CWE_OBJECT_UID": 17, + "TYPE_ID_CVE_OBJECT_UID": 18, + "TYPE_ID_USER_CREDENTIAL_ID": 19, + "TYPE_ID_ENDPOINT": 20, + "TYPE_ID_USER": 21, + "TYPE_ID_EMAIL": 22, + "TYPE_ID_UNIFORM_RESOURCE_LOCATOR": 23, + "TYPE_ID_FILE": 24, + "TYPE_ID_PROCESS": 25, + "TYPE_ID_GEO_LOCATION": 26, + "TYPE_ID_CONTAINER": 27, + "TYPE_ID_REGISTRY_KEY": 28, + "TYPE_ID_REGISTRY_VALUE": 29, + "TYPE_ID_FINGERPRINT": 30, + "TYPE_ID_USER_OBJECT_UID": 31, + "TYPE_ID_GROUP_OBJECT_NAME": 32, + "TYPE_ID_GROUP_OBJECT_UID": 33, + "TYPE_ID_ACCOUNT_OBJECT_NAME": 34, + "TYPE_ID_ACCOUNT_OBJECT_UID": 35, + "TYPE_ID_SCRIPT_CONTENT": 36, + "TYPE_ID_SERIAL_NUMBER": 37, + "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME": 38, + "TYPE_ID_PROCESS_ENTITY_OBJECT_UID": 39, + "TYPE_ID_EMAIL_OBJECT_SUBJECT": 40, + "TYPE_ID_EMAIL_OBJECT_UID": 41, + "TYPE_ID_MESSAGE_UID": 42, + "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME": 43, + "TYPE_ID_ADVISORY_OBJECT_UID": 44, + "TYPE_ID_FILE_PATH": 45, + "TYPE_ID_REGISTRY_KEY_PATH": 46, + "TYPE_ID_DEVICE_OBJECT_UID": 47, + "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID": 48, + "TYPE_ID_OTHER": 99, + } +) + +func (x Observable_TypeId) Enum() *Observable_TypeId { + p := new(Observable_TypeId) + *p = x + return p +} + +func (x Observable_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Observable_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[59].Descriptor() +} + +func (Observable_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[59] +} + +func (x Observable_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Observable_TypeId.Descriptor instead. +func (Observable_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{75, 0} +} + +type Os_TypeId int32 + +const ( + Os_TYPE_ID_UNKNOWN Os_TypeId = 0 + Os_TYPE_ID_OTHER Os_TypeId = 99 + Os_TYPE_ID_WINDOWS Os_TypeId = 100 + Os_TYPE_ID_WINDOWS_MOBILE Os_TypeId = 101 + Os_TYPE_ID_LINUX Os_TypeId = 200 + Os_TYPE_ID_ANDROID Os_TypeId = 201 + Os_TYPE_ID_MACOS Os_TypeId = 300 + Os_TYPE_ID_IOS Os_TypeId = 301 + Os_TYPE_ID_IPADOS Os_TypeId = 302 + Os_TYPE_ID_SOLARIS Os_TypeId = 400 + Os_TYPE_ID_AIX Os_TypeId = 401 + Os_TYPE_ID_HP_UX Os_TypeId = 402 +) + +// Enum value maps for Os_TypeId. +var ( + Os_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 99: "TYPE_ID_OTHER", + 100: "TYPE_ID_WINDOWS", + 101: "TYPE_ID_WINDOWS_MOBILE", + 200: "TYPE_ID_LINUX", + 201: "TYPE_ID_ANDROID", + 300: "TYPE_ID_MACOS", + 301: "TYPE_ID_IOS", + 302: "TYPE_ID_IPADOS", + 400: "TYPE_ID_SOLARIS", + 401: "TYPE_ID_AIX", + 402: "TYPE_ID_HP_UX", + } + Os_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_OTHER": 99, + "TYPE_ID_WINDOWS": 100, + "TYPE_ID_WINDOWS_MOBILE": 101, + "TYPE_ID_LINUX": 200, + "TYPE_ID_ANDROID": 201, + "TYPE_ID_MACOS": 300, + "TYPE_ID_IOS": 301, + "TYPE_ID_IPADOS": 302, + "TYPE_ID_SOLARIS": 400, + "TYPE_ID_AIX": 401, + "TYPE_ID_HP_UX": 402, + } +) + +func (x Os_TypeId) Enum() *Os_TypeId { + p := new(Os_TypeId) + *p = x + return p +} + +func (x Os_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Os_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[60].Descriptor() +} + +func (Os_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[60] +} + +func (x Os_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Os_TypeId.Descriptor instead. +func (Os_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{78, 0} +} + +type Osint_ConfidenceId int32 + +const ( + Osint_CONFIDENCE_ID_UNKNOWN Osint_ConfidenceId = 0 + Osint_CONFIDENCE_ID_LOW Osint_ConfidenceId = 1 + Osint_CONFIDENCE_ID_MEDIUM Osint_ConfidenceId = 2 + Osint_CONFIDENCE_ID_HIGH Osint_ConfidenceId = 3 + Osint_CONFIDENCE_ID_OTHER Osint_ConfidenceId = 99 +) + +// Enum value maps for Osint_ConfidenceId. +var ( + Osint_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + Osint_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x Osint_ConfidenceId) Enum() *Osint_ConfidenceId { + p := new(Osint_ConfidenceId) + *p = x + return p +} + +func (x Osint_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Osint_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[61].Descriptor() +} + +func (Osint_ConfidenceId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[61] +} + +func (x Osint_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Osint_ConfidenceId.Descriptor instead. +func (Osint_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{79, 0} +} + +type Osint_DetectionPatternTypeId int32 + +const ( + Osint_DETECTION_PATTERN_TYPE_ID_UNKNOWN Osint_DetectionPatternTypeId = 0 + Osint_DETECTION_PATTERN_TYPE_ID_STIX Osint_DetectionPatternTypeId = 1 + Osint_DETECTION_PATTERN_TYPE_ID_PCRE Osint_DetectionPatternTypeId = 2 + Osint_DETECTION_PATTERN_TYPE_ID_SIGMA Osint_DetectionPatternTypeId = 3 + Osint_DETECTION_PATTERN_TYPE_ID_SNORT Osint_DetectionPatternTypeId = 4 + Osint_DETECTION_PATTERN_TYPE_ID_SURICATA Osint_DetectionPatternTypeId = 5 + Osint_DETECTION_PATTERN_TYPE_ID_YARA Osint_DetectionPatternTypeId = 6 + Osint_DETECTION_PATTERN_TYPE_ID_OTHER Osint_DetectionPatternTypeId = 99 +) + +// Enum value maps for Osint_DetectionPatternTypeId. +var ( + Osint_DetectionPatternTypeId_name = map[int32]string{ + 0: "DETECTION_PATTERN_TYPE_ID_UNKNOWN", + 1: "DETECTION_PATTERN_TYPE_ID_STIX", + 2: "DETECTION_PATTERN_TYPE_ID_PCRE", + 3: "DETECTION_PATTERN_TYPE_ID_SIGMA", + 4: "DETECTION_PATTERN_TYPE_ID_SNORT", + 5: "DETECTION_PATTERN_TYPE_ID_SURICATA", + 6: "DETECTION_PATTERN_TYPE_ID_YARA", + 99: "DETECTION_PATTERN_TYPE_ID_OTHER", + } + Osint_DetectionPatternTypeId_value = map[string]int32{ + "DETECTION_PATTERN_TYPE_ID_UNKNOWN": 0, + "DETECTION_PATTERN_TYPE_ID_STIX": 1, + "DETECTION_PATTERN_TYPE_ID_PCRE": 2, + "DETECTION_PATTERN_TYPE_ID_SIGMA": 3, + "DETECTION_PATTERN_TYPE_ID_SNORT": 4, + "DETECTION_PATTERN_TYPE_ID_SURICATA": 5, + "DETECTION_PATTERN_TYPE_ID_YARA": 6, + "DETECTION_PATTERN_TYPE_ID_OTHER": 99, + } +) + +func (x Osint_DetectionPatternTypeId) Enum() *Osint_DetectionPatternTypeId { + p := new(Osint_DetectionPatternTypeId) + *p = x + return p +} + +func (x Osint_DetectionPatternTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Osint_DetectionPatternTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[62].Descriptor() +} + +func (Osint_DetectionPatternTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[62] +} + +func (x Osint_DetectionPatternTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Osint_DetectionPatternTypeId.Descriptor instead. +func (Osint_DetectionPatternTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{79, 1} +} + +type Osint_SeverityId int32 + +const ( + Osint_SEVERITY_ID_UNKNOWN Osint_SeverityId = 0 + Osint_SEVERITY_ID_INFORMATIONAL Osint_SeverityId = 1 + Osint_SEVERITY_ID_LOW Osint_SeverityId = 2 + Osint_SEVERITY_ID_MEDIUM Osint_SeverityId = 3 + Osint_SEVERITY_ID_HIGH Osint_SeverityId = 4 + Osint_SEVERITY_ID_CRITICAL Osint_SeverityId = 5 + Osint_SEVERITY_ID_FATAL Osint_SeverityId = 6 + Osint_SEVERITY_ID_OTHER Osint_SeverityId = 99 +) + +// Enum value maps for Osint_SeverityId. +var ( + Osint_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + Osint_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x Osint_SeverityId) Enum() *Osint_SeverityId { + p := new(Osint_SeverityId) + *p = x + return p +} + +func (x Osint_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Osint_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[63].Descriptor() +} + +func (Osint_SeverityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[63] +} + +func (x Osint_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Osint_SeverityId.Descriptor instead. +func (Osint_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{79, 2} +} + +type Osint_TypeId int32 + +const ( + Osint_TYPE_ID_UNKNOWN Osint_TypeId = 0 + Osint_TYPE_ID_IP_ADDRESS Osint_TypeId = 1 + Osint_TYPE_ID_DOMAIN Osint_TypeId = 2 + Osint_TYPE_ID_HOSTNAME Osint_TypeId = 3 + Osint_TYPE_ID_HASH Osint_TypeId = 4 + Osint_TYPE_ID_URL Osint_TypeId = 5 + Osint_TYPE_ID_USER_AGENT Osint_TypeId = 6 + Osint_TYPE_ID_DIGITAL_CERTIFICATE Osint_TypeId = 7 + Osint_TYPE_ID_EMAIL Osint_TypeId = 8 + Osint_TYPE_ID_EMAIL_ADDRESS Osint_TypeId = 9 + Osint_TYPE_ID_VULNERABILITY Osint_TypeId = 10 + Osint_TYPE_ID_FILE Osint_TypeId = 11 + Osint_TYPE_ID_REGISTRY_KEY Osint_TypeId = 12 + Osint_TYPE_ID_REGISTRY_VALUE Osint_TypeId = 13 + Osint_TYPE_ID_COMMAND_LINE Osint_TypeId = 14 + Osint_TYPE_ID_OTHER Osint_TypeId = 99 +) + +// Enum value maps for Osint_TypeId. +var ( + Osint_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_IP_ADDRESS", + 2: "TYPE_ID_DOMAIN", + 3: "TYPE_ID_HOSTNAME", + 4: "TYPE_ID_HASH", + 5: "TYPE_ID_URL", + 6: "TYPE_ID_USER_AGENT", + 7: "TYPE_ID_DIGITAL_CERTIFICATE", + 8: "TYPE_ID_EMAIL", + 9: "TYPE_ID_EMAIL_ADDRESS", + 10: "TYPE_ID_VULNERABILITY", + 11: "TYPE_ID_FILE", + 12: "TYPE_ID_REGISTRY_KEY", + 13: "TYPE_ID_REGISTRY_VALUE", + 14: "TYPE_ID_COMMAND_LINE", + 99: "TYPE_ID_OTHER", + } + Osint_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_IP_ADDRESS": 1, + "TYPE_ID_DOMAIN": 2, + "TYPE_ID_HOSTNAME": 3, + "TYPE_ID_HASH": 4, + "TYPE_ID_URL": 5, + "TYPE_ID_USER_AGENT": 6, + "TYPE_ID_DIGITAL_CERTIFICATE": 7, + "TYPE_ID_EMAIL": 8, + "TYPE_ID_EMAIL_ADDRESS": 9, + "TYPE_ID_VULNERABILITY": 10, + "TYPE_ID_FILE": 11, + "TYPE_ID_REGISTRY_KEY": 12, + "TYPE_ID_REGISTRY_VALUE": 13, + "TYPE_ID_COMMAND_LINE": 14, + "TYPE_ID_OTHER": 99, + } +) + +func (x Osint_TypeId) Enum() *Osint_TypeId { + p := new(Osint_TypeId) + *p = x + return p +} + +func (x Osint_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Osint_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[64].Descriptor() +} + +func (Osint_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[64] +} + +func (x Osint_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Osint_TypeId.Descriptor instead. +func (Osint_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{79, 3} +} + +type Package_TypeId int32 + +const ( + Package_TYPE_ID_UNKNOWN Package_TypeId = 0 + Package_TYPE_ID_APPLICATION Package_TypeId = 1 + Package_TYPE_ID_OPERATING_SYSTEM Package_TypeId = 2 + Package_TYPE_ID_OTHER Package_TypeId = 99 +) + +// Enum value maps for Package_TypeId. +var ( + Package_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_APPLICATION", + 2: "TYPE_ID_OPERATING_SYSTEM", + 99: "TYPE_ID_OTHER", + } + Package_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_APPLICATION": 1, + "TYPE_ID_OPERATING_SYSTEM": 2, + "TYPE_ID_OTHER": 99, + } +) + +func (x Package_TypeId) Enum() *Package_TypeId { + p := new(Package_TypeId) + *p = x + return p +} + +func (x Package_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Package_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[65].Descriptor() +} + +func (Package_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[65] +} + +func (x Package_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Package_TypeId.Descriptor instead. +func (Package_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{80, 0} +} + +type Process_IntegrityId int32 + +const ( + Process_INTEGRITY_ID_UNKNOWN Process_IntegrityId = 0 + Process_INTEGRITY_ID_UNTRUSTED Process_IntegrityId = 1 + Process_INTEGRITY_ID_LOW Process_IntegrityId = 2 + Process_INTEGRITY_ID_MEDIUM Process_IntegrityId = 3 + Process_INTEGRITY_ID_HIGH Process_IntegrityId = 4 + Process_INTEGRITY_ID_SYSTEM Process_IntegrityId = 5 + Process_INTEGRITY_ID_PROTECTED Process_IntegrityId = 6 + Process_INTEGRITY_ID_OTHER Process_IntegrityId = 99 +) + +// Enum value maps for Process_IntegrityId. +var ( + Process_IntegrityId_name = map[int32]string{ + 0: "INTEGRITY_ID_UNKNOWN", + 1: "INTEGRITY_ID_UNTRUSTED", + 2: "INTEGRITY_ID_LOW", + 3: "INTEGRITY_ID_MEDIUM", + 4: "INTEGRITY_ID_HIGH", + 5: "INTEGRITY_ID_SYSTEM", + 6: "INTEGRITY_ID_PROTECTED", + 99: "INTEGRITY_ID_OTHER", + } + Process_IntegrityId_value = map[string]int32{ + "INTEGRITY_ID_UNKNOWN": 0, + "INTEGRITY_ID_UNTRUSTED": 1, + "INTEGRITY_ID_LOW": 2, + "INTEGRITY_ID_MEDIUM": 3, + "INTEGRITY_ID_HIGH": 4, + "INTEGRITY_ID_SYSTEM": 5, + "INTEGRITY_ID_PROTECTED": 6, + "INTEGRITY_ID_OTHER": 99, + } +) + +func (x Process_IntegrityId) Enum() *Process_IntegrityId { + p := new(Process_IntegrityId) + *p = x + return p +} + +func (x Process_IntegrityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Process_IntegrityId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[66].Descriptor() +} + +func (Process_IntegrityId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[66] +} + +func (x Process_IntegrityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Process_IntegrityId.Descriptor instead. +func (Process_IntegrityId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{83, 0} +} + +type Reputation_ScoreId int32 + +const ( + Reputation_SCORE_ID_UNKNOWN Reputation_ScoreId = 0 + Reputation_SCORE_ID_VERY_SAFE Reputation_ScoreId = 1 + Reputation_SCORE_ID_SAFE Reputation_ScoreId = 2 + Reputation_SCORE_ID_PROBABLY_SAFE Reputation_ScoreId = 3 + Reputation_SCORE_ID_LEANS_SAFE Reputation_ScoreId = 4 + Reputation_SCORE_ID_MAY_NOT_BE_SAFE Reputation_ScoreId = 5 + Reputation_SCORE_ID_EXERCISE_CAUTION Reputation_ScoreId = 6 + Reputation_SCORE_ID_SUSPICIOUS_RISKY Reputation_ScoreId = 7 + Reputation_SCORE_ID_POSSIBLY_MALICIOUS Reputation_ScoreId = 8 + Reputation_SCORE_ID_PROBABLY_MALICIOUS Reputation_ScoreId = 9 + Reputation_SCORE_ID_MALICIOUS Reputation_ScoreId = 10 + Reputation_SCORE_ID_OTHER Reputation_ScoreId = 99 +) + +// Enum value maps for Reputation_ScoreId. +var ( + Reputation_ScoreId_name = map[int32]string{ + 0: "SCORE_ID_UNKNOWN", + 1: "SCORE_ID_VERY_SAFE", + 2: "SCORE_ID_SAFE", + 3: "SCORE_ID_PROBABLY_SAFE", + 4: "SCORE_ID_LEANS_SAFE", + 5: "SCORE_ID_MAY_NOT_BE_SAFE", + 6: "SCORE_ID_EXERCISE_CAUTION", + 7: "SCORE_ID_SUSPICIOUS_RISKY", + 8: "SCORE_ID_POSSIBLY_MALICIOUS", + 9: "SCORE_ID_PROBABLY_MALICIOUS", + 10: "SCORE_ID_MALICIOUS", + 99: "SCORE_ID_OTHER", + } + Reputation_ScoreId_value = map[string]int32{ + "SCORE_ID_UNKNOWN": 0, + "SCORE_ID_VERY_SAFE": 1, + "SCORE_ID_SAFE": 2, + "SCORE_ID_PROBABLY_SAFE": 3, + "SCORE_ID_LEANS_SAFE": 4, + "SCORE_ID_MAY_NOT_BE_SAFE": 5, + "SCORE_ID_EXERCISE_CAUTION": 6, + "SCORE_ID_SUSPICIOUS_RISKY": 7, + "SCORE_ID_POSSIBLY_MALICIOUS": 8, + "SCORE_ID_PROBABLY_MALICIOUS": 9, + "SCORE_ID_MALICIOUS": 10, + "SCORE_ID_OTHER": 99, + } +) + +func (x Reputation_ScoreId) Enum() *Reputation_ScoreId { + p := new(Reputation_ScoreId) + *p = x + return p +} + +func (x Reputation_ScoreId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Reputation_ScoreId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[67].Descriptor() +} + +func (Reputation_ScoreId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[67] +} + +func (x Reputation_ScoreId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Reputation_ScoreId.Descriptor instead. +func (Reputation_ScoreId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{89, 0} +} + +type ResourceDetails_RoleId int32 + +const ( + ResourceDetails_ROLE_ID_UNKNOWN ResourceDetails_RoleId = 0 + ResourceDetails_ROLE_ID_TARGET ResourceDetails_RoleId = 1 + ResourceDetails_ROLE_ID_ACTOR ResourceDetails_RoleId = 2 + ResourceDetails_ROLE_ID_AFFECTED ResourceDetails_RoleId = 3 + ResourceDetails_ROLE_ID_RELATED ResourceDetails_RoleId = 4 + ResourceDetails_ROLE_ID_OTHER ResourceDetails_RoleId = 99 +) + +// Enum value maps for ResourceDetails_RoleId. +var ( + ResourceDetails_RoleId_name = map[int32]string{ + 0: "ROLE_ID_UNKNOWN", + 1: "ROLE_ID_TARGET", + 2: "ROLE_ID_ACTOR", + 3: "ROLE_ID_AFFECTED", + 4: "ROLE_ID_RELATED", + 99: "ROLE_ID_OTHER", + } + ResourceDetails_RoleId_value = map[string]int32{ + "ROLE_ID_UNKNOWN": 0, + "ROLE_ID_TARGET": 1, + "ROLE_ID_ACTOR": 2, + "ROLE_ID_AFFECTED": 3, + "ROLE_ID_RELATED": 4, + "ROLE_ID_OTHER": 99, + } +) + +func (x ResourceDetails_RoleId) Enum() *ResourceDetails_RoleId { + p := new(ResourceDetails_RoleId) + *p = x + return p +} + +func (x ResourceDetails_RoleId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ResourceDetails_RoleId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[68].Descriptor() +} + +func (ResourceDetails_RoleId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[68] +} + +func (x ResourceDetails_RoleId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ResourceDetails_RoleId.Descriptor instead. +func (ResourceDetails_RoleId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{91, 0} +} + +type Sbom_TypeId int32 + +const ( + Sbom_TYPE_ID_UNKNOWN Sbom_TypeId = 0 + Sbom_TYPE_ID_SPDX Sbom_TypeId = 1 + Sbom_TYPE_ID_CYCLONEDX Sbom_TypeId = 2 + Sbom_TYPE_ID_SWID Sbom_TypeId = 3 + Sbom_TYPE_ID_OTHER Sbom_TypeId = 99 +) + +// Enum value maps for Sbom_TypeId. +var ( + Sbom_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SPDX", + 2: "TYPE_ID_CYCLONEDX", + 3: "TYPE_ID_SWID", + 99: "TYPE_ID_OTHER", + } + Sbom_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SPDX": 1, + "TYPE_ID_CYCLONEDX": 2, + "TYPE_ID_SWID": 3, + "TYPE_ID_OTHER": 99, + } +) + +func (x Sbom_TypeId) Enum() *Sbom_TypeId { + p := new(Sbom_TypeId) + *p = x + return p +} + +func (x Sbom_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Sbom_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[69].Descriptor() +} + +func (Sbom_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[69] +} + +func (x Sbom_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Sbom_TypeId.Descriptor instead. +func (Sbom_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{95, 0} +} + +type Scim_AuthProtocolId int32 + +const ( + Scim_AUTH_PROTOCOL_ID_UNKNOWN Scim_AuthProtocolId = 0 + Scim_AUTH_PROTOCOL_ID_NTLM Scim_AuthProtocolId = 1 + Scim_AUTH_PROTOCOL_ID_KERBEROS Scim_AuthProtocolId = 2 + Scim_AUTH_PROTOCOL_ID_DIGEST Scim_AuthProtocolId = 3 + Scim_AUTH_PROTOCOL_ID_OPENID Scim_AuthProtocolId = 4 + Scim_AUTH_PROTOCOL_ID_SAML Scim_AuthProtocolId = 5 + Scim_AUTH_PROTOCOL_ID_OAUTH_2_0 Scim_AuthProtocolId = 6 + Scim_AUTH_PROTOCOL_ID_PAP Scim_AuthProtocolId = 7 + Scim_AUTH_PROTOCOL_ID_CHAP Scim_AuthProtocolId = 8 + Scim_AUTH_PROTOCOL_ID_EAP Scim_AuthProtocolId = 9 + Scim_AUTH_PROTOCOL_ID_RADIUS Scim_AuthProtocolId = 10 + Scim_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Scim_AuthProtocolId = 11 + Scim_AUTH_PROTOCOL_ID_LDAP Scim_AuthProtocolId = 12 + Scim_AUTH_PROTOCOL_ID_OTHER Scim_AuthProtocolId = 99 +) + +// Enum value maps for Scim_AuthProtocolId. +var ( + Scim_AuthProtocolId_name = map[int32]string{ + 0: "AUTH_PROTOCOL_ID_UNKNOWN", + 1: "AUTH_PROTOCOL_ID_NTLM", + 2: "AUTH_PROTOCOL_ID_KERBEROS", + 3: "AUTH_PROTOCOL_ID_DIGEST", + 4: "AUTH_PROTOCOL_ID_OPENID", + 5: "AUTH_PROTOCOL_ID_SAML", + 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", + 7: "AUTH_PROTOCOL_ID_PAP", + 8: "AUTH_PROTOCOL_ID_CHAP", + 9: "AUTH_PROTOCOL_ID_EAP", + 10: "AUTH_PROTOCOL_ID_RADIUS", + 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", + 12: "AUTH_PROTOCOL_ID_LDAP", + 99: "AUTH_PROTOCOL_ID_OTHER", + } + Scim_AuthProtocolId_value = map[string]int32{ + "AUTH_PROTOCOL_ID_UNKNOWN": 0, + "AUTH_PROTOCOL_ID_NTLM": 1, + "AUTH_PROTOCOL_ID_KERBEROS": 2, + "AUTH_PROTOCOL_ID_DIGEST": 3, + "AUTH_PROTOCOL_ID_OPENID": 4, + "AUTH_PROTOCOL_ID_SAML": 5, + "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, + "AUTH_PROTOCOL_ID_PAP": 7, + "AUTH_PROTOCOL_ID_CHAP": 8, + "AUTH_PROTOCOL_ID_EAP": 9, + "AUTH_PROTOCOL_ID_RADIUS": 10, + "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, + "AUTH_PROTOCOL_ID_LDAP": 12, + "AUTH_PROTOCOL_ID_OTHER": 99, + } +) + +func (x Scim_AuthProtocolId) Enum() *Scim_AuthProtocolId { + p := new(Scim_AuthProtocolId) + *p = x + return p +} + +func (x Scim_AuthProtocolId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Scim_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[70].Descriptor() +} + +func (Scim_AuthProtocolId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[70] +} + +func (x Scim_AuthProtocolId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Scim_AuthProtocolId.Descriptor instead. +func (Scim_AuthProtocolId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{96, 0} +} + +type Scim_StateId int32 + +const ( + Scim_STATE_ID_UNKNOWN Scim_StateId = 0 + Scim_STATE_ID_PENDING Scim_StateId = 1 + Scim_STATE_ID_ACTIVE Scim_StateId = 2 + Scim_STATE_ID_FAILED Scim_StateId = 3 + Scim_STATE_ID_DELETED Scim_StateId = 4 + Scim_STATE_ID_OTHER Scim_StateId = 99 +) + +// Enum value maps for Scim_StateId. +var ( + Scim_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_PENDING", + 2: "STATE_ID_ACTIVE", + 3: "STATE_ID_FAILED", + 4: "STATE_ID_DELETED", + 99: "STATE_ID_OTHER", + } + Scim_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_PENDING": 1, + "STATE_ID_ACTIVE": 2, + "STATE_ID_FAILED": 3, + "STATE_ID_DELETED": 4, + "STATE_ID_OTHER": 99, + } +) + +func (x Scim_StateId) Enum() *Scim_StateId { + p := new(Scim_StateId) + *p = x + return p +} + +func (x Scim_StateId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Scim_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[71].Descriptor() +} + +func (Scim_StateId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[71] +} + +func (x Scim_StateId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Scim_StateId.Descriptor instead. +func (Scim_StateId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{96, 1} +} + +type Script_TypeId int32 + +const ( + Script_TYPE_ID_UNKNOWN Script_TypeId = 0 + Script_TYPE_ID_WINDOWS_COMMAND_PROMPT Script_TypeId = 1 + Script_TYPE_ID_POWERSHELL Script_TypeId = 2 + Script_TYPE_ID_PYTHON Script_TypeId = 3 + Script_TYPE_ID_JAVASCRIPT Script_TypeId = 4 + Script_TYPE_ID_VBSCRIPT Script_TypeId = 5 + Script_TYPE_ID_UNIX_SHELL Script_TypeId = 6 + Script_TYPE_ID_VBA Script_TypeId = 7 + Script_TYPE_ID_OTHER Script_TypeId = 99 +) + +// Enum value maps for Script_TypeId. +var ( + Script_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_WINDOWS_COMMAND_PROMPT", + 2: "TYPE_ID_POWERSHELL", + 3: "TYPE_ID_PYTHON", + 4: "TYPE_ID_JAVASCRIPT", + 5: "TYPE_ID_VBSCRIPT", + 6: "TYPE_ID_UNIX_SHELL", + 7: "TYPE_ID_VBA", + 99: "TYPE_ID_OTHER", + } + Script_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_WINDOWS_COMMAND_PROMPT": 1, + "TYPE_ID_POWERSHELL": 2, + "TYPE_ID_PYTHON": 3, + "TYPE_ID_JAVASCRIPT": 4, + "TYPE_ID_VBSCRIPT": 5, + "TYPE_ID_UNIX_SHELL": 6, + "TYPE_ID_VBA": 7, + "TYPE_ID_OTHER": 99, + } +) + +func (x Script_TypeId) Enum() *Script_TypeId { + p := new(Script_TypeId) + *p = x + return p +} + +func (x Script_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Script_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[72].Descriptor() +} + +func (Script_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[72] +} + +func (x Script_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Script_TypeId.Descriptor instead. +func (Script_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{97, 0} +} + +type SoftwareComponent_RelationshipId int32 + +const ( + SoftwareComponent_RELATIONSHIP_ID_UNKNOWN SoftwareComponent_RelationshipId = 0 + SoftwareComponent_RELATIONSHIP_ID_DEPENDS_ON SoftwareComponent_RelationshipId = 1 + SoftwareComponent_RELATIONSHIP_ID_OTHER SoftwareComponent_RelationshipId = 99 +) + +// Enum value maps for SoftwareComponent_RelationshipId. +var ( + SoftwareComponent_RelationshipId_name = map[int32]string{ + 0: "RELATIONSHIP_ID_UNKNOWN", + 1: "RELATIONSHIP_ID_DEPENDS_ON", + 99: "RELATIONSHIP_ID_OTHER", + } + SoftwareComponent_RelationshipId_value = map[string]int32{ + "RELATIONSHIP_ID_UNKNOWN": 0, + "RELATIONSHIP_ID_DEPENDS_ON": 1, + "RELATIONSHIP_ID_OTHER": 99, + } +) + +func (x SoftwareComponent_RelationshipId) Enum() *SoftwareComponent_RelationshipId { + p := new(SoftwareComponent_RelationshipId) + *p = x + return p +} + +func (x SoftwareComponent_RelationshipId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (SoftwareComponent_RelationshipId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[73].Descriptor() +} + +func (SoftwareComponent_RelationshipId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[73] +} + +func (x SoftwareComponent_RelationshipId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use SoftwareComponent_RelationshipId.Descriptor instead. +func (SoftwareComponent_RelationshipId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{100, 0} +} + +type SoftwareComponent_TypeId int32 + +const ( + SoftwareComponent_TYPE_ID_UNKNOWN SoftwareComponent_TypeId = 0 + SoftwareComponent_TYPE_ID_FRAMEWORK SoftwareComponent_TypeId = 1 + SoftwareComponent_TYPE_ID_LIBRARY SoftwareComponent_TypeId = 2 + SoftwareComponent_TYPE_ID_OPERATING_SYSTEM SoftwareComponent_TypeId = 3 + SoftwareComponent_TYPE_ID_OTHER SoftwareComponent_TypeId = 99 +) + +// Enum value maps for SoftwareComponent_TypeId. +var ( + SoftwareComponent_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_FRAMEWORK", + 2: "TYPE_ID_LIBRARY", + 3: "TYPE_ID_OPERATING_SYSTEM", + 99: "TYPE_ID_OTHER", + } + SoftwareComponent_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_FRAMEWORK": 1, + "TYPE_ID_LIBRARY": 2, + "TYPE_ID_OPERATING_SYSTEM": 3, + "TYPE_ID_OTHER": 99, + } +) + +func (x SoftwareComponent_TypeId) Enum() *SoftwareComponent_TypeId { + p := new(SoftwareComponent_TypeId) + *p = x + return p +} + +func (x SoftwareComponent_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (SoftwareComponent_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[74].Descriptor() +} + +func (SoftwareComponent_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[74] +} + +func (x SoftwareComponent_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use SoftwareComponent_TypeId.Descriptor instead. +func (SoftwareComponent_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{100, 1} +} + +type Sso_AuthProtocolId int32 + +const ( + Sso_AUTH_PROTOCOL_ID_UNKNOWN Sso_AuthProtocolId = 0 + Sso_AUTH_PROTOCOL_ID_NTLM Sso_AuthProtocolId = 1 + Sso_AUTH_PROTOCOL_ID_KERBEROS Sso_AuthProtocolId = 2 + Sso_AUTH_PROTOCOL_ID_DIGEST Sso_AuthProtocolId = 3 + Sso_AUTH_PROTOCOL_ID_OPENID Sso_AuthProtocolId = 4 + Sso_AUTH_PROTOCOL_ID_SAML Sso_AuthProtocolId = 5 + Sso_AUTH_PROTOCOL_ID_OAUTH_2_0 Sso_AuthProtocolId = 6 + Sso_AUTH_PROTOCOL_ID_PAP Sso_AuthProtocolId = 7 + Sso_AUTH_PROTOCOL_ID_CHAP Sso_AuthProtocolId = 8 + Sso_AUTH_PROTOCOL_ID_EAP Sso_AuthProtocolId = 9 + Sso_AUTH_PROTOCOL_ID_RADIUS Sso_AuthProtocolId = 10 + Sso_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Sso_AuthProtocolId = 11 + Sso_AUTH_PROTOCOL_ID_LDAP Sso_AuthProtocolId = 12 + Sso_AUTH_PROTOCOL_ID_OTHER Sso_AuthProtocolId = 99 +) + +// Enum value maps for Sso_AuthProtocolId. +var ( + Sso_AuthProtocolId_name = map[int32]string{ + 0: "AUTH_PROTOCOL_ID_UNKNOWN", + 1: "AUTH_PROTOCOL_ID_NTLM", + 2: "AUTH_PROTOCOL_ID_KERBEROS", + 3: "AUTH_PROTOCOL_ID_DIGEST", + 4: "AUTH_PROTOCOL_ID_OPENID", + 5: "AUTH_PROTOCOL_ID_SAML", + 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", + 7: "AUTH_PROTOCOL_ID_PAP", + 8: "AUTH_PROTOCOL_ID_CHAP", + 9: "AUTH_PROTOCOL_ID_EAP", + 10: "AUTH_PROTOCOL_ID_RADIUS", + 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", + 12: "AUTH_PROTOCOL_ID_LDAP", + 99: "AUTH_PROTOCOL_ID_OTHER", + } + Sso_AuthProtocolId_value = map[string]int32{ + "AUTH_PROTOCOL_ID_UNKNOWN": 0, + "AUTH_PROTOCOL_ID_NTLM": 1, + "AUTH_PROTOCOL_ID_KERBEROS": 2, + "AUTH_PROTOCOL_ID_DIGEST": 3, + "AUTH_PROTOCOL_ID_OPENID": 4, + "AUTH_PROTOCOL_ID_SAML": 5, + "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, + "AUTH_PROTOCOL_ID_PAP": 7, + "AUTH_PROTOCOL_ID_CHAP": 8, + "AUTH_PROTOCOL_ID_EAP": 9, + "AUTH_PROTOCOL_ID_RADIUS": 10, + "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, + "AUTH_PROTOCOL_ID_LDAP": 12, + "AUTH_PROTOCOL_ID_OTHER": 99, + } +) + +func (x Sso_AuthProtocolId) Enum() *Sso_AuthProtocolId { + p := new(Sso_AuthProtocolId) + *p = x + return p +} + +func (x Sso_AuthProtocolId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Sso_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[75].Descriptor() +} + +func (Sso_AuthProtocolId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[75] +} + +func (x Sso_AuthProtocolId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Sso_AuthProtocolId.Descriptor instead. +func (Sso_AuthProtocolId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{102, 0} +} + +type ThreatActor_TypeId int32 + +const ( + ThreatActor_TYPE_ID_UNKNOWN ThreatActor_TypeId = 0 + ThreatActor_TYPE_ID_NATION_STATE ThreatActor_TypeId = 1 + ThreatActor_TYPE_ID_CYBERCRIMINAL ThreatActor_TypeId = 2 + ThreatActor_TYPE_ID_HACKTIVISTS ThreatActor_TypeId = 3 + ThreatActor_TYPE_ID_INSIDER ThreatActor_TypeId = 4 + ThreatActor_TYPE_ID_OTHER ThreatActor_TypeId = 99 +) + +// Enum value maps for ThreatActor_TypeId. +var ( + ThreatActor_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_NATION_STATE", + 2: "TYPE_ID_CYBERCRIMINAL", + 3: "TYPE_ID_HACKTIVISTS", + 4: "TYPE_ID_INSIDER", + 99: "TYPE_ID_OTHER", + } + ThreatActor_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_NATION_STATE": 1, + "TYPE_ID_CYBERCRIMINAL": 2, + "TYPE_ID_HACKTIVISTS": 3, + "TYPE_ID_INSIDER": 4, + "TYPE_ID_OTHER": 99, + } +) + +func (x ThreatActor_TypeId) Enum() *ThreatActor_TypeId { + p := new(ThreatActor_TypeId) + *p = x + return p +} + +func (x ThreatActor_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ThreatActor_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[76].Descriptor() +} + +func (ThreatActor_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[76] +} + +func (x ThreatActor_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ThreatActor_TypeId.Descriptor instead. +func (ThreatActor_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{106, 0} +} + +type Timespan_TypeId int32 + +const ( + Timespan_TYPE_ID_UNKNOWN Timespan_TypeId = 0 + Timespan_TYPE_ID_MILLISECONDS Timespan_TypeId = 1 + Timespan_TYPE_ID_SECONDS Timespan_TypeId = 2 + Timespan_TYPE_ID_MINUTES Timespan_TypeId = 3 + Timespan_TYPE_ID_HOURS Timespan_TypeId = 4 + Timespan_TYPE_ID_DAYS Timespan_TypeId = 5 + Timespan_TYPE_ID_WEEKS Timespan_TypeId = 6 + Timespan_TYPE_ID_MONTHS Timespan_TypeId = 7 + Timespan_TYPE_ID_YEARS Timespan_TypeId = 8 + Timespan_TYPE_ID_TIME_INTERVAL Timespan_TypeId = 9 + Timespan_TYPE_ID_OTHER Timespan_TypeId = 99 +) + +// Enum value maps for Timespan_TypeId. +var ( + Timespan_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_MILLISECONDS", + 2: "TYPE_ID_SECONDS", + 3: "TYPE_ID_MINUTES", + 4: "TYPE_ID_HOURS", + 5: "TYPE_ID_DAYS", + 6: "TYPE_ID_WEEKS", + 7: "TYPE_ID_MONTHS", + 8: "TYPE_ID_YEARS", + 9: "TYPE_ID_TIME_INTERVAL", + 99: "TYPE_ID_OTHER", + } + Timespan_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_MILLISECONDS": 1, + "TYPE_ID_SECONDS": 2, + "TYPE_ID_MINUTES": 3, + "TYPE_ID_HOURS": 4, + "TYPE_ID_DAYS": 5, + "TYPE_ID_WEEKS": 6, + "TYPE_ID_MONTHS": 7, + "TYPE_ID_YEARS": 8, + "TYPE_ID_TIME_INTERVAL": 9, + "TYPE_ID_OTHER": 99, + } +) + +func (x Timespan_TypeId) Enum() *Timespan_TypeId { + p := new(Timespan_TypeId) + *p = x + return p +} + +func (x Timespan_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Timespan_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[77].Descriptor() +} + +func (Timespan_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[77] +} + +func (x Timespan_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Timespan_TypeId.Descriptor instead. +func (Timespan_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{107, 0} +} + +type Token_TypeId int32 + +const ( + Token_TYPE_ID_UNKNOWN Token_TypeId = 0 + Token_TYPE_ID_TICKET_GRANTING_TICKET Token_TypeId = 1 + Token_TYPE_ID_SERVICE_TICKET Token_TypeId = 2 + Token_TYPE_ID_IDENTITY_TOKEN Token_TypeId = 3 + Token_TYPE_ID_REFRESH_TOKEN Token_TypeId = 4 + Token_TYPE_ID_SAML_ASSERTION Token_TypeId = 5 + Token_TYPE_ID_CLIENT_TOKEN Token_TypeId = 6 + Token_TYPE_ID_API_TOKEN Token_TypeId = 7 + Token_TYPE_ID_OTHER Token_TypeId = 99 +) + +// Enum value maps for Token_TypeId. +var ( + Token_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_TICKET_GRANTING_TICKET", + 2: "TYPE_ID_SERVICE_TICKET", + 3: "TYPE_ID_IDENTITY_TOKEN", + 4: "TYPE_ID_REFRESH_TOKEN", + 5: "TYPE_ID_SAML_ASSERTION", + 6: "TYPE_ID_CLIENT_TOKEN", + 7: "TYPE_ID_API_TOKEN", + 99: "TYPE_ID_OTHER", + } + Token_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_TICKET_GRANTING_TICKET": 1, + "TYPE_ID_SERVICE_TICKET": 2, + "TYPE_ID_IDENTITY_TOKEN": 3, + "TYPE_ID_REFRESH_TOKEN": 4, + "TYPE_ID_SAML_ASSERTION": 5, + "TYPE_ID_CLIENT_TOKEN": 6, + "TYPE_ID_API_TOKEN": 7, + "TYPE_ID_OTHER": 99, + } +) + +func (x Token_TypeId) Enum() *Token_TypeId { + p := new(Token_TypeId) + *p = x + return p +} + +func (x Token_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Token_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[78].Descriptor() +} + +func (Token_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[78] +} + +func (x Token_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Token_TypeId.Descriptor instead. +func (Token_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{108, 0} +} + +type Url_CategoryIds int32 + +const ( + Url_CATEGORY_IDS_UNKNOWN Url_CategoryIds = 0 + Url_CATEGORY_IDS_ADULT_MATURE_CONTENT Url_CategoryIds = 1 + Url_CATEGORY_IDS_PORNOGRAPHY Url_CategoryIds = 3 + Url_CATEGORY_IDS_SEX_EDUCATION Url_CategoryIds = 4 + Url_CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT Url_CategoryIds = 5 + Url_CATEGORY_IDS_NUDITY Url_CategoryIds = 6 + Url_CATEGORY_IDS_EXTREME Url_CategoryIds = 7 + Url_CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL Url_CategoryIds = 9 + Url_CATEGORY_IDS_GAMBLING Url_CategoryIds = 11 + Url_CATEGORY_IDS_VIOLENCE_HATE_RACISM Url_CategoryIds = 14 + Url_CATEGORY_IDS_WEAPONS Url_CategoryIds = 15 + Url_CATEGORY_IDS_ABORTION Url_CategoryIds = 16 + Url_CATEGORY_IDS_HACKING Url_CategoryIds = 17 + Url_CATEGORY_IDS_PHISHING Url_CategoryIds = 18 + Url_CATEGORY_IDS_ENTERTAINMENT Url_CategoryIds = 20 + Url_CATEGORY_IDS_BUSINESS_ECONOMY Url_CategoryIds = 21 + Url_CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF Url_CategoryIds = 22 + Url_CATEGORY_IDS_ALCOHOL Url_CategoryIds = 23 + Url_CATEGORY_IDS_TOBACCO Url_CategoryIds = 24 + Url_CATEGORY_IDS_CONTROLLED_SUBSTANCES Url_CategoryIds = 25 + Url_CATEGORY_IDS_CHILD_PORNOGRAPHY Url_CategoryIds = 26 + Url_CATEGORY_IDS_EDUCATION Url_CategoryIds = 27 + Url_CATEGORY_IDS_CHARITABLE_ORGANIZATIONS Url_CategoryIds = 29 + Url_CATEGORY_IDS_ART_CULTURE Url_CategoryIds = 30 + Url_CATEGORY_IDS_FINANCIAL_SERVICES Url_CategoryIds = 31 + Url_CATEGORY_IDS_BROKERAGE_TRADING Url_CategoryIds = 32 + Url_CATEGORY_IDS_GAMES Url_CategoryIds = 33 + Url_CATEGORY_IDS_GOVERNMENT_LEGAL Url_CategoryIds = 34 + Url_CATEGORY_IDS_MILITARY Url_CategoryIds = 35 + Url_CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY Url_CategoryIds = 36 + Url_CATEGORY_IDS_HEALTH Url_CategoryIds = 37 + Url_CATEGORY_IDS_TECHNOLOGY_INTERNET Url_CategoryIds = 38 + Url_CATEGORY_IDS_SEARCH_ENGINES_PORTALS Url_CategoryIds = 40 + Url_CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS Url_CategoryIds = 43 + Url_CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS Url_CategoryIds = 44 + Url_CATEGORY_IDS_JOB_SEARCH_CAREERS Url_CategoryIds = 45 + Url_CATEGORY_IDS_NEWS_MEDIA Url_CategoryIds = 46 + Url_CATEGORY_IDS_PERSONALS_DATING Url_CategoryIds = 47 + Url_CATEGORY_IDS_REFERENCE Url_CategoryIds = 49 + Url_CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT Url_CategoryIds = 50 + Url_CATEGORY_IDS_CHAT_IM_SMS Url_CategoryIds = 51 + Url_CATEGORY_IDS_EMAIL Url_CategoryIds = 52 + Url_CATEGORY_IDS_NEWSGROUPS_FORUMS Url_CategoryIds = 53 + Url_CATEGORY_IDS_RELIGION Url_CategoryIds = 54 + Url_CATEGORY_IDS_SOCIAL_NETWORKING Url_CategoryIds = 55 + Url_CATEGORY_IDS_FILE_STORAGE_SHARING Url_CategoryIds = 56 + Url_CATEGORY_IDS_REMOTE_ACCESS_TOOLS Url_CategoryIds = 57 + Url_CATEGORY_IDS_SHOPPING Url_CategoryIds = 58 + Url_CATEGORY_IDS_AUCTIONS Url_CategoryIds = 59 + Url_CATEGORY_IDS_REAL_ESTATE Url_CategoryIds = 60 + Url_CATEGORY_IDS_SOCIETY_DAILY_LIVING Url_CategoryIds = 61 + Url_CATEGORY_IDS_PERSONAL_SITES Url_CategoryIds = 63 + Url_CATEGORY_IDS_RESTAURANTS_DINING_FOOD Url_CategoryIds = 64 + Url_CATEGORY_IDS_SPORTS_RECREATION Url_CategoryIds = 65 + Url_CATEGORY_IDS_TRAVEL Url_CategoryIds = 66 + Url_CATEGORY_IDS_VEHICLES Url_CategoryIds = 67 + Url_CATEGORY_IDS_HUMOR_JOKES Url_CategoryIds = 68 + Url_CATEGORY_IDS_SOFTWARE_DOWNLOADS Url_CategoryIds = 71 + Url_CATEGORY_IDS_PEER_TO_PEER_P2P Url_CategoryIds = 83 + Url_CATEGORY_IDS_AUDIO_VIDEO_CLIPS Url_CategoryIds = 84 + Url_CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS Url_CategoryIds = 85 + Url_CATEGORY_IDS_PROXY_AVOIDANCE Url_CategoryIds = 86 + Url_CATEGORY_IDS_FOR_KIDS Url_CategoryIds = 87 + Url_CATEGORY_IDS_WEB_ADS_ANALYTICS Url_CategoryIds = 88 + Url_CATEGORY_IDS_WEB_HOSTING Url_CategoryIds = 89 + Url_CATEGORY_IDS_UNCATEGORIZED Url_CategoryIds = 90 + Url_CATEGORY_IDS_SUSPICIOUS Url_CategoryIds = 92 + Url_CATEGORY_IDS_SEXUAL_EXPRESSION Url_CategoryIds = 93 + Url_CATEGORY_IDS_TRANSLATION Url_CategoryIds = 95 + Url_CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE Url_CategoryIds = 96 + Url_CATEGORY_IDS_CONTENT_SERVERS Url_CategoryIds = 97 + Url_CATEGORY_IDS_PLACEHOLDERS Url_CategoryIds = 98 + Url_CATEGORY_IDS_OTHER Url_CategoryIds = 99 + Url_CATEGORY_IDS_SPAM Url_CategoryIds = 101 + Url_CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE Url_CategoryIds = 102 + Url_CATEGORY_IDS_DYNAMIC_DNS_HOST Url_CategoryIds = 103 + Url_CATEGORY_IDS_E_CARD_INVITATIONS Url_CategoryIds = 106 + Url_CATEGORY_IDS_INFORMATIONAL Url_CategoryIds = 107 + Url_CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY Url_CategoryIds = 108 + Url_CATEGORY_IDS_INTERNET_CONNECTED_DEVICES Url_CategoryIds = 109 + Url_CATEGORY_IDS_INTERNET_TELEPHONY Url_CategoryIds = 110 + Url_CATEGORY_IDS_ONLINE_MEETINGS Url_CategoryIds = 111 + Url_CATEGORY_IDS_MEDIA_SHARING Url_CategoryIds = 112 + Url_CATEGORY_IDS_RADIO_AUDIO_STREAMS Url_CategoryIds = 113 + Url_CATEGORY_IDS_TV_VIDEO_STREAMS Url_CategoryIds = 114 + Url_CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS Url_CategoryIds = 118 + Url_CATEGORY_IDS_MARIJUANA Url_CategoryIds = 121 +) + +// Enum value maps for Url_CategoryIds. +var ( + Url_CategoryIds_name = map[int32]string{ + 0: "CATEGORY_IDS_UNKNOWN", + 1: "CATEGORY_IDS_ADULT_MATURE_CONTENT", + 3: "CATEGORY_IDS_PORNOGRAPHY", + 4: "CATEGORY_IDS_SEX_EDUCATION", + 5: "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT", + 6: "CATEGORY_IDS_NUDITY", + 7: "CATEGORY_IDS_EXTREME", + 9: "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL", + 11: "CATEGORY_IDS_GAMBLING", + 14: "CATEGORY_IDS_VIOLENCE_HATE_RACISM", + 15: "CATEGORY_IDS_WEAPONS", + 16: "CATEGORY_IDS_ABORTION", + 17: "CATEGORY_IDS_HACKING", + 18: "CATEGORY_IDS_PHISHING", + 20: "CATEGORY_IDS_ENTERTAINMENT", + 21: "CATEGORY_IDS_BUSINESS_ECONOMY", + 22: "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF", + 23: "CATEGORY_IDS_ALCOHOL", + 24: "CATEGORY_IDS_TOBACCO", + 25: "CATEGORY_IDS_CONTROLLED_SUBSTANCES", + 26: "CATEGORY_IDS_CHILD_PORNOGRAPHY", + 27: "CATEGORY_IDS_EDUCATION", + 29: "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS", + 30: "CATEGORY_IDS_ART_CULTURE", + 31: "CATEGORY_IDS_FINANCIAL_SERVICES", + 32: "CATEGORY_IDS_BROKERAGE_TRADING", + 33: "CATEGORY_IDS_GAMES", + 34: "CATEGORY_IDS_GOVERNMENT_LEGAL", + 35: "CATEGORY_IDS_MILITARY", + 36: "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY", + 37: "CATEGORY_IDS_HEALTH", + 38: "CATEGORY_IDS_TECHNOLOGY_INTERNET", + 40: "CATEGORY_IDS_SEARCH_ENGINES_PORTALS", + 43: "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS", + 44: "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS", + 45: "CATEGORY_IDS_JOB_SEARCH_CAREERS", + 46: "CATEGORY_IDS_NEWS_MEDIA", + 47: "CATEGORY_IDS_PERSONALS_DATING", + 49: "CATEGORY_IDS_REFERENCE", + 50: "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT", + 51: "CATEGORY_IDS_CHAT_IM_SMS", + 52: "CATEGORY_IDS_EMAIL", + 53: "CATEGORY_IDS_NEWSGROUPS_FORUMS", + 54: "CATEGORY_IDS_RELIGION", + 55: "CATEGORY_IDS_SOCIAL_NETWORKING", + 56: "CATEGORY_IDS_FILE_STORAGE_SHARING", + 57: "CATEGORY_IDS_REMOTE_ACCESS_TOOLS", + 58: "CATEGORY_IDS_SHOPPING", + 59: "CATEGORY_IDS_AUCTIONS", + 60: "CATEGORY_IDS_REAL_ESTATE", + 61: "CATEGORY_IDS_SOCIETY_DAILY_LIVING", + 63: "CATEGORY_IDS_PERSONAL_SITES", + 64: "CATEGORY_IDS_RESTAURANTS_DINING_FOOD", + 65: "CATEGORY_IDS_SPORTS_RECREATION", + 66: "CATEGORY_IDS_TRAVEL", + 67: "CATEGORY_IDS_VEHICLES", + 68: "CATEGORY_IDS_HUMOR_JOKES", + 71: "CATEGORY_IDS_SOFTWARE_DOWNLOADS", + 83: "CATEGORY_IDS_PEER_TO_PEER_P2P", + 84: "CATEGORY_IDS_AUDIO_VIDEO_CLIPS", + 85: "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS", + 86: "CATEGORY_IDS_PROXY_AVOIDANCE", + 87: "CATEGORY_IDS_FOR_KIDS", + 88: "CATEGORY_IDS_WEB_ADS_ANALYTICS", + 89: "CATEGORY_IDS_WEB_HOSTING", + 90: "CATEGORY_IDS_UNCATEGORIZED", + 92: "CATEGORY_IDS_SUSPICIOUS", + 93: "CATEGORY_IDS_SEXUAL_EXPRESSION", + 95: "CATEGORY_IDS_TRANSLATION", + 96: "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE", + 97: "CATEGORY_IDS_CONTENT_SERVERS", + 98: "CATEGORY_IDS_PLACEHOLDERS", + 99: "CATEGORY_IDS_OTHER", + 101: "CATEGORY_IDS_SPAM", + 102: "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE", + 103: "CATEGORY_IDS_DYNAMIC_DNS_HOST", + 106: "CATEGORY_IDS_E_CARD_INVITATIONS", + 107: "CATEGORY_IDS_INFORMATIONAL", + 108: "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY", + 109: "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES", + 110: "CATEGORY_IDS_INTERNET_TELEPHONY", + 111: "CATEGORY_IDS_ONLINE_MEETINGS", + 112: "CATEGORY_IDS_MEDIA_SHARING", + 113: "CATEGORY_IDS_RADIO_AUDIO_STREAMS", + 114: "CATEGORY_IDS_TV_VIDEO_STREAMS", + 118: "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS", + 121: "CATEGORY_IDS_MARIJUANA", + } + Url_CategoryIds_value = map[string]int32{ + "CATEGORY_IDS_UNKNOWN": 0, + "CATEGORY_IDS_ADULT_MATURE_CONTENT": 1, + "CATEGORY_IDS_PORNOGRAPHY": 3, + "CATEGORY_IDS_SEX_EDUCATION": 4, + "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT": 5, + "CATEGORY_IDS_NUDITY": 6, + "CATEGORY_IDS_EXTREME": 7, + "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL": 9, + "CATEGORY_IDS_GAMBLING": 11, + "CATEGORY_IDS_VIOLENCE_HATE_RACISM": 14, + "CATEGORY_IDS_WEAPONS": 15, + "CATEGORY_IDS_ABORTION": 16, + "CATEGORY_IDS_HACKING": 17, + "CATEGORY_IDS_PHISHING": 18, + "CATEGORY_IDS_ENTERTAINMENT": 20, + "CATEGORY_IDS_BUSINESS_ECONOMY": 21, + "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF": 22, + "CATEGORY_IDS_ALCOHOL": 23, + "CATEGORY_IDS_TOBACCO": 24, + "CATEGORY_IDS_CONTROLLED_SUBSTANCES": 25, + "CATEGORY_IDS_CHILD_PORNOGRAPHY": 26, + "CATEGORY_IDS_EDUCATION": 27, + "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS": 29, + "CATEGORY_IDS_ART_CULTURE": 30, + "CATEGORY_IDS_FINANCIAL_SERVICES": 31, + "CATEGORY_IDS_BROKERAGE_TRADING": 32, + "CATEGORY_IDS_GAMES": 33, + "CATEGORY_IDS_GOVERNMENT_LEGAL": 34, + "CATEGORY_IDS_MILITARY": 35, + "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY": 36, + "CATEGORY_IDS_HEALTH": 37, + "CATEGORY_IDS_TECHNOLOGY_INTERNET": 38, + "CATEGORY_IDS_SEARCH_ENGINES_PORTALS": 40, + "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS": 43, + "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS": 44, + "CATEGORY_IDS_JOB_SEARCH_CAREERS": 45, + "CATEGORY_IDS_NEWS_MEDIA": 46, + "CATEGORY_IDS_PERSONALS_DATING": 47, + "CATEGORY_IDS_REFERENCE": 49, + "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT": 50, + "CATEGORY_IDS_CHAT_IM_SMS": 51, + "CATEGORY_IDS_EMAIL": 52, + "CATEGORY_IDS_NEWSGROUPS_FORUMS": 53, + "CATEGORY_IDS_RELIGION": 54, + "CATEGORY_IDS_SOCIAL_NETWORKING": 55, + "CATEGORY_IDS_FILE_STORAGE_SHARING": 56, + "CATEGORY_IDS_REMOTE_ACCESS_TOOLS": 57, + "CATEGORY_IDS_SHOPPING": 58, + "CATEGORY_IDS_AUCTIONS": 59, + "CATEGORY_IDS_REAL_ESTATE": 60, + "CATEGORY_IDS_SOCIETY_DAILY_LIVING": 61, + "CATEGORY_IDS_PERSONAL_SITES": 63, + "CATEGORY_IDS_RESTAURANTS_DINING_FOOD": 64, + "CATEGORY_IDS_SPORTS_RECREATION": 65, + "CATEGORY_IDS_TRAVEL": 66, + "CATEGORY_IDS_VEHICLES": 67, + "CATEGORY_IDS_HUMOR_JOKES": 68, + "CATEGORY_IDS_SOFTWARE_DOWNLOADS": 71, + "CATEGORY_IDS_PEER_TO_PEER_P2P": 83, + "CATEGORY_IDS_AUDIO_VIDEO_CLIPS": 84, + "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS": 85, + "CATEGORY_IDS_PROXY_AVOIDANCE": 86, + "CATEGORY_IDS_FOR_KIDS": 87, + "CATEGORY_IDS_WEB_ADS_ANALYTICS": 88, + "CATEGORY_IDS_WEB_HOSTING": 89, + "CATEGORY_IDS_UNCATEGORIZED": 90, + "CATEGORY_IDS_SUSPICIOUS": 92, + "CATEGORY_IDS_SEXUAL_EXPRESSION": 93, + "CATEGORY_IDS_TRANSLATION": 95, + "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE": 96, + "CATEGORY_IDS_CONTENT_SERVERS": 97, + "CATEGORY_IDS_PLACEHOLDERS": 98, + "CATEGORY_IDS_OTHER": 99, + "CATEGORY_IDS_SPAM": 101, + "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE": 102, + "CATEGORY_IDS_DYNAMIC_DNS_HOST": 103, + "CATEGORY_IDS_E_CARD_INVITATIONS": 106, + "CATEGORY_IDS_INFORMATIONAL": 107, + "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY": 108, + "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES": 109, + "CATEGORY_IDS_INTERNET_TELEPHONY": 110, + "CATEGORY_IDS_ONLINE_MEETINGS": 111, + "CATEGORY_IDS_MEDIA_SHARING": 112, + "CATEGORY_IDS_RADIO_AUDIO_STREAMS": 113, + "CATEGORY_IDS_TV_VIDEO_STREAMS": 114, + "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS": 118, + "CATEGORY_IDS_MARIJUANA": 121, + } +) + +func (x Url_CategoryIds) Enum() *Url_CategoryIds { + p := new(Url_CategoryIds) + *p = x + return p +} + +func (x Url_CategoryIds) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Url_CategoryIds) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[79].Descriptor() +} + +func (Url_CategoryIds) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[79] +} + +func (x Url_CategoryIds) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Url_CategoryIds.Descriptor instead. +func (Url_CategoryIds) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{111, 0} +} + +type User_RiskLevelId int32 + +const ( + User_RISK_LEVEL_ID_INFO User_RiskLevelId = 0 + User_RISK_LEVEL_ID_LOW User_RiskLevelId = 1 + User_RISK_LEVEL_ID_MEDIUM User_RiskLevelId = 2 + User_RISK_LEVEL_ID_HIGH User_RiskLevelId = 3 + User_RISK_LEVEL_ID_CRITICAL User_RiskLevelId = 4 + User_RISK_LEVEL_ID_OTHER User_RiskLevelId = 99 +) + +// Enum value maps for User_RiskLevelId. +var ( + User_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + User_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x User_RiskLevelId) Enum() *User_RiskLevelId { + p := new(User_RiskLevelId) + *p = x + return p +} + +func (x User_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (User_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[80].Descriptor() +} + +func (User_RiskLevelId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[80] +} + +func (x User_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use User_RiskLevelId.Descriptor instead. +func (User_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{112, 0} +} + +type User_TypeId int32 + +const ( + User_TYPE_ID_UNKNOWN User_TypeId = 0 + User_TYPE_ID_USER User_TypeId = 1 + User_TYPE_ID_ADMIN User_TypeId = 2 + User_TYPE_ID_SYSTEM User_TypeId = 3 + User_TYPE_ID_SERVICE User_TypeId = 4 + User_TYPE_ID_OTHER User_TypeId = 99 +) + +// Enum value maps for User_TypeId. +var ( + User_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_USER", + 2: "TYPE_ID_ADMIN", + 3: "TYPE_ID_SYSTEM", + 4: "TYPE_ID_SERVICE", + 99: "TYPE_ID_OTHER", + } + User_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_USER": 1, + "TYPE_ID_ADMIN": 2, + "TYPE_ID_SYSTEM": 3, + "TYPE_ID_SERVICE": 4, + "TYPE_ID_OTHER": 99, + } +) + +func (x User_TypeId) Enum() *User_TypeId { + p := new(User_TypeId) + *p = x + return p +} + +func (x User_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (User_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[81].Descriptor() +} + +func (User_TypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[81] +} + +func (x User_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use User_TypeId.Descriptor instead. +func (User_TypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{112, 1} +} + +type Vulnerability_FixCoverageId int32 + +const ( + Vulnerability_FIX_COVERAGE_ID_UNKNOWN Vulnerability_FixCoverageId = 0 + Vulnerability_FIX_COVERAGE_ID_COMPLETE Vulnerability_FixCoverageId = 1 + Vulnerability_FIX_COVERAGE_ID_PARTIAL Vulnerability_FixCoverageId = 2 + Vulnerability_FIX_COVERAGE_ID_NONE Vulnerability_FixCoverageId = 3 + Vulnerability_FIX_COVERAGE_ID_OTHER Vulnerability_FixCoverageId = 99 +) + +// Enum value maps for Vulnerability_FixCoverageId. +var ( + Vulnerability_FixCoverageId_name = map[int32]string{ + 0: "FIX_COVERAGE_ID_UNKNOWN", + 1: "FIX_COVERAGE_ID_COMPLETE", + 2: "FIX_COVERAGE_ID_PARTIAL", + 3: "FIX_COVERAGE_ID_NONE", + 99: "FIX_COVERAGE_ID_OTHER", + } + Vulnerability_FixCoverageId_value = map[string]int32{ + "FIX_COVERAGE_ID_UNKNOWN": 0, + "FIX_COVERAGE_ID_COMPLETE": 1, + "FIX_COVERAGE_ID_PARTIAL": 2, + "FIX_COVERAGE_ID_NONE": 3, + "FIX_COVERAGE_ID_OTHER": 99, + } +) + +func (x Vulnerability_FixCoverageId) Enum() *Vulnerability_FixCoverageId { + p := new(Vulnerability_FixCoverageId) + *p = x + return p +} + +func (x Vulnerability_FixCoverageId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Vulnerability_FixCoverageId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[82].Descriptor() +} + +func (Vulnerability_FixCoverageId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[82] +} + +func (x Vulnerability_FixCoverageId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Vulnerability_FixCoverageId.Descriptor instead. +func (Vulnerability_FixCoverageId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{113, 0} +} + +type Whois_DnssecStatusId int32 + +const ( + Whois_DNSSEC_STATUS_ID_UNKNOWN Whois_DnssecStatusId = 0 + Whois_DNSSEC_STATUS_ID_SIGNED Whois_DnssecStatusId = 1 + Whois_DNSSEC_STATUS_ID_UNSIGNED Whois_DnssecStatusId = 2 + Whois_DNSSEC_STATUS_ID_OTHER Whois_DnssecStatusId = 99 +) + +// Enum value maps for Whois_DnssecStatusId. +var ( + Whois_DnssecStatusId_name = map[int32]string{ + 0: "DNSSEC_STATUS_ID_UNKNOWN", + 1: "DNSSEC_STATUS_ID_SIGNED", + 2: "DNSSEC_STATUS_ID_UNSIGNED", + 99: "DNSSEC_STATUS_ID_OTHER", + } + Whois_DnssecStatusId_value = map[string]int32{ + "DNSSEC_STATUS_ID_UNKNOWN": 0, + "DNSSEC_STATUS_ID_SIGNED": 1, + "DNSSEC_STATUS_ID_UNSIGNED": 2, + "DNSSEC_STATUS_ID_OTHER": 99, + } +) + +func (x Whois_DnssecStatusId) Enum() *Whois_DnssecStatusId { + p := new(Whois_DnssecStatusId) + *p = x + return p +} + +func (x Whois_DnssecStatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Whois_DnssecStatusId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[83].Descriptor() +} + +func (Whois_DnssecStatusId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[83] +} + +func (x Whois_DnssecStatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Whois_DnssecStatusId.Descriptor instead. +func (Whois_DnssecStatusId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{114, 0} +} + +type WinService_ServiceCategoryId int32 + +const ( + WinService_SERVICE_CATEGORY_ID_UNKNOWN WinService_ServiceCategoryId = 0 + WinService_SERVICE_CATEGORY_ID_KERNEL_MODE WinService_ServiceCategoryId = 1 + WinService_SERVICE_CATEGORY_ID_USER_MODE WinService_ServiceCategoryId = 2 + WinService_SERVICE_CATEGORY_ID_OTHER WinService_ServiceCategoryId = 99 +) + +// Enum value maps for WinService_ServiceCategoryId. +var ( + WinService_ServiceCategoryId_name = map[int32]string{ + 0: "SERVICE_CATEGORY_ID_UNKNOWN", + 1: "SERVICE_CATEGORY_ID_KERNEL_MODE", + 2: "SERVICE_CATEGORY_ID_USER_MODE", + 99: "SERVICE_CATEGORY_ID_OTHER", + } + WinService_ServiceCategoryId_value = map[string]int32{ + "SERVICE_CATEGORY_ID_UNKNOWN": 0, + "SERVICE_CATEGORY_ID_KERNEL_MODE": 1, + "SERVICE_CATEGORY_ID_USER_MODE": 2, + "SERVICE_CATEGORY_ID_OTHER": 99, + } +) + +func (x WinService_ServiceCategoryId) Enum() *WinService_ServiceCategoryId { + p := new(WinService_ServiceCategoryId) + *p = x + return p +} + +func (x WinService_ServiceCategoryId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WinService_ServiceCategoryId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[84].Descriptor() +} + +func (WinService_ServiceCategoryId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[84] +} + +func (x WinService_ServiceCategoryId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WinService_ServiceCategoryId.Descriptor instead. +func (WinService_ServiceCategoryId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{115, 0} +} + +type WinService_ServiceErrorControlId int32 + +const ( + WinService_SERVICE_ERROR_CONTROL_ID_UNKNOWN WinService_ServiceErrorControlId = 0 + WinService_SERVICE_ERROR_CONTROL_ID_IGNORE WinService_ServiceErrorControlId = 1 + WinService_SERVICE_ERROR_CONTROL_ID_NORMAL WinService_ServiceErrorControlId = 2 + WinService_SERVICE_ERROR_CONTROL_ID_SEVERE WinService_ServiceErrorControlId = 3 + WinService_SERVICE_ERROR_CONTROL_ID_CRITICAL WinService_ServiceErrorControlId = 4 + WinService_SERVICE_ERROR_CONTROL_ID_OTHER WinService_ServiceErrorControlId = 99 +) + +// Enum value maps for WinService_ServiceErrorControlId. +var ( + WinService_ServiceErrorControlId_name = map[int32]string{ + 0: "SERVICE_ERROR_CONTROL_ID_UNKNOWN", + 1: "SERVICE_ERROR_CONTROL_ID_IGNORE", + 2: "SERVICE_ERROR_CONTROL_ID_NORMAL", + 3: "SERVICE_ERROR_CONTROL_ID_SEVERE", + 4: "SERVICE_ERROR_CONTROL_ID_CRITICAL", + 99: "SERVICE_ERROR_CONTROL_ID_OTHER", + } + WinService_ServiceErrorControlId_value = map[string]int32{ + "SERVICE_ERROR_CONTROL_ID_UNKNOWN": 0, + "SERVICE_ERROR_CONTROL_ID_IGNORE": 1, + "SERVICE_ERROR_CONTROL_ID_NORMAL": 2, + "SERVICE_ERROR_CONTROL_ID_SEVERE": 3, + "SERVICE_ERROR_CONTROL_ID_CRITICAL": 4, + "SERVICE_ERROR_CONTROL_ID_OTHER": 99, + } +) + +func (x WinService_ServiceErrorControlId) Enum() *WinService_ServiceErrorControlId { + p := new(WinService_ServiceErrorControlId) + *p = x + return p +} + +func (x WinService_ServiceErrorControlId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WinService_ServiceErrorControlId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[85].Descriptor() +} + +func (WinService_ServiceErrorControlId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[85] +} + +func (x WinService_ServiceErrorControlId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WinService_ServiceErrorControlId.Descriptor instead. +func (WinService_ServiceErrorControlId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{115, 1} +} + +type WinService_ServiceStartTypeId int32 + +const ( + WinService_SERVICE_START_TYPE_ID_UNKNOWN WinService_ServiceStartTypeId = 0 + WinService_SERVICE_START_TYPE_ID_BOOT WinService_ServiceStartTypeId = 1 + WinService_SERVICE_START_TYPE_ID_SYSTEM WinService_ServiceStartTypeId = 2 + WinService_SERVICE_START_TYPE_ID_AUTO WinService_ServiceStartTypeId = 3 + WinService_SERVICE_START_TYPE_ID_DEMAND WinService_ServiceStartTypeId = 4 + WinService_SERVICE_START_TYPE_ID_DISABLED WinService_ServiceStartTypeId = 5 + WinService_SERVICE_START_TYPE_ID_OTHER WinService_ServiceStartTypeId = 99 +) + +// Enum value maps for WinService_ServiceStartTypeId. +var ( + WinService_ServiceStartTypeId_name = map[int32]string{ + 0: "SERVICE_START_TYPE_ID_UNKNOWN", + 1: "SERVICE_START_TYPE_ID_BOOT", + 2: "SERVICE_START_TYPE_ID_SYSTEM", + 3: "SERVICE_START_TYPE_ID_AUTO", + 4: "SERVICE_START_TYPE_ID_DEMAND", + 5: "SERVICE_START_TYPE_ID_DISABLED", + 99: "SERVICE_START_TYPE_ID_OTHER", + } + WinService_ServiceStartTypeId_value = map[string]int32{ + "SERVICE_START_TYPE_ID_UNKNOWN": 0, + "SERVICE_START_TYPE_ID_BOOT": 1, + "SERVICE_START_TYPE_ID_SYSTEM": 2, + "SERVICE_START_TYPE_ID_AUTO": 3, + "SERVICE_START_TYPE_ID_DEMAND": 4, + "SERVICE_START_TYPE_ID_DISABLED": 5, + "SERVICE_START_TYPE_ID_OTHER": 99, + } +) + +func (x WinService_ServiceStartTypeId) Enum() *WinService_ServiceStartTypeId { + p := new(WinService_ServiceStartTypeId) + *p = x + return p +} + +func (x WinService_ServiceStartTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WinService_ServiceStartTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[86].Descriptor() +} + +func (WinService_ServiceStartTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[86] +} + +func (x WinService_ServiceStartTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WinService_ServiceStartTypeId.Descriptor instead. +func (WinService_ServiceStartTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{115, 2} +} + +type WinService_ServiceTypeId int32 + +const ( + WinService_SERVICE_TYPE_ID_UNKNOWN WinService_ServiceTypeId = 0 + WinService_SERVICE_TYPE_ID_KERNEL_DRIVER WinService_ServiceTypeId = 1 + WinService_SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER WinService_ServiceTypeId = 2 + WinService_SERVICE_TYPE_ID_OWN_PROCESS WinService_ServiceTypeId = 3 + WinService_SERVICE_TYPE_ID_SHARE_PROCESS WinService_ServiceTypeId = 4 + WinService_SERVICE_TYPE_ID_OTHER WinService_ServiceTypeId = 99 +) + +// Enum value maps for WinService_ServiceTypeId. +var ( + WinService_ServiceTypeId_name = map[int32]string{ + 0: "SERVICE_TYPE_ID_UNKNOWN", + 1: "SERVICE_TYPE_ID_KERNEL_DRIVER", + 2: "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER", + 3: "SERVICE_TYPE_ID_OWN_PROCESS", + 4: "SERVICE_TYPE_ID_SHARE_PROCESS", + 99: "SERVICE_TYPE_ID_OTHER", + } + WinService_ServiceTypeId_value = map[string]int32{ + "SERVICE_TYPE_ID_UNKNOWN": 0, + "SERVICE_TYPE_ID_KERNEL_DRIVER": 1, + "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER": 2, + "SERVICE_TYPE_ID_OWN_PROCESS": 3, + "SERVICE_TYPE_ID_SHARE_PROCESS": 4, + "SERVICE_TYPE_ID_OTHER": 99, + } +) + +func (x WinService_ServiceTypeId) Enum() *WinService_ServiceTypeId { + p := new(WinService_ServiceTypeId) + *p = x + return p +} + +func (x WinService_ServiceTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WinService_ServiceTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_api_entity_proto_enumTypes[87].Descriptor() +} + +func (WinService_ServiceTypeId) Type() protoreflect.EnumType { + return &file_api_entity_proto_enumTypes[87] +} + +func (x WinService_ServiceTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WinService_ServiceTypeId.Descriptor instead. +func (WinService_ServiceTypeId) EnumDescriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{115, 3} +} + +type ApiActivity struct { + state protoimpl.MessageState `protogen:"open.v1"` + Action string `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"` + ActionId ApiActivity_ActionId `protobuf:"varint,2,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.ApiActivity_ActionId" json:"action_id,omitempty"` + ActivityId ApiActivity_ActivityId `protobuf:"varint,3,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.ApiActivity_ActivityId" json:"activity_id,omitempty"` + ActivityName string `protobuf:"bytes,4,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` + Actor *Actor `protobuf:"bytes,5,opt,name=actor,proto3" json:"actor,omitempty"` + AiModel *AiModel `protobuf:"bytes,6,opt,name=ai_model,json=aiModel,proto3" json:"ai_model,omitempty"` + Api *Api `protobuf:"bytes,7,opt,name=api,proto3" json:"api,omitempty"` + Attacks []*Attack `protobuf:"bytes,8,rep,name=attacks,proto3" json:"attacks,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,9,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + CategoryName string `protobuf:"bytes,10,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` + CategoryUid ApiActivity_CategoryUid `protobuf:"varint,11,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.ApiActivity_CategoryUid" json:"category_uid,omitempty"` + ClassName string `protobuf:"bytes,12,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` + ClassUid ApiActivity_ClassUid `protobuf:"varint,13,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.ApiActivity_ClassUid" json:"class_uid,omitempty"` + Cloud *Cloud `protobuf:"bytes,14,opt,name=cloud,proto3" json:"cloud,omitempty"` + Confidence string `protobuf:"bytes,15,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId ApiActivity_ConfidenceId `protobuf:"varint,16,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.ApiActivity_ConfidenceId" json:"confidence_id,omitempty"` + ConfidenceScore int32 `protobuf:"varint,17,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` + Count int32 `protobuf:"varint,18,opt,name=count,proto3" json:"count,omitempty"` + Device *Device `protobuf:"bytes,19,opt,name=device,proto3" json:"device,omitempty"` + Disposition string `protobuf:"bytes,20,opt,name=disposition,proto3" json:"disposition,omitempty"` + DispositionId ApiActivity_DispositionId `protobuf:"varint,21,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.ApiActivity_DispositionId" json:"disposition_id,omitempty"` + DstEndpoint *NetworkEndpoint `protobuf:"bytes,22,opt,name=dst_endpoint,json=dstEndpoint,proto3" json:"dst_endpoint,omitempty"` + Duration int64 `protobuf:"varint,23,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,24,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,25,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Enrichments []*Enrichment `protobuf:"bytes,26,rep,name=enrichments,proto3" json:"enrichments,omitempty"` + FirewallRule *FirewallRule `protobuf:"bytes,27,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` + HttpRequest *HttpRequest `protobuf:"bytes,28,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` + HttpResponse *HttpResponse `protobuf:"bytes,29,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` + IsAlert bool `protobuf:"varint,30,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + Malware []*Malware `protobuf:"bytes,31,rep,name=malware,proto3" json:"malware,omitempty"` + MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,32,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` + Message string `protobuf:"bytes,33,opt,name=message,proto3" json:"message,omitempty"` + MessageContext *MessageContext `protobuf:"bytes,34,opt,name=message_context,json=messageContext,proto3" json:"message_context,omitempty"` + Metadata *Metadata `protobuf:"bytes,35,opt,name=metadata,proto3" json:"metadata,omitempty"` + Observables []*Observable `protobuf:"bytes,36,rep,name=observables,proto3" json:"observables,omitempty"` + Osint []*Osint `protobuf:"bytes,37,rep,name=osint,proto3" json:"osint,omitempty"` + Policy *Policy `protobuf:"bytes,38,opt,name=policy,proto3" json:"policy,omitempty"` + RawData string `protobuf:"bytes,39,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` + RawDataHash *Fingerprint `protobuf:"bytes,40,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` + RawDataSize int64 `protobuf:"varint,41,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` + Resources []*ResourceDetails `protobuf:"bytes,42,rep,name=resources,proto3" json:"resources,omitempty"` + RiskDetails string `protobuf:"bytes,43,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` + RiskLevel string `protobuf:"bytes,44,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId ApiActivity_RiskLevelId `protobuf:"varint,45,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.ApiActivity_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,46,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Severity string `protobuf:"bytes,47,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId ApiActivity_SeverityId `protobuf:"varint,48,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.ApiActivity_SeverityId" json:"severity_id,omitempty"` + SrcEndpoint *NetworkEndpoint `protobuf:"bytes,49,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` + StartTime int64 `protobuf:"varint,50,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,51,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Status string `protobuf:"bytes,52,opt,name=status,proto3" json:"status,omitempty"` + StatusCode string `protobuf:"bytes,53,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + StatusDetail string `protobuf:"bytes,54,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` + StatusId ApiActivity_StatusId `protobuf:"varint,55,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.ApiActivity_StatusId" json:"status_id,omitempty"` + Time int64 `protobuf:"varint,56,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,57,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + TimezoneOffset int32 `protobuf:"varint,58,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` + Trace *Trace `protobuf:"bytes,59,opt,name=trace,proto3" json:"trace,omitempty"` + TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` + TypeUid ApiActivity_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.ApiActivity_TypeUid" json:"type_uid,omitempty"` + Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ApiActivity) Reset() { + *x = ApiActivity{} + mi := &file_api_entity_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ApiActivity) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ApiActivity) ProtoMessage() {} + +func (x *ApiActivity) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ApiActivity.ProtoReflect.Descriptor instead. +func (*ApiActivity) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{0} +} + +func (x *ApiActivity) GetAction() string { + if x != nil { + return x.Action + } + return "" +} + +func (x *ApiActivity) GetActionId() ApiActivity_ActionId { + if x != nil { + return x.ActionId + } + return ApiActivity_ACTION_ID_UNKNOWN +} + +func (x *ApiActivity) GetActivityId() ApiActivity_ActivityId { + if x != nil { + return x.ActivityId + } + return ApiActivity_ACTIVITY_ID_UNKNOWN +} + +func (x *ApiActivity) GetActivityName() string { + if x != nil { + return x.ActivityName + } + return "" +} + +func (x *ApiActivity) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *ApiActivity) GetAiModel() *AiModel { + if x != nil { + return x.AiModel + } + return nil +} + +func (x *ApiActivity) GetApi() *Api { + if x != nil { + return x.Api + } + return nil +} + +func (x *ApiActivity) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *ApiActivity) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *ApiActivity) GetCategoryName() string { + if x != nil { + return x.CategoryName + } + return "" +} + +func (x *ApiActivity) GetCategoryUid() ApiActivity_CategoryUid { + if x != nil { + return x.CategoryUid + } + return ApiActivity_CATEGORY_UID_UNKNOWN +} + +func (x *ApiActivity) GetClassName() string { + if x != nil { + return x.ClassName + } + return "" +} + +func (x *ApiActivity) GetClassUid() ApiActivity_ClassUid { + if x != nil { + return x.ClassUid + } + return ApiActivity_CLASS_UID_UNKNOWN +} + +func (x *ApiActivity) GetCloud() *Cloud { + if x != nil { + return x.Cloud + } + return nil +} + +func (x *ApiActivity) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *ApiActivity) GetConfidenceId() ApiActivity_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return ApiActivity_CONFIDENCE_ID_UNKNOWN +} + +func (x *ApiActivity) GetConfidenceScore() int32 { + if x != nil { + return x.ConfidenceScore + } + return 0 +} + +func (x *ApiActivity) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *ApiActivity) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *ApiActivity) GetDisposition() string { + if x != nil { + return x.Disposition + } + return "" +} + +func (x *ApiActivity) GetDispositionId() ApiActivity_DispositionId { + if x != nil { + return x.DispositionId + } + return ApiActivity_DISPOSITION_ID_UNKNOWN +} + +func (x *ApiActivity) GetDstEndpoint() *NetworkEndpoint { + if x != nil { + return x.DstEndpoint + } + return nil +} + +func (x *ApiActivity) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *ApiActivity) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *ApiActivity) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *ApiActivity) GetEnrichments() []*Enrichment { + if x != nil { + return x.Enrichments + } + return nil +} + +func (x *ApiActivity) GetFirewallRule() *FirewallRule { + if x != nil { + return x.FirewallRule + } + return nil +} + +func (x *ApiActivity) GetHttpRequest() *HttpRequest { + if x != nil { + return x.HttpRequest + } + return nil +} + +func (x *ApiActivity) GetHttpResponse() *HttpResponse { + if x != nil { + return x.HttpResponse + } + return nil +} + +func (x *ApiActivity) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *ApiActivity) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *ApiActivity) GetMalwareScanInfo() *MalwareScanInfo { + if x != nil { + return x.MalwareScanInfo + } + return nil +} + +func (x *ApiActivity) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *ApiActivity) GetMessageContext() *MessageContext { + if x != nil { + return x.MessageContext + } + return nil +} + +func (x *ApiActivity) GetMetadata() *Metadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *ApiActivity) GetObservables() []*Observable { + if x != nil { + return x.Observables + } + return nil +} + +func (x *ApiActivity) GetOsint() []*Osint { + if x != nil { + return x.Osint + } + return nil +} + +func (x *ApiActivity) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *ApiActivity) GetRawData() string { + if x != nil { + return x.RawData + } + return "" +} + +func (x *ApiActivity) GetRawDataHash() *Fingerprint { + if x != nil { + return x.RawDataHash + } + return nil +} + +func (x *ApiActivity) GetRawDataSize() int64 { + if x != nil { + return x.RawDataSize + } + return 0 +} + +func (x *ApiActivity) GetResources() []*ResourceDetails { + if x != nil { + return x.Resources + } + return nil +} + +func (x *ApiActivity) GetRiskDetails() string { + if x != nil { + return x.RiskDetails + } + return "" +} + +func (x *ApiActivity) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *ApiActivity) GetRiskLevelId() ApiActivity_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return ApiActivity_RISK_LEVEL_ID_INFO +} + +func (x *ApiActivity) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *ApiActivity) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *ApiActivity) GetSeverityId() ApiActivity_SeverityId { + if x != nil { + return x.SeverityId + } + return ApiActivity_SEVERITY_ID_UNKNOWN +} + +func (x *ApiActivity) GetSrcEndpoint() *NetworkEndpoint { + if x != nil { + return x.SrcEndpoint + } + return nil +} + +func (x *ApiActivity) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *ApiActivity) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *ApiActivity) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *ApiActivity) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *ApiActivity) GetStatusDetail() string { + if x != nil { + return x.StatusDetail + } + return "" +} + +func (x *ApiActivity) GetStatusId() ApiActivity_StatusId { + if x != nil { + return x.StatusId + } + return ApiActivity_STATUS_ID_UNKNOWN +} + +func (x *ApiActivity) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *ApiActivity) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *ApiActivity) GetTimezoneOffset() int32 { + if x != nil { + return x.TimezoneOffset + } + return 0 +} + +func (x *ApiActivity) GetTrace() *Trace { + if x != nil { + return x.Trace + } + return nil +} + +func (x *ApiActivity) GetTypeName() string { + if x != nil { + return x.TypeName + } + return "" +} + +func (x *ApiActivity) GetTypeUid() ApiActivity_TypeUid { + if x != nil { + return x.TypeUid + } + return ApiActivity_TYPE_UID_UNKNOWN +} + +func (x *ApiActivity) GetUnmapped() *structpb.Value { + if x != nil { + return x.Unmapped + } + return nil +} + +type EntityManagement struct { + state protoimpl.MessageState `protogen:"open.v1"` + AccessList []string `protobuf:"bytes,1,rep,name=access_list,json=accessList,proto3" json:"access_list,omitempty"` + AccessMask int32 `protobuf:"varint,2,opt,name=access_mask,json=accessMask,proto3" json:"access_mask,omitempty"` + Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` + ActionId EntityManagement_ActionId `protobuf:"varint,4,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.EntityManagement_ActionId" json:"action_id,omitempty"` + ActivityId EntityManagement_ActivityId `protobuf:"varint,5,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.EntityManagement_ActivityId" json:"activity_id,omitempty"` + ActivityName string `protobuf:"bytes,6,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` + Actor *Actor `protobuf:"bytes,7,opt,name=actor,proto3" json:"actor,omitempty"` + Api *Api `protobuf:"bytes,8,opt,name=api,proto3" json:"api,omitempty"` + Attacks []*Attack `protobuf:"bytes,9,rep,name=attacks,proto3" json:"attacks,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,10,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + CategoryName string `protobuf:"bytes,11,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` + CategoryUid EntityManagement_CategoryUid `protobuf:"varint,12,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.EntityManagement_CategoryUid" json:"category_uid,omitempty"` + ClassName string `protobuf:"bytes,13,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` + ClassUid EntityManagement_ClassUid `protobuf:"varint,14,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.EntityManagement_ClassUid" json:"class_uid,omitempty"` + Cloud *Cloud `protobuf:"bytes,15,opt,name=cloud,proto3" json:"cloud,omitempty"` + Comment string `protobuf:"bytes,16,opt,name=comment,proto3" json:"comment,omitempty"` + Confidence string `protobuf:"bytes,17,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId EntityManagement_ConfidenceId `protobuf:"varint,18,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.EntityManagement_ConfidenceId" json:"confidence_id,omitempty"` + ConfidenceScore int32 `protobuf:"varint,19,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` + Count int32 `protobuf:"varint,20,opt,name=count,proto3" json:"count,omitempty"` + Device *Device `protobuf:"bytes,21,opt,name=device,proto3" json:"device,omitempty"` + Disposition string `protobuf:"bytes,22,opt,name=disposition,proto3" json:"disposition,omitempty"` + DispositionId EntityManagement_DispositionId `protobuf:"varint,23,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.EntityManagement_DispositionId" json:"disposition_id,omitempty"` + Duration int64 `protobuf:"varint,24,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,25,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,26,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Enrichments []*Enrichment `protobuf:"bytes,27,rep,name=enrichments,proto3" json:"enrichments,omitempty"` + Entity *ManagedEntity `protobuf:"bytes,28,opt,name=entity,proto3" json:"entity,omitempty"` + EntityResult *ManagedEntity `protobuf:"bytes,29,opt,name=entity_result,json=entityResult,proto3" json:"entity_result,omitempty"` + FirewallRule *FirewallRule `protobuf:"bytes,30,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` + HttpRequest *HttpRequest `protobuf:"bytes,31,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` + HttpResponse *HttpResponse `protobuf:"bytes,32,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` + IsAlert bool `protobuf:"varint,33,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + Malware []*Malware `protobuf:"bytes,34,rep,name=malware,proto3" json:"malware,omitempty"` + MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,35,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` + Message string `protobuf:"bytes,36,opt,name=message,proto3" json:"message,omitempty"` + Metadata *Metadata `protobuf:"bytes,37,opt,name=metadata,proto3" json:"metadata,omitempty"` + Observables []*Observable `protobuf:"bytes,38,rep,name=observables,proto3" json:"observables,omitempty"` + Osint []*Osint `protobuf:"bytes,39,rep,name=osint,proto3" json:"osint,omitempty"` + Policy *Policy `protobuf:"bytes,40,opt,name=policy,proto3" json:"policy,omitempty"` + RawData string `protobuf:"bytes,41,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` + RawDataHash *Fingerprint `protobuf:"bytes,42,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` + RawDataSize int64 `protobuf:"varint,43,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` + RiskDetails string `protobuf:"bytes,44,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` + RiskLevel string `protobuf:"bytes,45,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId EntityManagement_RiskLevelId `protobuf:"varint,46,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.EntityManagement_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,47,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Severity string `protobuf:"bytes,48,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId EntityManagement_SeverityId `protobuf:"varint,49,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.EntityManagement_SeverityId" json:"severity_id,omitempty"` + SrcEndpoint *NetworkEndpoint `protobuf:"bytes,50,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` + StartTime int64 `protobuf:"varint,51,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,52,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Status string `protobuf:"bytes,53,opt,name=status,proto3" json:"status,omitempty"` + StatusCode string `protobuf:"bytes,54,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + StatusDetail string `protobuf:"bytes,55,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` + StatusId EntityManagement_StatusId `protobuf:"varint,56,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.EntityManagement_StatusId" json:"status_id,omitempty"` + Time int64 `protobuf:"varint,57,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,58,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + TimezoneOffset int32 `protobuf:"varint,59,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` + TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` + TypeUid EntityManagement_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.EntityManagement_TypeUid" json:"type_uid,omitempty"` + Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EntityManagement) Reset() { + *x = EntityManagement{} + mi := &file_api_entity_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EntityManagement) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EntityManagement) ProtoMessage() {} + +func (x *EntityManagement) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EntityManagement.ProtoReflect.Descriptor instead. +func (*EntityManagement) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{1} +} + +func (x *EntityManagement) GetAccessList() []string { + if x != nil { + return x.AccessList + } + return nil +} + +func (x *EntityManagement) GetAccessMask() int32 { + if x != nil { + return x.AccessMask + } + return 0 +} + +func (x *EntityManagement) GetAction() string { + if x != nil { + return x.Action + } + return "" +} + +func (x *EntityManagement) GetActionId() EntityManagement_ActionId { + if x != nil { + return x.ActionId + } + return EntityManagement_ACTION_ID_UNKNOWN +} + +func (x *EntityManagement) GetActivityId() EntityManagement_ActivityId { + if x != nil { + return x.ActivityId + } + return EntityManagement_ACTIVITY_ID_UNKNOWN +} + +func (x *EntityManagement) GetActivityName() string { + if x != nil { + return x.ActivityName + } + return "" +} + +func (x *EntityManagement) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *EntityManagement) GetApi() *Api { + if x != nil { + return x.Api + } + return nil +} + +func (x *EntityManagement) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *EntityManagement) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *EntityManagement) GetCategoryName() string { + if x != nil { + return x.CategoryName + } + return "" +} + +func (x *EntityManagement) GetCategoryUid() EntityManagement_CategoryUid { + if x != nil { + return x.CategoryUid + } + return EntityManagement_CATEGORY_UID_UNKNOWN +} + +func (x *EntityManagement) GetClassName() string { + if x != nil { + return x.ClassName + } + return "" +} + +func (x *EntityManagement) GetClassUid() EntityManagement_ClassUid { + if x != nil { + return x.ClassUid + } + return EntityManagement_CLASS_UID_UNKNOWN +} + +func (x *EntityManagement) GetCloud() *Cloud { + if x != nil { + return x.Cloud + } + return nil +} + +func (x *EntityManagement) GetComment() string { + if x != nil { + return x.Comment + } + return "" +} + +func (x *EntityManagement) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *EntityManagement) GetConfidenceId() EntityManagement_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return EntityManagement_CONFIDENCE_ID_UNKNOWN +} + +func (x *EntityManagement) GetConfidenceScore() int32 { + if x != nil { + return x.ConfidenceScore + } + return 0 +} + +func (x *EntityManagement) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *EntityManagement) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *EntityManagement) GetDisposition() string { + if x != nil { + return x.Disposition + } + return "" +} + +func (x *EntityManagement) GetDispositionId() EntityManagement_DispositionId { + if x != nil { + return x.DispositionId + } + return EntityManagement_DISPOSITION_ID_UNKNOWN +} + +func (x *EntityManagement) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *EntityManagement) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *EntityManagement) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *EntityManagement) GetEnrichments() []*Enrichment { + if x != nil { + return x.Enrichments + } + return nil +} + +func (x *EntityManagement) GetEntity() *ManagedEntity { + if x != nil { + return x.Entity + } + return nil +} + +func (x *EntityManagement) GetEntityResult() *ManagedEntity { + if x != nil { + return x.EntityResult + } + return nil +} + +func (x *EntityManagement) GetFirewallRule() *FirewallRule { + if x != nil { + return x.FirewallRule + } + return nil +} + +func (x *EntityManagement) GetHttpRequest() *HttpRequest { + if x != nil { + return x.HttpRequest + } + return nil +} + +func (x *EntityManagement) GetHttpResponse() *HttpResponse { + if x != nil { + return x.HttpResponse + } + return nil +} + +func (x *EntityManagement) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *EntityManagement) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *EntityManagement) GetMalwareScanInfo() *MalwareScanInfo { + if x != nil { + return x.MalwareScanInfo + } + return nil +} + +func (x *EntityManagement) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *EntityManagement) GetMetadata() *Metadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *EntityManagement) GetObservables() []*Observable { + if x != nil { + return x.Observables + } + return nil +} + +func (x *EntityManagement) GetOsint() []*Osint { + if x != nil { + return x.Osint + } + return nil +} + +func (x *EntityManagement) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *EntityManagement) GetRawData() string { + if x != nil { + return x.RawData + } + return "" +} + +func (x *EntityManagement) GetRawDataHash() *Fingerprint { + if x != nil { + return x.RawDataHash + } + return nil +} + +func (x *EntityManagement) GetRawDataSize() int64 { + if x != nil { + return x.RawDataSize + } + return 0 +} + +func (x *EntityManagement) GetRiskDetails() string { + if x != nil { + return x.RiskDetails + } + return "" +} + +func (x *EntityManagement) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *EntityManagement) GetRiskLevelId() EntityManagement_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return EntityManagement_RISK_LEVEL_ID_INFO +} + +func (x *EntityManagement) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *EntityManagement) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *EntityManagement) GetSeverityId() EntityManagement_SeverityId { + if x != nil { + return x.SeverityId + } + return EntityManagement_SEVERITY_ID_UNKNOWN +} + +func (x *EntityManagement) GetSrcEndpoint() *NetworkEndpoint { + if x != nil { + return x.SrcEndpoint + } + return nil +} + +func (x *EntityManagement) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *EntityManagement) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *EntityManagement) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *EntityManagement) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *EntityManagement) GetStatusDetail() string { + if x != nil { + return x.StatusDetail + } + return "" +} + +func (x *EntityManagement) GetStatusId() EntityManagement_StatusId { + if x != nil { + return x.StatusId + } + return EntityManagement_STATUS_ID_UNKNOWN +} + +func (x *EntityManagement) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *EntityManagement) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *EntityManagement) GetTimezoneOffset() int32 { + if x != nil { + return x.TimezoneOffset + } + return 0 +} + +func (x *EntityManagement) GetTypeName() string { + if x != nil { + return x.TypeName + } + return "" +} + +func (x *EntityManagement) GetTypeUid() EntityManagement_TypeUid { + if x != nil { + return x.TypeUid + } + return EntityManagement_TYPE_UID_UNKNOWN +} + +func (x *EntityManagement) GetUnmapped() *structpb.Value { + if x != nil { + return x.Unmapped + } + return nil +} + +type Account struct { + state protoimpl.MessageState `protogen:"open.v1"` + IsDisabled bool `protobuf:"varint,1,opt,name=is_disabled,json=isDisabled,proto3" json:"is_disabled,omitempty"` + IsLocked bool `protobuf:"varint,2,opt,name=is_locked,json=isLocked,proto3" json:"is_locked,omitempty"` + IsOnPremisesSyncEnabled bool `protobuf:"varint,3,opt,name=is_on_premises_sync_enabled,json=isOnPremisesSyncEnabled,proto3" json:"is_on_premises_sync_enabled,omitempty"` + Labels []string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,6,rep,name=tags,proto3" json:"tags,omitempty"` + Type string `protobuf:"bytes,7,opt,name=type,proto3" json:"type,omitempty"` + TypeId Account_TypeId `protobuf:"varint,8,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Account_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,9,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Account) Reset() { + *x = Account{} + mi := &file_api_entity_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Account) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Account) ProtoMessage() {} + +func (x *Account) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Account.ProtoReflect.Descriptor instead. +func (*Account) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{2} +} + +func (x *Account) GetIsDisabled() bool { + if x != nil { + return x.IsDisabled + } + return false +} + +func (x *Account) GetIsLocked() bool { + if x != nil { + return x.IsLocked + } + return false +} + +func (x *Account) GetIsOnPremisesSyncEnabled() bool { + if x != nil { + return x.IsOnPremisesSyncEnabled + } + return false +} + +func (x *Account) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Account) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Account) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Account) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Account) GetTypeId() Account_TypeId { + if x != nil { + return x.TypeId + } + return Account_TYPE_ID_UNKNOWN +} + +func (x *Account) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Actor struct { + state protoimpl.MessageState `protogen:"open.v1"` + AppName string `protobuf:"bytes,1,opt,name=app_name,json=appName,proto3" json:"app_name,omitempty"` + AppUid string `protobuf:"bytes,2,opt,name=app_uid,json=appUid,proto3" json:"app_uid,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,3,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + Idp *Idp `protobuf:"bytes,4,opt,name=idp,proto3" json:"idp,omitempty"` + InvokedBy string `protobuf:"bytes,5,opt,name=invoked_by,json=invokedBy,proto3" json:"invoked_by,omitempty"` + Process *Process `protobuf:"bytes,6,opt,name=process,proto3" json:"process,omitempty"` + Session *Session `protobuf:"bytes,7,opt,name=session,proto3" json:"session,omitempty"` + User *User `protobuf:"bytes,8,opt,name=user,proto3" json:"user,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Actor) Reset() { + *x = Actor{} + mi := &file_api_entity_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Actor) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Actor) ProtoMessage() {} + +func (x *Actor) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[3] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Actor.ProtoReflect.Descriptor instead. +func (*Actor) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{3} +} + +func (x *Actor) GetAppName() string { + if x != nil { + return x.AppName + } + return "" +} + +func (x *Actor) GetAppUid() string { + if x != nil { + return x.AppUid + } + return "" +} + +func (x *Actor) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *Actor) GetIdp() *Idp { + if x != nil { + return x.Idp + } + return nil +} + +func (x *Actor) GetInvokedBy() string { + if x != nil { + return x.InvokedBy + } + return "" +} + +func (x *Actor) GetProcess() *Process { + if x != nil { + return x.Process + } + return nil +} + +func (x *Actor) GetSession() *Session { + if x != nil { + return x.Session + } + return nil +} + +func (x *Actor) GetUser() *User { + if x != nil { + return x.User + } + return nil +} + +type Advisory struct { + state protoimpl.MessageState `protogen:"open.v1"` + AvgTimespan *Timespan `protobuf:"bytes,1,opt,name=avg_timespan,json=avgTimespan,proto3" json:"avg_timespan,omitempty"` + Bulletin string `protobuf:"bytes,2,opt,name=bulletin,proto3" json:"bulletin,omitempty"` + Classification string `protobuf:"bytes,3,opt,name=classification,proto3" json:"classification,omitempty"` + CreatedTime int64 `protobuf:"varint,4,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,5,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Desc string `protobuf:"bytes,6,opt,name=desc,proto3" json:"desc,omitempty"` + InstallState string `protobuf:"bytes,7,opt,name=install_state,json=installState,proto3" json:"install_state,omitempty"` + InstallStateId Advisory_InstallStateId `protobuf:"varint,8,opt,name=install_state_id,json=installStateId,proto3,enum=ocsf.v1.Advisory_InstallStateId" json:"install_state_id,omitempty"` + IsSuperseded bool `protobuf:"varint,9,opt,name=is_superseded,json=isSuperseded,proto3" json:"is_superseded,omitempty"` + ModifiedTime int64 `protobuf:"varint,10,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,11,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Os *Os `protobuf:"bytes,12,opt,name=os,proto3" json:"os,omitempty"` + Product *Product `protobuf:"bytes,13,opt,name=product,proto3" json:"product,omitempty"` + References []string `protobuf:"bytes,14,rep,name=references,proto3" json:"references,omitempty"` + RelatedCves []*Cve `protobuf:"bytes,15,rep,name=related_cves,json=relatedCves,proto3" json:"related_cves,omitempty"` + RelatedCwes []*Cwe `protobuf:"bytes,16,rep,name=related_cwes,json=relatedCwes,proto3" json:"related_cwes,omitempty"` + Size int64 `protobuf:"varint,17,opt,name=size,proto3" json:"size,omitempty"` + SrcUrl string `protobuf:"bytes,18,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Title string `protobuf:"bytes,19,opt,name=title,proto3" json:"title,omitempty"` + Uid string `protobuf:"bytes,20,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Advisory) Reset() { + *x = Advisory{} + mi := &file_api_entity_proto_msgTypes[4] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Advisory) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Advisory) ProtoMessage() {} + +func (x *Advisory) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[4] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Advisory.ProtoReflect.Descriptor instead. +func (*Advisory) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{4} +} + +func (x *Advisory) GetAvgTimespan() *Timespan { + if x != nil { + return x.AvgTimespan + } + return nil +} + +func (x *Advisory) GetBulletin() string { + if x != nil { + return x.Bulletin + } + return "" +} + +func (x *Advisory) GetClassification() string { + if x != nil { + return x.Classification + } + return "" +} + +func (x *Advisory) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Advisory) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Advisory) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Advisory) GetInstallState() string { + if x != nil { + return x.InstallState + } + return "" +} + +func (x *Advisory) GetInstallStateId() Advisory_InstallStateId { + if x != nil { + return x.InstallStateId + } + return Advisory_INSTALL_STATE_ID_UNKNOWN +} + +func (x *Advisory) GetIsSuperseded() bool { + if x != nil { + return x.IsSuperseded + } + return false +} + +func (x *Advisory) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Advisory) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Advisory) GetOs() *Os { + if x != nil { + return x.Os + } + return nil +} + +func (x *Advisory) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *Advisory) GetReferences() []string { + if x != nil { + return x.References + } + return nil +} + +func (x *Advisory) GetRelatedCves() []*Cve { + if x != nil { + return x.RelatedCves + } + return nil +} + +func (x *Advisory) GetRelatedCwes() []*Cwe { + if x != nil { + return x.RelatedCwes + } + return nil +} + +func (x *Advisory) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *Advisory) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Advisory) GetTitle() string { + if x != nil { + return x.Title + } + return "" +} + +func (x *Advisory) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type AffectedCode struct { + state protoimpl.MessageState `protogen:"open.v1"` + EndColumn int32 `protobuf:"varint,1,opt,name=end_column,json=endColumn,proto3" json:"end_column,omitempty"` + EndLine int32 `protobuf:"varint,2,opt,name=end_line,json=endLine,proto3" json:"end_line,omitempty"` + File *File `protobuf:"bytes,3,opt,name=file,proto3" json:"file,omitempty"` + Owner *User `protobuf:"bytes,4,opt,name=owner,proto3" json:"owner,omitempty"` + Remediation *Remediation `protobuf:"bytes,5,opt,name=remediation,proto3" json:"remediation,omitempty"` + Rule *Rule `protobuf:"bytes,6,opt,name=rule,proto3" json:"rule,omitempty"` + StartColumn int32 `protobuf:"varint,7,opt,name=start_column,json=startColumn,proto3" json:"start_column,omitempty"` + StartLine int32 `protobuf:"varint,8,opt,name=start_line,json=startLine,proto3" json:"start_line,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AffectedCode) Reset() { + *x = AffectedCode{} + mi := &file_api_entity_proto_msgTypes[5] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AffectedCode) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AffectedCode) ProtoMessage() {} + +func (x *AffectedCode) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[5] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AffectedCode.ProtoReflect.Descriptor instead. +func (*AffectedCode) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{5} +} + +func (x *AffectedCode) GetEndColumn() int32 { + if x != nil { + return x.EndColumn + } + return 0 +} + +func (x *AffectedCode) GetEndLine() int32 { + if x != nil { + return x.EndLine + } + return 0 +} + +func (x *AffectedCode) GetFile() *File { + if x != nil { + return x.File + } + return nil +} + +func (x *AffectedCode) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *AffectedCode) GetRemediation() *Remediation { + if x != nil { + return x.Remediation + } + return nil +} + +func (x *AffectedCode) GetRule() *Rule { + if x != nil { + return x.Rule + } + return nil +} + +func (x *AffectedCode) GetStartColumn() int32 { + if x != nil { + return x.StartColumn + } + return 0 +} + +func (x *AffectedCode) GetStartLine() int32 { + if x != nil { + return x.StartLine + } + return 0 +} + +type AffectedPackage struct { + state protoimpl.MessageState `protogen:"open.v1"` + Architecture string `protobuf:"bytes,1,opt,name=architecture,proto3" json:"architecture,omitempty"` + CpeName string `protobuf:"bytes,2,opt,name=cpe_name,json=cpeName,proto3" json:"cpe_name,omitempty"` + Epoch int32 `protobuf:"varint,3,opt,name=epoch,proto3" json:"epoch,omitempty"` + FixedInVersion string `protobuf:"bytes,4,opt,name=fixed_in_version,json=fixedInVersion,proto3" json:"fixed_in_version,omitempty"` + Hash *Fingerprint `protobuf:"bytes,5,opt,name=hash,proto3" json:"hash,omitempty"` + License string `protobuf:"bytes,6,opt,name=license,proto3" json:"license,omitempty"` + LicenseUrl string `protobuf:"bytes,7,opt,name=license_url,json=licenseUrl,proto3" json:"license_url,omitempty"` + Name string `protobuf:"bytes,8,opt,name=name,proto3" json:"name,omitempty"` + PackageManager string `protobuf:"bytes,9,opt,name=package_manager,json=packageManager,proto3" json:"package_manager,omitempty"` + PackageManagerUrl string `protobuf:"bytes,10,opt,name=package_manager_url,json=packageManagerUrl,proto3" json:"package_manager_url,omitempty"` + Path string `protobuf:"bytes,11,opt,name=path,proto3" json:"path,omitempty"` + Purl string `protobuf:"bytes,12,opt,name=purl,proto3" json:"purl,omitempty"` + Release string `protobuf:"bytes,13,opt,name=release,proto3" json:"release,omitempty"` + Remediation *Remediation `protobuf:"bytes,14,opt,name=remediation,proto3" json:"remediation,omitempty"` + SrcUrl string `protobuf:"bytes,15,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Type string `protobuf:"bytes,16,opt,name=type,proto3" json:"type,omitempty"` + TypeId AffectedPackage_TypeId `protobuf:"varint,17,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.AffectedPackage_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,18,opt,name=uid,proto3" json:"uid,omitempty"` + VendorName string `protobuf:"bytes,19,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,20,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AffectedPackage) Reset() { + *x = AffectedPackage{} + mi := &file_api_entity_proto_msgTypes[6] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AffectedPackage) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AffectedPackage) ProtoMessage() {} + +func (x *AffectedPackage) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[6] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AffectedPackage.ProtoReflect.Descriptor instead. +func (*AffectedPackage) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{6} +} + +func (x *AffectedPackage) GetArchitecture() string { + if x != nil { + return x.Architecture + } + return "" +} + +func (x *AffectedPackage) GetCpeName() string { + if x != nil { + return x.CpeName + } + return "" +} + +func (x *AffectedPackage) GetEpoch() int32 { + if x != nil { + return x.Epoch + } + return 0 +} + +func (x *AffectedPackage) GetFixedInVersion() string { + if x != nil { + return x.FixedInVersion + } + return "" +} + +func (x *AffectedPackage) GetHash() *Fingerprint { + if x != nil { + return x.Hash + } + return nil +} + +func (x *AffectedPackage) GetLicense() string { + if x != nil { + return x.License + } + return "" +} + +func (x *AffectedPackage) GetLicenseUrl() string { + if x != nil { + return x.LicenseUrl + } + return "" +} + +func (x *AffectedPackage) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *AffectedPackage) GetPackageManager() string { + if x != nil { + return x.PackageManager + } + return "" +} + +func (x *AffectedPackage) GetPackageManagerUrl() string { + if x != nil { + return x.PackageManagerUrl + } + return "" +} + +func (x *AffectedPackage) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *AffectedPackage) GetPurl() string { + if x != nil { + return x.Purl + } + return "" +} + +func (x *AffectedPackage) GetRelease() string { + if x != nil { + return x.Release + } + return "" +} + +func (x *AffectedPackage) GetRemediation() *Remediation { + if x != nil { + return x.Remediation + } + return nil +} + +func (x *AffectedPackage) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *AffectedPackage) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *AffectedPackage) GetTypeId() AffectedPackage_TypeId { + if x != nil { + return x.TypeId + } + return AffectedPackage_TYPE_ID_UNKNOWN +} + +func (x *AffectedPackage) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *AffectedPackage) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *AffectedPackage) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Agent struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Policies []*Policy `protobuf:"bytes,2,rep,name=policies,proto3" json:"policies,omitempty"` + Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"` + TypeId Agent_TypeId `protobuf:"varint,4,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Agent_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,6,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + VendorName string `protobuf:"bytes,7,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,8,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Agent) Reset() { + *x = Agent{} + mi := &file_api_entity_proto_msgTypes[7] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Agent) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Agent) ProtoMessage() {} + +func (x *Agent) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[7] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Agent.ProtoReflect.Descriptor instead. +func (*Agent) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{7} +} + +func (x *Agent) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Agent) GetPolicies() []*Policy { + if x != nil { + return x.Policies + } + return nil +} + +func (x *Agent) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Agent) GetTypeId() Agent_TypeId { + if x != nil { + return x.TypeId + } + return Agent_TYPE_ID_UNKNOWN +} + +func (x *Agent) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Agent) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *Agent) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Agent) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type AiModel struct { + state protoimpl.MessageState `protogen:"open.v1"` + AiProvider string `protobuf:"bytes,1,opt,name=ai_provider,json=aiProvider,proto3" json:"ai_provider,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,4,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AiModel) Reset() { + *x = AiModel{} + mi := &file_api_entity_proto_msgTypes[8] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AiModel) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AiModel) ProtoMessage() {} + +func (x *AiModel) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[8] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AiModel.ProtoReflect.Descriptor instead. +func (*AiModel) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{8} +} + +func (x *AiModel) GetAiProvider() string { + if x != nil { + return x.AiProvider + } + return "" +} + +func (x *AiModel) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *AiModel) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *AiModel) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Analytic struct { + state protoimpl.MessageState `protogen:"open.v1"` + Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"` + Category string `protobuf:"bytes,2,opt,name=category,proto3" json:"category,omitempty"` + Desc string `protobuf:"bytes,3,opt,name=desc,proto3" json:"desc,omitempty"` + Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` + RelatedAnalytics []*Analytic `protobuf:"bytes,5,rep,name=related_analytics,json=relatedAnalytics,proto3" json:"related_analytics,omitempty"` + State string `protobuf:"bytes,6,opt,name=state,proto3" json:"state,omitempty"` + StateId Analytic_StateId `protobuf:"varint,7,opt,name=state_id,json=stateId,proto3,enum=ocsf.v1.Analytic_StateId" json:"state_id,omitempty"` + Type string `protobuf:"bytes,8,opt,name=type,proto3" json:"type,omitempty"` + TypeId Analytic_TypeId `protobuf:"varint,9,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Analytic_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,10,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,11,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Analytic) Reset() { + *x = Analytic{} + mi := &file_api_entity_proto_msgTypes[9] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Analytic) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Analytic) ProtoMessage() {} + +func (x *Analytic) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[9] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Analytic.ProtoReflect.Descriptor instead. +func (*Analytic) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{9} +} + +func (x *Analytic) GetAlgorithm() string { + if x != nil { + return x.Algorithm + } + return "" +} + +func (x *Analytic) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *Analytic) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Analytic) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Analytic) GetRelatedAnalytics() []*Analytic { + if x != nil { + return x.RelatedAnalytics + } + return nil +} + +func (x *Analytic) GetState() string { + if x != nil { + return x.State + } + return "" +} + +func (x *Analytic) GetStateId() Analytic_StateId { + if x != nil { + return x.StateId + } + return Analytic_STATE_ID_UNKNOWN +} + +func (x *Analytic) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Analytic) GetTypeId() Analytic_TypeId { + if x != nil { + return x.TypeId + } + return Analytic_TYPE_ID_UNKNOWN +} + +func (x *Analytic) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Analytic) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Api struct { + state protoimpl.MessageState `protogen:"open.v1"` + Group *Group `protobuf:"bytes,1,opt,name=group,proto3" json:"group,omitempty"` + Operation string `protobuf:"bytes,2,opt,name=operation,proto3" json:"operation,omitempty"` + Request *Request `protobuf:"bytes,3,opt,name=request,proto3" json:"request,omitempty"` + Response *Response `protobuf:"bytes,4,opt,name=response,proto3" json:"response,omitempty"` + Service *Service `protobuf:"bytes,5,opt,name=service,proto3" json:"service,omitempty"` + Token *Token `protobuf:"bytes,6,opt,name=token,proto3" json:"token,omitempty"` + Version string `protobuf:"bytes,7,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Api) Reset() { + *x = Api{} + mi := &file_api_entity_proto_msgTypes[10] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Api) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Api) ProtoMessage() {} + +func (x *Api) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[10] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Api.ProtoReflect.Descriptor instead. +func (*Api) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{10} +} + +func (x *Api) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *Api) GetOperation() string { + if x != nil { + return x.Operation + } + return "" +} + +func (x *Api) GetRequest() *Request { + if x != nil { + return x.Request + } + return nil +} + +func (x *Api) GetResponse() *Response { + if x != nil { + return x.Response + } + return nil +} + +func (x *Api) GetService() *Service { + if x != nil { + return x.Service + } + return nil +} + +func (x *Api) GetToken() *Token { + if x != nil { + return x.Token + } + return nil +} + +func (x *Api) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Application struct { + state protoimpl.MessageState `protogen:"open.v1"` + Criticality string `protobuf:"bytes,1,opt,name=criticality,proto3" json:"criticality,omitempty"` + Data *structpb.Value `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"` + Desc string `protobuf:"bytes,3,opt,name=desc,proto3" json:"desc,omitempty"` + Group *Group `protobuf:"bytes,4,opt,name=group,proto3" json:"group,omitempty"` + Hostname string `protobuf:"bytes,5,opt,name=hostname,proto3" json:"hostname,omitempty"` + Labels []string `protobuf:"bytes,6,rep,name=labels,proto3" json:"labels,omitempty"` + Name string `protobuf:"bytes,7,opt,name=name,proto3" json:"name,omitempty"` + Owner *User `protobuf:"bytes,8,opt,name=owner,proto3" json:"owner,omitempty"` + Region string `protobuf:"bytes,9,opt,name=region,proto3" json:"region,omitempty"` + ResourceRelationship *Graph `protobuf:"bytes,10,opt,name=resource_relationship,json=resourceRelationship,proto3" json:"resource_relationship,omitempty"` + RiskLevel string `protobuf:"bytes,11,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId Application_RiskLevelId `protobuf:"varint,12,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.Application_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,13,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Sbom *Sbom `protobuf:"bytes,14,opt,name=sbom,proto3" json:"sbom,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,15,rep,name=tags,proto3" json:"tags,omitempty"` + Type string `protobuf:"bytes,16,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,17,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,18,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + Url *Url `protobuf:"bytes,19,opt,name=url,proto3" json:"url,omitempty"` + Version string `protobuf:"bytes,20,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Application) Reset() { + *x = Application{} + mi := &file_api_entity_proto_msgTypes[11] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Application) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Application) ProtoMessage() {} + +func (x *Application) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[11] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Application.ProtoReflect.Descriptor instead. +func (*Application) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{11} +} + +func (x *Application) GetCriticality() string { + if x != nil { + return x.Criticality + } + return "" +} + +func (x *Application) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Application) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Application) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *Application) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *Application) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Application) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Application) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *Application) GetRegion() string { + if x != nil { + return x.Region + } + return "" +} + +func (x *Application) GetResourceRelationship() *Graph { + if x != nil { + return x.ResourceRelationship + } + return nil +} + +func (x *Application) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *Application) GetRiskLevelId() Application_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return Application_RISK_LEVEL_ID_INFO +} + +func (x *Application) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *Application) GetSbom() *Sbom { + if x != nil { + return x.Sbom + } + return nil +} + +func (x *Application) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Application) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Application) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Application) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *Application) GetUrl() *Url { + if x != nil { + return x.Url + } + return nil +} + +func (x *Application) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Attack struct { + state protoimpl.MessageState `protogen:"open.v1"` + Mitigation *Mitigation `protobuf:"bytes,1,opt,name=mitigation,proto3" json:"mitigation,omitempty"` + SubTechnique *SubTechnique `protobuf:"bytes,2,opt,name=sub_technique,json=subTechnique,proto3" json:"sub_technique,omitempty"` + Tactic *Tactic `protobuf:"bytes,3,opt,name=tactic,proto3" json:"tactic,omitempty"` + Tactics []*Tactic `protobuf:"bytes,4,rep,name=tactics,proto3" json:"tactics,omitempty"` + Technique *Technique `protobuf:"bytes,5,opt,name=technique,proto3" json:"technique,omitempty"` + Version string `protobuf:"bytes,6,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Attack) Reset() { + *x = Attack{} + mi := &file_api_entity_proto_msgTypes[12] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Attack) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Attack) ProtoMessage() {} + +func (x *Attack) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[12] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Attack.ProtoReflect.Descriptor instead. +func (*Attack) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{12} +} + +func (x *Attack) GetMitigation() *Mitigation { + if x != nil { + return x.Mitigation + } + return nil +} + +func (x *Attack) GetSubTechnique() *SubTechnique { + if x != nil { + return x.SubTechnique + } + return nil +} + +func (x *Attack) GetTactic() *Tactic { + if x != nil { + return x.Tactic + } + return nil +} + +func (x *Attack) GetTactics() []*Tactic { + if x != nil { + return x.Tactics + } + return nil +} + +func (x *Attack) GetTechnique() *Technique { + if x != nil { + return x.Technique + } + return nil +} + +func (x *Attack) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type AuthFactor struct { + state protoimpl.MessageState `protogen:"open.v1"` + Device *Device `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"` + EmailAddr string `protobuf:"bytes,2,opt,name=email_addr,json=emailAddr,proto3" json:"email_addr,omitempty"` + FactorType string `protobuf:"bytes,3,opt,name=factor_type,json=factorType,proto3" json:"factor_type,omitempty"` + FactorTypeId AuthFactor_FactorTypeId `protobuf:"varint,4,opt,name=factor_type_id,json=factorTypeId,proto3,enum=ocsf.v1.AuthFactor_FactorTypeId" json:"factor_type_id,omitempty"` + IsHotp bool `protobuf:"varint,5,opt,name=is_hotp,json=isHotp,proto3" json:"is_hotp,omitempty"` + IsTotp bool `protobuf:"varint,6,opt,name=is_totp,json=isTotp,proto3" json:"is_totp,omitempty"` + PhoneNumber string `protobuf:"bytes,7,opt,name=phone_number,json=phoneNumber,proto3" json:"phone_number,omitempty"` + Provider string `protobuf:"bytes,8,opt,name=provider,proto3" json:"provider,omitempty"` + SecurityQuestions []string `protobuf:"bytes,9,rep,name=security_questions,json=securityQuestions,proto3" json:"security_questions,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AuthFactor) Reset() { + *x = AuthFactor{} + mi := &file_api_entity_proto_msgTypes[13] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AuthFactor) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AuthFactor) ProtoMessage() {} + +func (x *AuthFactor) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[13] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AuthFactor.ProtoReflect.Descriptor instead. +func (*AuthFactor) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{13} +} + +func (x *AuthFactor) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *AuthFactor) GetEmailAddr() string { + if x != nil { + return x.EmailAddr + } + return "" +} + +func (x *AuthFactor) GetFactorType() string { + if x != nil { + return x.FactorType + } + return "" +} + +func (x *AuthFactor) GetFactorTypeId() AuthFactor_FactorTypeId { + if x != nil { + return x.FactorTypeId + } + return AuthFactor_FACTOR_TYPE_ID_UNKNOWN +} + +func (x *AuthFactor) GetIsHotp() bool { + if x != nil { + return x.IsHotp + } + return false +} + +func (x *AuthFactor) GetIsTotp() bool { + if x != nil { + return x.IsTotp + } + return false +} + +func (x *AuthFactor) GetPhoneNumber() string { + if x != nil { + return x.PhoneNumber + } + return "" +} + +func (x *AuthFactor) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *AuthFactor) GetSecurityQuestions() []string { + if x != nil { + return x.SecurityQuestions + } + return nil +} + +type Authorization struct { + state protoimpl.MessageState `protogen:"open.v1"` + Decision string `protobuf:"bytes,1,opt,name=decision,proto3" json:"decision,omitempty"` + Policy *Policy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Authorization) Reset() { + *x = Authorization{} + mi := &file_api_entity_proto_msgTypes[14] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Authorization) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Authorization) ProtoMessage() {} + +func (x *Authorization) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[14] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Authorization.ProtoReflect.Descriptor instead. +func (*Authorization) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{14} +} + +func (x *Authorization) GetDecision() string { + if x != nil { + return x.Decision + } + return "" +} + +func (x *Authorization) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +type AutonomousSystem struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Number int32 `protobuf:"varint,2,opt,name=number,proto3" json:"number,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AutonomousSystem) Reset() { + *x = AutonomousSystem{} + mi := &file_api_entity_proto_msgTypes[15] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AutonomousSystem) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AutonomousSystem) ProtoMessage() {} + +func (x *AutonomousSystem) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[15] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AutonomousSystem.ProtoReflect.Descriptor instead. +func (*AutonomousSystem) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{15} +} + +func (x *AutonomousSystem) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *AutonomousSystem) GetNumber() int32 { + if x != nil { + return x.Number + } + return 0 +} + +type Campaign struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Campaign) Reset() { + *x = Campaign{} + mi := &file_api_entity_proto_msgTypes[16] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Campaign) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Campaign) ProtoMessage() {} + +func (x *Campaign) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[16] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Campaign.ProtoReflect.Descriptor instead. +func (*Campaign) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{16} +} + +func (x *Campaign) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +type Certificate struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + ExpirationTime int64 `protobuf:"varint,3,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"` + ExpirationTimeDt string `protobuf:"bytes,4,opt,name=expiration_time_dt,json=expirationTimeDt,proto3" json:"expiration_time_dt,omitempty"` + Fingerprints []*Fingerprint `protobuf:"bytes,5,rep,name=fingerprints,proto3" json:"fingerprints,omitempty"` + IsSelfSigned bool `protobuf:"varint,6,opt,name=is_self_signed,json=isSelfSigned,proto3" json:"is_self_signed,omitempty"` + Issuer string `protobuf:"bytes,7,opt,name=issuer,proto3" json:"issuer,omitempty"` + Sans []*San `protobuf:"bytes,8,rep,name=sans,proto3" json:"sans,omitempty"` + SerialNumber string `protobuf:"bytes,9,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"` + Subject string `protobuf:"bytes,10,opt,name=subject,proto3" json:"subject,omitempty"` + Uid string `protobuf:"bytes,11,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,12,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Certificate) Reset() { + *x = Certificate{} + mi := &file_api_entity_proto_msgTypes[17] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Certificate) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Certificate) ProtoMessage() {} + +func (x *Certificate) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[17] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Certificate.ProtoReflect.Descriptor instead. +func (*Certificate) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{17} +} + +func (x *Certificate) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Certificate) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Certificate) GetExpirationTime() int64 { + if x != nil { + return x.ExpirationTime + } + return 0 +} + +func (x *Certificate) GetExpirationTimeDt() string { + if x != nil { + return x.ExpirationTimeDt + } + return "" +} + +func (x *Certificate) GetFingerprints() []*Fingerprint { + if x != nil { + return x.Fingerprints + } + return nil +} + +func (x *Certificate) GetIsSelfSigned() bool { + if x != nil { + return x.IsSelfSigned + } + return false +} + +func (x *Certificate) GetIssuer() string { + if x != nil { + return x.Issuer + } + return "" +} + +func (x *Certificate) GetSans() []*San { + if x != nil { + return x.Sans + } + return nil +} + +func (x *Certificate) GetSerialNumber() string { + if x != nil { + return x.SerialNumber + } + return "" +} + +func (x *Certificate) GetSubject() string { + if x != nil { + return x.Subject + } + return "" +} + +func (x *Certificate) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Certificate) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type CisControl struct { + state protoimpl.MessageState `protogen:"open.v1"` + Desc string `protobuf:"bytes,1,opt,name=desc,proto3" json:"desc,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CisControl) Reset() { + *x = CisControl{} + mi := &file_api_entity_proto_msgTypes[18] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CisControl) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CisControl) ProtoMessage() {} + +func (x *CisControl) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[18] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CisControl.ProtoReflect.Descriptor instead. +func (*CisControl) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{18} +} + +func (x *CisControl) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *CisControl) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *CisControl) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type ClassifierDetails struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ClassifierDetails) Reset() { + *x = ClassifierDetails{} + mi := &file_api_entity_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ClassifierDetails) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ClassifierDetails) ProtoMessage() {} + +func (x *ClassifierDetails) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ClassifierDetails.ProtoReflect.Descriptor instead. +func (*ClassifierDetails) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{19} +} + +func (x *ClassifierDetails) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ClassifierDetails) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *ClassifierDetails) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Cloud struct { + state protoimpl.MessageState `protogen:"open.v1"` + Account *Account `protobuf:"bytes,1,opt,name=account,proto3" json:"account,omitempty"` + CloudPartition string `protobuf:"bytes,2,opt,name=cloud_partition,json=cloudPartition,proto3" json:"cloud_partition,omitempty"` + Org *Organization `protobuf:"bytes,3,opt,name=org,proto3" json:"org,omitempty"` + ProjectUid string `protobuf:"bytes,4,opt,name=project_uid,json=projectUid,proto3" json:"project_uid,omitempty"` + Provider string `protobuf:"bytes,5,opt,name=provider,proto3" json:"provider,omitempty"` + Region string `protobuf:"bytes,6,opt,name=region,proto3" json:"region,omitempty"` + Zone string `protobuf:"bytes,7,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Cloud) Reset() { + *x = Cloud{} + mi := &file_api_entity_proto_msgTypes[20] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Cloud) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Cloud) ProtoMessage() {} + +func (x *Cloud) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[20] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Cloud.ProtoReflect.Descriptor instead. +func (*Cloud) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{20} +} + +func (x *Cloud) GetAccount() *Account { + if x != nil { + return x.Account + } + return nil +} + +func (x *Cloud) GetCloudPartition() string { + if x != nil { + return x.CloudPartition + } + return "" +} + +func (x *Cloud) GetOrg() *Organization { + if x != nil { + return x.Org + } + return nil +} + +func (x *Cloud) GetProjectUid() string { + if x != nil { + return x.ProjectUid + } + return "" +} + +func (x *Cloud) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *Cloud) GetRegion() string { + if x != nil { + return x.Region + } + return "" +} + +func (x *Cloud) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type Container struct { + state protoimpl.MessageState `protogen:"open.v1"` + Hash *Fingerprint `protobuf:"bytes,1,opt,name=hash,proto3" json:"hash,omitempty"` + Image *Image `protobuf:"bytes,2,opt,name=image,proto3" json:"image,omitempty"` + Labels []string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty"` + Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` + NetworkDriver string `protobuf:"bytes,5,opt,name=network_driver,json=networkDriver,proto3" json:"network_driver,omitempty"` + Orchestrator string `protobuf:"bytes,6,opt,name=orchestrator,proto3" json:"orchestrator,omitempty"` + PodUuid string `protobuf:"bytes,7,opt,name=pod_uuid,json=podUuid,proto3" json:"pod_uuid,omitempty"` + Runtime string `protobuf:"bytes,8,opt,name=runtime,proto3" json:"runtime,omitempty"` + Size int64 `protobuf:"varint,9,opt,name=size,proto3" json:"size,omitempty"` + Tag string `protobuf:"bytes,10,opt,name=tag,proto3" json:"tag,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,11,rep,name=tags,proto3" json:"tags,omitempty"` + Uid string `protobuf:"bytes,12,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Container) Reset() { + *x = Container{} + mi := &file_api_entity_proto_msgTypes[21] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Container) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Container) ProtoMessage() {} + +func (x *Container) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[21] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Container.ProtoReflect.Descriptor instead. +func (*Container) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{21} +} + +func (x *Container) GetHash() *Fingerprint { + if x != nil { + return x.Hash + } + return nil +} + +func (x *Container) GetImage() *Image { + if x != nil { + return x.Image + } + return nil +} + +func (x *Container) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Container) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Container) GetNetworkDriver() string { + if x != nil { + return x.NetworkDriver + } + return "" +} + +func (x *Container) GetOrchestrator() string { + if x != nil { + return x.Orchestrator + } + return "" +} + +func (x *Container) GetPodUuid() string { + if x != nil { + return x.PodUuid + } + return "" +} + +func (x *Container) GetRuntime() string { + if x != nil { + return x.Runtime + } + return "" +} + +func (x *Container) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *Container) GetTag() string { + if x != nil { + return x.Tag + } + return "" +} + +func (x *Container) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Container) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Cve struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Cvss []*Cvss `protobuf:"bytes,3,rep,name=cvss,proto3" json:"cvss,omitempty"` + Cwe *Cwe `protobuf:"bytes,4,opt,name=cwe,proto3" json:"cwe,omitempty"` + CweUid string `protobuf:"bytes,5,opt,name=cwe_uid,json=cweUid,proto3" json:"cwe_uid,omitempty"` + CweUrl string `protobuf:"bytes,6,opt,name=cwe_url,json=cweUrl,proto3" json:"cwe_url,omitempty"` + Desc string `protobuf:"bytes,7,opt,name=desc,proto3" json:"desc,omitempty"` + Epss *Epss `protobuf:"bytes,8,opt,name=epss,proto3" json:"epss,omitempty"` + ModifiedTime int64 `protobuf:"varint,9,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,10,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Product *Product `protobuf:"bytes,11,opt,name=product,proto3" json:"product,omitempty"` + References []string `protobuf:"bytes,12,rep,name=references,proto3" json:"references,omitempty"` + RelatedCwes []*Cwe `protobuf:"bytes,13,rep,name=related_cwes,json=relatedCwes,proto3" json:"related_cwes,omitempty"` + Title string `protobuf:"bytes,14,opt,name=title,proto3" json:"title,omitempty"` + Type string `protobuf:"bytes,15,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,16,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Cve) Reset() { + *x = Cve{} + mi := &file_api_entity_proto_msgTypes[22] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Cve) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Cve) ProtoMessage() {} + +func (x *Cve) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[22] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Cve.ProtoReflect.Descriptor instead. +func (*Cve) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{22} +} + +func (x *Cve) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Cve) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Cve) GetCvss() []*Cvss { + if x != nil { + return x.Cvss + } + return nil +} + +func (x *Cve) GetCwe() *Cwe { + if x != nil { + return x.Cwe + } + return nil +} + +func (x *Cve) GetCweUid() string { + if x != nil { + return x.CweUid + } + return "" +} + +func (x *Cve) GetCweUrl() string { + if x != nil { + return x.CweUrl + } + return "" +} + +func (x *Cve) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Cve) GetEpss() *Epss { + if x != nil { + return x.Epss + } + return nil +} + +func (x *Cve) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Cve) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Cve) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *Cve) GetReferences() []string { + if x != nil { + return x.References + } + return nil +} + +func (x *Cve) GetRelatedCwes() []*Cwe { + if x != nil { + return x.RelatedCwes + } + return nil +} + +func (x *Cve) GetTitle() string { + if x != nil { + return x.Title + } + return "" +} + +func (x *Cve) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Cve) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Cvss struct { + state protoimpl.MessageState `protogen:"open.v1"` + BaseScore float64 `protobuf:"fixed64,1,opt,name=base_score,json=baseScore,proto3" json:"base_score,omitempty"` + Depth string `protobuf:"bytes,2,opt,name=depth,proto3" json:"depth,omitempty"` + Metrics []*Metric `protobuf:"bytes,3,rep,name=metrics,proto3" json:"metrics,omitempty"` + OverallScore float64 `protobuf:"fixed64,4,opt,name=overall_score,json=overallScore,proto3" json:"overall_score,omitempty"` + Severity string `protobuf:"bytes,5,opt,name=severity,proto3" json:"severity,omitempty"` + SrcUrl string `protobuf:"bytes,6,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + VectorString string `protobuf:"bytes,7,opt,name=vector_string,json=vectorString,proto3" json:"vector_string,omitempty"` + VendorName string `protobuf:"bytes,8,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,9,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Cvss) Reset() { + *x = Cvss{} + mi := &file_api_entity_proto_msgTypes[23] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Cvss) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Cvss) ProtoMessage() {} + +func (x *Cvss) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[23] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Cvss.ProtoReflect.Descriptor instead. +func (*Cvss) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{23} +} + +func (x *Cvss) GetBaseScore() float64 { + if x != nil { + return x.BaseScore + } + return 0 +} + +func (x *Cvss) GetDepth() string { + if x != nil { + return x.Depth + } + return "" +} + +func (x *Cvss) GetMetrics() []*Metric { + if x != nil { + return x.Metrics + } + return nil +} + +func (x *Cvss) GetOverallScore() float64 { + if x != nil { + return x.OverallScore + } + return 0 +} + +func (x *Cvss) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *Cvss) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Cvss) GetVectorString() string { + if x != nil { + return x.VectorString + } + return "" +} + +func (x *Cvss) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Cvss) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Cwe struct { + state protoimpl.MessageState `protogen:"open.v1"` + Caption string `protobuf:"bytes,1,opt,name=caption,proto3" json:"caption,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Cwe) Reset() { + *x = Cwe{} + mi := &file_api_entity_proto_msgTypes[24] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Cwe) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Cwe) ProtoMessage() {} + +func (x *Cwe) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[24] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Cwe.ProtoReflect.Descriptor instead. +func (*Cwe) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{24} +} + +func (x *Cwe) GetCaption() string { + if x != nil { + return x.Caption + } + return "" +} + +func (x *Cwe) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Cwe) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type D3FTactic struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *D3FTactic) Reset() { + *x = D3FTactic{} + mi := &file_api_entity_proto_msgTypes[25] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *D3FTactic) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*D3FTactic) ProtoMessage() {} + +func (x *D3FTactic) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[25] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use D3FTactic.ProtoReflect.Descriptor instead. +func (*D3FTactic) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{25} +} + +func (x *D3FTactic) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *D3FTactic) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *D3FTactic) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type D3FTechnique struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *D3FTechnique) Reset() { + *x = D3FTechnique{} + mi := &file_api_entity_proto_msgTypes[26] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *D3FTechnique) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*D3FTechnique) ProtoMessage() {} + +func (x *D3FTechnique) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[26] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use D3FTechnique.ProtoReflect.Descriptor instead. +func (*D3FTechnique) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{26} +} + +func (x *D3FTechnique) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *D3FTechnique) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *D3FTechnique) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type D3Fend struct { + state protoimpl.MessageState `protogen:"open.v1"` + D3FTactic *D3FTactic `protobuf:"bytes,1,opt,name=d3f_tactic,json=d3fTactic,proto3" json:"d3f_tactic,omitempty"` + D3FTechnique *D3FTechnique `protobuf:"bytes,2,opt,name=d3f_technique,json=d3fTechnique,proto3" json:"d3f_technique,omitempty"` + Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *D3Fend) Reset() { + *x = D3Fend{} + mi := &file_api_entity_proto_msgTypes[27] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *D3Fend) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*D3Fend) ProtoMessage() {} + +func (x *D3Fend) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[27] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use D3Fend.ProtoReflect.Descriptor instead. +func (*D3Fend) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{27} +} + +func (x *D3Fend) GetD3FTactic() *D3FTactic { + if x != nil { + return x.D3FTactic + } + return nil +} + +func (x *D3Fend) GetD3FTechnique() *D3FTechnique { + if x != nil { + return x.D3FTechnique + } + return nil +} + +func (x *D3Fend) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type DataClassification struct { + state protoimpl.MessageState `protogen:"open.v1"` + Category string `protobuf:"bytes,1,opt,name=category,proto3" json:"category,omitempty"` + CategoryId DataClassification_CategoryId `protobuf:"varint,2,opt,name=category_id,json=categoryId,proto3,enum=ocsf.v1.DataClassification_CategoryId" json:"category_id,omitempty"` + ClassifierDetails *ClassifierDetails `protobuf:"bytes,3,opt,name=classifier_details,json=classifierDetails,proto3" json:"classifier_details,omitempty"` + Confidentiality string `protobuf:"bytes,4,opt,name=confidentiality,proto3" json:"confidentiality,omitempty"` + ConfidentialityId DataClassification_ConfidentialityId `protobuf:"varint,5,opt,name=confidentiality_id,json=confidentialityId,proto3,enum=ocsf.v1.DataClassification_ConfidentialityId" json:"confidentiality_id,omitempty"` + DiscoveryDetails []*DiscoveryDetails `protobuf:"bytes,6,rep,name=discovery_details,json=discoveryDetails,proto3" json:"discovery_details,omitempty"` + Policy *Policy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"` + Size int64 `protobuf:"varint,8,opt,name=size,proto3" json:"size,omitempty"` + SrcUrl string `protobuf:"bytes,9,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Status string `protobuf:"bytes,10,opt,name=status,proto3" json:"status,omitempty"` + StatusDetails []string `protobuf:"bytes,11,rep,name=status_details,json=statusDetails,proto3" json:"status_details,omitempty"` + StatusId DataClassification_StatusId `protobuf:"varint,12,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.DataClassification_StatusId" json:"status_id,omitempty"` + Total int32 `protobuf:"varint,13,opt,name=total,proto3" json:"total,omitempty"` + Uid string `protobuf:"bytes,14,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DataClassification) Reset() { + *x = DataClassification{} + mi := &file_api_entity_proto_msgTypes[28] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DataClassification) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DataClassification) ProtoMessage() {} + +func (x *DataClassification) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[28] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DataClassification.ProtoReflect.Descriptor instead. +func (*DataClassification) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{28} +} + +func (x *DataClassification) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *DataClassification) GetCategoryId() DataClassification_CategoryId { + if x != nil { + return x.CategoryId + } + return DataClassification_CATEGORY_ID_UNKNOWN +} + +func (x *DataClassification) GetClassifierDetails() *ClassifierDetails { + if x != nil { + return x.ClassifierDetails + } + return nil +} + +func (x *DataClassification) GetConfidentiality() string { + if x != nil { + return x.Confidentiality + } + return "" +} + +func (x *DataClassification) GetConfidentialityId() DataClassification_ConfidentialityId { + if x != nil { + return x.ConfidentialityId + } + return DataClassification_CONFIDENTIALITY_ID_UNKNOWN +} + +func (x *DataClassification) GetDiscoveryDetails() []*DiscoveryDetails { + if x != nil { + return x.DiscoveryDetails + } + return nil +} + +func (x *DataClassification) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *DataClassification) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *DataClassification) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *DataClassification) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *DataClassification) GetStatusDetails() []string { + if x != nil { + return x.StatusDetails + } + return nil +} + +func (x *DataClassification) GetStatusId() DataClassification_StatusId { + if x != nil { + return x.StatusId + } + return DataClassification_STATUS_ID_UNKNOWN +} + +func (x *DataClassification) GetTotal() int32 { + if x != nil { + return x.Total + } + return 0 +} + +func (x *DataClassification) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Device struct { + state protoimpl.MessageState `protogen:"open.v1"` + AgentList []*Agent `protobuf:"bytes,1,rep,name=agent_list,json=agentList,proto3" json:"agent_list,omitempty"` + AutoscaleUid string `protobuf:"bytes,2,opt,name=autoscale_uid,json=autoscaleUid,proto3" json:"autoscale_uid,omitempty"` + BootTime int64 `protobuf:"varint,3,opt,name=boot_time,json=bootTime,proto3" json:"boot_time,omitempty"` + BootTimeDt string `protobuf:"bytes,4,opt,name=boot_time_dt,json=bootTimeDt,proto3" json:"boot_time_dt,omitempty"` + BootUid string `protobuf:"bytes,5,opt,name=boot_uid,json=bootUid,proto3" json:"boot_uid,omitempty"` + Container *Container `protobuf:"bytes,6,opt,name=container,proto3" json:"container,omitempty"` + CreatedTime int64 `protobuf:"varint,7,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,8,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Desc string `protobuf:"bytes,9,opt,name=desc,proto3" json:"desc,omitempty"` + Domain string `protobuf:"bytes,10,opt,name=domain,proto3" json:"domain,omitempty"` + Eid string `protobuf:"bytes,11,opt,name=eid,proto3" json:"eid,omitempty"` + FirstSeenTime int64 `protobuf:"varint,12,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"` + FirstSeenTimeDt string `protobuf:"bytes,13,opt,name=first_seen_time_dt,json=firstSeenTimeDt,proto3" json:"first_seen_time_dt,omitempty"` + Groups []*Group `protobuf:"bytes,14,rep,name=groups,proto3" json:"groups,omitempty"` + Hostname string `protobuf:"bytes,15,opt,name=hostname,proto3" json:"hostname,omitempty"` + HwInfo *DeviceHwInfo `protobuf:"bytes,16,opt,name=hw_info,json=hwInfo,proto3" json:"hw_info,omitempty"` + Hypervisor string `protobuf:"bytes,17,opt,name=hypervisor,proto3" json:"hypervisor,omitempty"` + Iccid string `protobuf:"bytes,18,opt,name=iccid,proto3" json:"iccid,omitempty"` + Image *Image `protobuf:"bytes,19,opt,name=image,proto3" json:"image,omitempty"` + Imei string `protobuf:"bytes,20,opt,name=imei,proto3" json:"imei,omitempty"` + ImeiList []string `protobuf:"bytes,21,rep,name=imei_list,json=imeiList,proto3" json:"imei_list,omitempty"` + InstanceUid string `protobuf:"bytes,22,opt,name=instance_uid,json=instanceUid,proto3" json:"instance_uid,omitempty"` + InterfaceName string `protobuf:"bytes,23,opt,name=interface_name,json=interfaceName,proto3" json:"interface_name,omitempty"` + InterfaceUid string `protobuf:"bytes,24,opt,name=interface_uid,json=interfaceUid,proto3" json:"interface_uid,omitempty"` + Ip string `protobuf:"bytes,25,opt,name=ip,proto3" json:"ip,omitempty"` + IsBackedUp bool `protobuf:"varint,26,opt,name=is_backed_up,json=isBackedUp,proto3" json:"is_backed_up,omitempty"` + IsCompliant bool `protobuf:"varint,27,opt,name=is_compliant,json=isCompliant,proto3" json:"is_compliant,omitempty"` + IsManaged bool `protobuf:"varint,28,opt,name=is_managed,json=isManaged,proto3" json:"is_managed,omitempty"` + IsMobileAccountActive bool `protobuf:"varint,29,opt,name=is_mobile_account_active,json=isMobileAccountActive,proto3" json:"is_mobile_account_active,omitempty"` + IsPersonal bool `protobuf:"varint,30,opt,name=is_personal,json=isPersonal,proto3" json:"is_personal,omitempty"` + IsShared bool `protobuf:"varint,31,opt,name=is_shared,json=isShared,proto3" json:"is_shared,omitempty"` + IsSupervised bool `protobuf:"varint,32,opt,name=is_supervised,json=isSupervised,proto3" json:"is_supervised,omitempty"` + IsTrusted bool `protobuf:"varint,33,opt,name=is_trusted,json=isTrusted,proto3" json:"is_trusted,omitempty"` + LastSeenTime int64 `protobuf:"varint,34,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"` + LastSeenTimeDt string `protobuf:"bytes,35,opt,name=last_seen_time_dt,json=lastSeenTimeDt,proto3" json:"last_seen_time_dt,omitempty"` + Location *Location `protobuf:"bytes,36,opt,name=location,proto3" json:"location,omitempty"` + Mac string `protobuf:"bytes,37,opt,name=mac,proto3" json:"mac,omitempty"` + MacVendor string `protobuf:"bytes,38,opt,name=mac_vendor,json=macVendor,proto3" json:"mac_vendor,omitempty"` + Meid string `protobuf:"bytes,39,opt,name=meid,proto3" json:"meid,omitempty"` + Model string `protobuf:"bytes,40,opt,name=model,proto3" json:"model,omitempty"` + ModifiedTime int64 `protobuf:"varint,41,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,42,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,43,opt,name=name,proto3" json:"name,omitempty"` + NamespacePid int32 `protobuf:"varint,44,opt,name=namespace_pid,json=namespacePid,proto3" json:"namespace_pid,omitempty"` + NetworkInterfaces []*NetworkInterface `protobuf:"bytes,45,rep,name=network_interfaces,json=networkInterfaces,proto3" json:"network_interfaces,omitempty"` + Org *Organization `protobuf:"bytes,46,opt,name=org,proto3" json:"org,omitempty"` + Os *Os `protobuf:"bytes,47,opt,name=os,proto3" json:"os,omitempty"` + OsMachineUuid string `protobuf:"bytes,48,opt,name=os_machine_uuid,json=osMachineUuid,proto3" json:"os_machine_uuid,omitempty"` + Owner *User `protobuf:"bytes,49,opt,name=owner,proto3" json:"owner,omitempty"` + Pool *Group `protobuf:"bytes,50,opt,name=pool,proto3" json:"pool,omitempty"` + Region string `protobuf:"bytes,51,opt,name=region,proto3" json:"region,omitempty"` + RiskLevel string `protobuf:"bytes,52,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId Device_RiskLevelId `protobuf:"varint,53,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.Device_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,54,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Subnet string `protobuf:"bytes,55,opt,name=subnet,proto3" json:"subnet,omitempty"` + SubnetUid string `protobuf:"bytes,56,opt,name=subnet_uid,json=subnetUid,proto3" json:"subnet_uid,omitempty"` + Type string `protobuf:"bytes,57,opt,name=type,proto3" json:"type,omitempty"` + TypeId Device_TypeId `protobuf:"varint,58,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Device_TypeId" json:"type_id,omitempty"` + Udid string `protobuf:"bytes,59,opt,name=udid,proto3" json:"udid,omitempty"` + Uid string `protobuf:"bytes,60,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,61,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + VendorName string `protobuf:"bytes,62,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + VlanUid string `protobuf:"bytes,63,opt,name=vlan_uid,json=vlanUid,proto3" json:"vlan_uid,omitempty"` + VpcUid string `protobuf:"bytes,64,opt,name=vpc_uid,json=vpcUid,proto3" json:"vpc_uid,omitempty"` + Zone string `protobuf:"bytes,65,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Device) Reset() { + *x = Device{} + mi := &file_api_entity_proto_msgTypes[29] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Device) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Device) ProtoMessage() {} + +func (x *Device) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[29] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Device.ProtoReflect.Descriptor instead. +func (*Device) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{29} +} + +func (x *Device) GetAgentList() []*Agent { + if x != nil { + return x.AgentList + } + return nil +} + +func (x *Device) GetAutoscaleUid() string { + if x != nil { + return x.AutoscaleUid + } + return "" +} + +func (x *Device) GetBootTime() int64 { + if x != nil { + return x.BootTime + } + return 0 +} + +func (x *Device) GetBootTimeDt() string { + if x != nil { + return x.BootTimeDt + } + return "" +} + +func (x *Device) GetBootUid() string { + if x != nil { + return x.BootUid + } + return "" +} + +func (x *Device) GetContainer() *Container { + if x != nil { + return x.Container + } + return nil +} + +func (x *Device) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Device) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Device) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Device) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *Device) GetEid() string { + if x != nil { + return x.Eid + } + return "" +} + +func (x *Device) GetFirstSeenTime() int64 { + if x != nil { + return x.FirstSeenTime + } + return 0 +} + +func (x *Device) GetFirstSeenTimeDt() string { + if x != nil { + return x.FirstSeenTimeDt + } + return "" +} + +func (x *Device) GetGroups() []*Group { + if x != nil { + return x.Groups + } + return nil +} + +func (x *Device) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *Device) GetHwInfo() *DeviceHwInfo { + if x != nil { + return x.HwInfo + } + return nil +} + +func (x *Device) GetHypervisor() string { + if x != nil { + return x.Hypervisor + } + return "" +} + +func (x *Device) GetIccid() string { + if x != nil { + return x.Iccid + } + return "" +} + +func (x *Device) GetImage() *Image { + if x != nil { + return x.Image + } + return nil +} + +func (x *Device) GetImei() string { + if x != nil { + return x.Imei + } + return "" +} + +func (x *Device) GetImeiList() []string { + if x != nil { + return x.ImeiList + } + return nil +} + +func (x *Device) GetInstanceUid() string { + if x != nil { + return x.InstanceUid + } + return "" +} + +func (x *Device) GetInterfaceName() string { + if x != nil { + return x.InterfaceName + } + return "" +} + +func (x *Device) GetInterfaceUid() string { + if x != nil { + return x.InterfaceUid + } + return "" +} + +func (x *Device) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *Device) GetIsBackedUp() bool { + if x != nil { + return x.IsBackedUp + } + return false +} + +func (x *Device) GetIsCompliant() bool { + if x != nil { + return x.IsCompliant + } + return false +} + +func (x *Device) GetIsManaged() bool { + if x != nil { + return x.IsManaged + } + return false +} + +func (x *Device) GetIsMobileAccountActive() bool { + if x != nil { + return x.IsMobileAccountActive + } + return false +} + +func (x *Device) GetIsPersonal() bool { + if x != nil { + return x.IsPersonal + } + return false +} + +func (x *Device) GetIsShared() bool { + if x != nil { + return x.IsShared + } + return false +} + +func (x *Device) GetIsSupervised() bool { + if x != nil { + return x.IsSupervised + } + return false +} + +func (x *Device) GetIsTrusted() bool { + if x != nil { + return x.IsTrusted + } + return false +} + +func (x *Device) GetLastSeenTime() int64 { + if x != nil { + return x.LastSeenTime + } + return 0 +} + +func (x *Device) GetLastSeenTimeDt() string { + if x != nil { + return x.LastSeenTimeDt + } + return "" +} + +func (x *Device) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *Device) GetMac() string { + if x != nil { + return x.Mac + } + return "" +} + +func (x *Device) GetMacVendor() string { + if x != nil { + return x.MacVendor + } + return "" +} + +func (x *Device) GetMeid() string { + if x != nil { + return x.Meid + } + return "" +} + +func (x *Device) GetModel() string { + if x != nil { + return x.Model + } + return "" +} + +func (x *Device) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Device) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Device) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Device) GetNamespacePid() int32 { + if x != nil { + return x.NamespacePid + } + return 0 +} + +func (x *Device) GetNetworkInterfaces() []*NetworkInterface { + if x != nil { + return x.NetworkInterfaces + } + return nil +} + +func (x *Device) GetOrg() *Organization { + if x != nil { + return x.Org + } + return nil +} + +func (x *Device) GetOs() *Os { + if x != nil { + return x.Os + } + return nil +} + +func (x *Device) GetOsMachineUuid() string { + if x != nil { + return x.OsMachineUuid + } + return "" +} + +func (x *Device) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *Device) GetPool() *Group { + if x != nil { + return x.Pool + } + return nil +} + +func (x *Device) GetRegion() string { + if x != nil { + return x.Region + } + return "" +} + +func (x *Device) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *Device) GetRiskLevelId() Device_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return Device_RISK_LEVEL_ID_INFO +} + +func (x *Device) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *Device) GetSubnet() string { + if x != nil { + return x.Subnet + } + return "" +} + +func (x *Device) GetSubnetUid() string { + if x != nil { + return x.SubnetUid + } + return "" +} + +func (x *Device) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Device) GetTypeId() Device_TypeId { + if x != nil { + return x.TypeId + } + return Device_TYPE_ID_UNKNOWN +} + +func (x *Device) GetUdid() string { + if x != nil { + return x.Udid + } + return "" +} + +func (x *Device) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Device) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *Device) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Device) GetVlanUid() string { + if x != nil { + return x.VlanUid + } + return "" +} + +func (x *Device) GetVpcUid() string { + if x != nil { + return x.VpcUid + } + return "" +} + +func (x *Device) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type DeviceHwInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + BiosDate string `protobuf:"bytes,1,opt,name=bios_date,json=biosDate,proto3" json:"bios_date,omitempty"` + BiosManufacturer string `protobuf:"bytes,2,opt,name=bios_manufacturer,json=biosManufacturer,proto3" json:"bios_manufacturer,omitempty"` + BiosVer string `protobuf:"bytes,3,opt,name=bios_ver,json=biosVer,proto3" json:"bios_ver,omitempty"` + Chassis string `protobuf:"bytes,4,opt,name=chassis,proto3" json:"chassis,omitempty"` + CpuArchitecture string `protobuf:"bytes,5,opt,name=cpu_architecture,json=cpuArchitecture,proto3" json:"cpu_architecture,omitempty"` + CpuArchitectureId DeviceHwInfo_CpuArchitectureId `protobuf:"varint,6,opt,name=cpu_architecture_id,json=cpuArchitectureId,proto3,enum=ocsf.v1.DeviceHwInfo_CpuArchitectureId" json:"cpu_architecture_id,omitempty"` + CpuBits int32 `protobuf:"varint,7,opt,name=cpu_bits,json=cpuBits,proto3" json:"cpu_bits,omitempty"` + CpuCores int32 `protobuf:"varint,8,opt,name=cpu_cores,json=cpuCores,proto3" json:"cpu_cores,omitempty"` + CpuCount int32 `protobuf:"varint,9,opt,name=cpu_count,json=cpuCount,proto3" json:"cpu_count,omitempty"` + CpuSpeed int32 `protobuf:"varint,10,opt,name=cpu_speed,json=cpuSpeed,proto3" json:"cpu_speed,omitempty"` + CpuType string `protobuf:"bytes,11,opt,name=cpu_type,json=cpuType,proto3" json:"cpu_type,omitempty"` + DesktopDisplay *Display `protobuf:"bytes,12,opt,name=desktop_display,json=desktopDisplay,proto3" json:"desktop_display,omitempty"` + GpuCount int32 `protobuf:"varint,13,opt,name=gpu_count,json=gpuCount,proto3" json:"gpu_count,omitempty"` + GpuInfoList []*GpuInfo `protobuf:"bytes,14,rep,name=gpu_info_list,json=gpuInfoList,proto3" json:"gpu_info_list,omitempty"` + KeyboardInfo *KeyboardInfo `protobuf:"bytes,15,opt,name=keyboard_info,json=keyboardInfo,proto3" json:"keyboard_info,omitempty"` + RamSize int32 `protobuf:"varint,16,opt,name=ram_size,json=ramSize,proto3" json:"ram_size,omitempty"` + SerialNumber string `protobuf:"bytes,17,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"` + Uuid string `protobuf:"bytes,18,opt,name=uuid,proto3" json:"uuid,omitempty"` + VendorName string `protobuf:"bytes,19,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeviceHwInfo) Reset() { + *x = DeviceHwInfo{} + mi := &file_api_entity_proto_msgTypes[30] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DeviceHwInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DeviceHwInfo) ProtoMessage() {} + +func (x *DeviceHwInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[30] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DeviceHwInfo.ProtoReflect.Descriptor instead. +func (*DeviceHwInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{30} +} + +func (x *DeviceHwInfo) GetBiosDate() string { + if x != nil { + return x.BiosDate + } + return "" +} + +func (x *DeviceHwInfo) GetBiosManufacturer() string { + if x != nil { + return x.BiosManufacturer + } + return "" +} + +func (x *DeviceHwInfo) GetBiosVer() string { + if x != nil { + return x.BiosVer + } + return "" +} + +func (x *DeviceHwInfo) GetChassis() string { + if x != nil { + return x.Chassis + } + return "" +} + +func (x *DeviceHwInfo) GetCpuArchitecture() string { + if x != nil { + return x.CpuArchitecture + } + return "" +} + +func (x *DeviceHwInfo) GetCpuArchitectureId() DeviceHwInfo_CpuArchitectureId { + if x != nil { + return x.CpuArchitectureId + } + return DeviceHwInfo_CPU_ARCHITECTURE_ID_UNKNOWN +} + +func (x *DeviceHwInfo) GetCpuBits() int32 { + if x != nil { + return x.CpuBits + } + return 0 +} + +func (x *DeviceHwInfo) GetCpuCores() int32 { + if x != nil { + return x.CpuCores + } + return 0 +} + +func (x *DeviceHwInfo) GetCpuCount() int32 { + if x != nil { + return x.CpuCount + } + return 0 +} + +func (x *DeviceHwInfo) GetCpuSpeed() int32 { + if x != nil { + return x.CpuSpeed + } + return 0 +} + +func (x *DeviceHwInfo) GetCpuType() string { + if x != nil { + return x.CpuType + } + return "" +} + +func (x *DeviceHwInfo) GetDesktopDisplay() *Display { + if x != nil { + return x.DesktopDisplay + } + return nil +} + +func (x *DeviceHwInfo) GetGpuCount() int32 { + if x != nil { + return x.GpuCount + } + return 0 +} + +func (x *DeviceHwInfo) GetGpuInfoList() []*GpuInfo { + if x != nil { + return x.GpuInfoList + } + return nil +} + +func (x *DeviceHwInfo) GetKeyboardInfo() *KeyboardInfo { + if x != nil { + return x.KeyboardInfo + } + return nil +} + +func (x *DeviceHwInfo) GetRamSize() int32 { + if x != nil { + return x.RamSize + } + return 0 +} + +func (x *DeviceHwInfo) GetSerialNumber() string { + if x != nil { + return x.SerialNumber + } + return "" +} + +func (x *DeviceHwInfo) GetUuid() string { + if x != nil { + return x.Uuid + } + return "" +} + +func (x *DeviceHwInfo) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +type DigitalSignature struct { + state protoimpl.MessageState `protogen:"open.v1"` + Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"` + AlgorithmId DigitalSignature_AlgorithmId `protobuf:"varint,2,opt,name=algorithm_id,json=algorithmId,proto3,enum=ocsf.v1.DigitalSignature_AlgorithmId" json:"algorithm_id,omitempty"` + Certificate *Certificate `protobuf:"bytes,3,opt,name=certificate,proto3" json:"certificate,omitempty"` + CreatedTime int64 `protobuf:"varint,4,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,5,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + DeveloperUid string `protobuf:"bytes,6,opt,name=developer_uid,json=developerUid,proto3" json:"developer_uid,omitempty"` + Digest *Fingerprint `protobuf:"bytes,7,opt,name=digest,proto3" json:"digest,omitempty"` + State string `protobuf:"bytes,8,opt,name=state,proto3" json:"state,omitempty"` + StateId DigitalSignature_StateId `protobuf:"varint,9,opt,name=state_id,json=stateId,proto3,enum=ocsf.v1.DigitalSignature_StateId" json:"state_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DigitalSignature) Reset() { + *x = DigitalSignature{} + mi := &file_api_entity_proto_msgTypes[31] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DigitalSignature) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DigitalSignature) ProtoMessage() {} + +func (x *DigitalSignature) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[31] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DigitalSignature.ProtoReflect.Descriptor instead. +func (*DigitalSignature) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{31} +} + +func (x *DigitalSignature) GetAlgorithm() string { + if x != nil { + return x.Algorithm + } + return "" +} + +func (x *DigitalSignature) GetAlgorithmId() DigitalSignature_AlgorithmId { + if x != nil { + return x.AlgorithmId + } + return DigitalSignature_ALGORITHM_ID_UNKNOWN +} + +func (x *DigitalSignature) GetCertificate() *Certificate { + if x != nil { + return x.Certificate + } + return nil +} + +func (x *DigitalSignature) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *DigitalSignature) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *DigitalSignature) GetDeveloperUid() string { + if x != nil { + return x.DeveloperUid + } + return "" +} + +func (x *DigitalSignature) GetDigest() *Fingerprint { + if x != nil { + return x.Digest + } + return nil +} + +func (x *DigitalSignature) GetState() string { + if x != nil { + return x.State + } + return "" +} + +func (x *DigitalSignature) GetStateId() DigitalSignature_StateId { + if x != nil { + return x.StateId + } + return DigitalSignature_STATE_ID_UNKNOWN +} + +type DiscoveryDetails struct { + state protoimpl.MessageState `protogen:"open.v1"` + Count int32 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"` + OccurrenceDetails *OccurrenceDetails `protobuf:"bytes,2,opt,name=occurrence_details,json=occurrenceDetails,proto3" json:"occurrence_details,omitempty"` + Occurrences []*OccurrenceDetails `protobuf:"bytes,3,rep,name=occurrences,proto3" json:"occurrences,omitempty"` + Type string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"` + Value string `protobuf:"bytes,5,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DiscoveryDetails) Reset() { + *x = DiscoveryDetails{} + mi := &file_api_entity_proto_msgTypes[32] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DiscoveryDetails) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DiscoveryDetails) ProtoMessage() {} + +func (x *DiscoveryDetails) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[32] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DiscoveryDetails.ProtoReflect.Descriptor instead. +func (*DiscoveryDetails) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{32} +} + +func (x *DiscoveryDetails) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *DiscoveryDetails) GetOccurrenceDetails() *OccurrenceDetails { + if x != nil { + return x.OccurrenceDetails + } + return nil +} + +func (x *DiscoveryDetails) GetOccurrences() []*OccurrenceDetails { + if x != nil { + return x.Occurrences + } + return nil +} + +func (x *DiscoveryDetails) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *DiscoveryDetails) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type Display struct { + state protoimpl.MessageState `protogen:"open.v1"` + ColorDepth int32 `protobuf:"varint,1,opt,name=color_depth,json=colorDepth,proto3" json:"color_depth,omitempty"` + PhysicalHeight int32 `protobuf:"varint,2,opt,name=physical_height,json=physicalHeight,proto3" json:"physical_height,omitempty"` + PhysicalOrientation int32 `protobuf:"varint,3,opt,name=physical_orientation,json=physicalOrientation,proto3" json:"physical_orientation,omitempty"` + PhysicalWidth int32 `protobuf:"varint,4,opt,name=physical_width,json=physicalWidth,proto3" json:"physical_width,omitempty"` + ScaleFactor int32 `protobuf:"varint,5,opt,name=scale_factor,json=scaleFactor,proto3" json:"scale_factor,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Display) Reset() { + *x = Display{} + mi := &file_api_entity_proto_msgTypes[33] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Display) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Display) ProtoMessage() {} + +func (x *Display) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[33] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Display.ProtoReflect.Descriptor instead. +func (*Display) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{33} +} + +func (x *Display) GetColorDepth() int32 { + if x != nil { + return x.ColorDepth + } + return 0 +} + +func (x *Display) GetPhysicalHeight() int32 { + if x != nil { + return x.PhysicalHeight + } + return 0 +} + +func (x *Display) GetPhysicalOrientation() int32 { + if x != nil { + return x.PhysicalOrientation + } + return 0 +} + +func (x *Display) GetPhysicalWidth() int32 { + if x != nil { + return x.PhysicalWidth + } + return 0 +} + +func (x *Display) GetScaleFactor() int32 { + if x != nil { + return x.ScaleFactor + } + return 0 +} + +type DnsAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + Class string `protobuf:"bytes,1,opt,name=class,proto3" json:"class,omitempty"` + FlagIds []DnsAnswer_FlagIds `protobuf:"varint,2,rep,packed,name=flag_ids,json=flagIds,proto3,enum=ocsf.v1.DnsAnswer_FlagIds" json:"flag_ids,omitempty"` + Flags []string `protobuf:"bytes,3,rep,name=flags,proto3" json:"flags,omitempty"` + PacketUid int32 `protobuf:"varint,4,opt,name=packet_uid,json=packetUid,proto3" json:"packet_uid,omitempty"` + Rdata string `protobuf:"bytes,5,opt,name=rdata,proto3" json:"rdata,omitempty"` + Ttl int32 `protobuf:"varint,6,opt,name=ttl,proto3" json:"ttl,omitempty"` + Type string `protobuf:"bytes,7,opt,name=type,proto3" json:"type,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DnsAnswer) Reset() { + *x = DnsAnswer{} + mi := &file_api_entity_proto_msgTypes[34] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DnsAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DnsAnswer) ProtoMessage() {} + +func (x *DnsAnswer) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[34] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DnsAnswer.ProtoReflect.Descriptor instead. +func (*DnsAnswer) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{34} +} + +func (x *DnsAnswer) GetClass() string { + if x != nil { + return x.Class + } + return "" +} + +func (x *DnsAnswer) GetFlagIds() []DnsAnswer_FlagIds { + if x != nil { + return x.FlagIds + } + return nil +} + +func (x *DnsAnswer) GetFlags() []string { + if x != nil { + return x.Flags + } + return nil +} + +func (x *DnsAnswer) GetPacketUid() int32 { + if x != nil { + return x.PacketUid + } + return 0 +} + +func (x *DnsAnswer) GetRdata() string { + if x != nil { + return x.Rdata + } + return "" +} + +func (x *DnsAnswer) GetTtl() int32 { + if x != nil { + return x.Ttl + } + return 0 +} + +func (x *DnsAnswer) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +type DomainContact struct { + state protoimpl.MessageState `protogen:"open.v1"` + EmailAddr string `protobuf:"bytes,1,opt,name=email_addr,json=emailAddr,proto3" json:"email_addr,omitempty"` + Location *Location `protobuf:"bytes,2,opt,name=location,proto3" json:"location,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + PhoneNumber string `protobuf:"bytes,4,opt,name=phone_number,json=phoneNumber,proto3" json:"phone_number,omitempty"` + Type string `protobuf:"bytes,5,opt,name=type,proto3" json:"type,omitempty"` + TypeId DomainContact_TypeId `protobuf:"varint,6,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.DomainContact_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,7,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DomainContact) Reset() { + *x = DomainContact{} + mi := &file_api_entity_proto_msgTypes[35] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DomainContact) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DomainContact) ProtoMessage() {} + +func (x *DomainContact) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[35] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DomainContact.ProtoReflect.Descriptor instead. +func (*DomainContact) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{35} +} + +func (x *DomainContact) GetEmailAddr() string { + if x != nil { + return x.EmailAddr + } + return "" +} + +func (x *DomainContact) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *DomainContact) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *DomainContact) GetPhoneNumber() string { + if x != nil { + return x.PhoneNumber + } + return "" +} + +func (x *DomainContact) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *DomainContact) GetTypeId() DomainContact_TypeId { + if x != nil { + return x.TypeId + } + return DomainContact_TYPE_ID_UNKNOWN +} + +func (x *DomainContact) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Edge struct { + state protoimpl.MessageState `protogen:"open.v1"` + Data *structpb.Value `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` + IsDirected bool `protobuf:"varint,2,opt,name=is_directed,json=isDirected,proto3" json:"is_directed,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + Relation string `protobuf:"bytes,4,opt,name=relation,proto3" json:"relation,omitempty"` + Source string `protobuf:"bytes,5,opt,name=source,proto3" json:"source,omitempty"` + Target string `protobuf:"bytes,6,opt,name=target,proto3" json:"target,omitempty"` + Uid string `protobuf:"bytes,7,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Edge) Reset() { + *x = Edge{} + mi := &file_api_entity_proto_msgTypes[36] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Edge) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Edge) ProtoMessage() {} + +func (x *Edge) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[36] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Edge.ProtoReflect.Descriptor instead. +func (*Edge) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{36} +} + +func (x *Edge) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Edge) GetIsDirected() bool { + if x != nil { + return x.IsDirected + } + return false +} + +func (x *Edge) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Edge) GetRelation() string { + if x != nil { + return x.Relation + } + return "" +} + +func (x *Edge) GetSource() string { + if x != nil { + return x.Source + } + return "" +} + +func (x *Edge) GetTarget() string { + if x != nil { + return x.Target + } + return "" +} + +func (x *Edge) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Email struct { + state protoimpl.MessageState `protogen:"open.v1"` + Cc []string `protobuf:"bytes,1,rep,name=cc,proto3" json:"cc,omitempty"` + CcMailboxes []string `protobuf:"bytes,2,rep,name=cc_mailboxes,json=ccMailboxes,proto3" json:"cc_mailboxes,omitempty"` + DataClassification *DataClassification `protobuf:"bytes,3,opt,name=data_classification,json=dataClassification,proto3" json:"data_classification,omitempty"` + DataClassifications []*DataClassification `protobuf:"bytes,4,rep,name=data_classifications,json=dataClassifications,proto3" json:"data_classifications,omitempty"` + DeliveredTo string `protobuf:"bytes,5,opt,name=delivered_to,json=deliveredTo,proto3" json:"delivered_to,omitempty"` + DeliveredToList []string `protobuf:"bytes,6,rep,name=delivered_to_list,json=deliveredToList,proto3" json:"delivered_to_list,omitempty"` + Files []*File `protobuf:"bytes,7,rep,name=files,proto3" json:"files,omitempty"` + From string `protobuf:"bytes,8,opt,name=from,proto3" json:"from,omitempty"` + FromList []string `protobuf:"bytes,9,rep,name=from_list,json=fromList,proto3" json:"from_list,omitempty"` + FromMailbox string `protobuf:"bytes,10,opt,name=from_mailbox,json=fromMailbox,proto3" json:"from_mailbox,omitempty"` + FromMailboxes []string `protobuf:"bytes,11,rep,name=from_mailboxes,json=fromMailboxes,proto3" json:"from_mailboxes,omitempty"` + HttpHeaders []*HttpHeader `protobuf:"bytes,12,rep,name=http_headers,json=httpHeaders,proto3" json:"http_headers,omitempty"` + IsRead bool `protobuf:"varint,13,opt,name=is_read,json=isRead,proto3" json:"is_read,omitempty"` + MessageUid string `protobuf:"bytes,14,opt,name=message_uid,json=messageUid,proto3" json:"message_uid,omitempty"` + RawHeader string `protobuf:"bytes,15,opt,name=raw_header,json=rawHeader,proto3" json:"raw_header,omitempty"` + ReplyTo string `protobuf:"bytes,16,opt,name=reply_to,json=replyTo,proto3" json:"reply_to,omitempty"` + ReplyToList []string `protobuf:"bytes,17,rep,name=reply_to_list,json=replyToList,proto3" json:"reply_to_list,omitempty"` + ReplyToMailboxes []string `protobuf:"bytes,18,rep,name=reply_to_mailboxes,json=replyToMailboxes,proto3" json:"reply_to_mailboxes,omitempty"` + ReturnPath string `protobuf:"bytes,19,opt,name=return_path,json=returnPath,proto3" json:"return_path,omitempty"` + Sender string `protobuf:"bytes,20,opt,name=sender,proto3" json:"sender,omitempty"` + SenderMailbox string `protobuf:"bytes,21,opt,name=sender_mailbox,json=senderMailbox,proto3" json:"sender_mailbox,omitempty"` + Size int64 `protobuf:"varint,22,opt,name=size,proto3" json:"size,omitempty"` + SmtpFrom string `protobuf:"bytes,23,opt,name=smtp_from,json=smtpFrom,proto3" json:"smtp_from,omitempty"` + SmtpTo []string `protobuf:"bytes,24,rep,name=smtp_to,json=smtpTo,proto3" json:"smtp_to,omitempty"` + Subject string `protobuf:"bytes,25,opt,name=subject,proto3" json:"subject,omitempty"` + To []string `protobuf:"bytes,26,rep,name=to,proto3" json:"to,omitempty"` + ToMailboxes []string `protobuf:"bytes,27,rep,name=to_mailboxes,json=toMailboxes,proto3" json:"to_mailboxes,omitempty"` + Uid string `protobuf:"bytes,28,opt,name=uid,proto3" json:"uid,omitempty"` + Urls []*Url `protobuf:"bytes,29,rep,name=urls,proto3" json:"urls,omitempty"` + XOriginatingIp []string `protobuf:"bytes,30,rep,name=x_originating_ip,json=xOriginatingIp,proto3" json:"x_originating_ip,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Email) Reset() { + *x = Email{} + mi := &file_api_entity_proto_msgTypes[37] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Email) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Email) ProtoMessage() {} + +func (x *Email) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[37] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Email.ProtoReflect.Descriptor instead. +func (*Email) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{37} +} + +func (x *Email) GetCc() []string { + if x != nil { + return x.Cc + } + return nil +} + +func (x *Email) GetCcMailboxes() []string { + if x != nil { + return x.CcMailboxes + } + return nil +} + +func (x *Email) GetDataClassification() *DataClassification { + if x != nil { + return x.DataClassification + } + return nil +} + +func (x *Email) GetDataClassifications() []*DataClassification { + if x != nil { + return x.DataClassifications + } + return nil +} + +func (x *Email) GetDeliveredTo() string { + if x != nil { + return x.DeliveredTo + } + return "" +} + +func (x *Email) GetDeliveredToList() []string { + if x != nil { + return x.DeliveredToList + } + return nil +} + +func (x *Email) GetFiles() []*File { + if x != nil { + return x.Files + } + return nil +} + +func (x *Email) GetFrom() string { + if x != nil { + return x.From + } + return "" +} + +func (x *Email) GetFromList() []string { + if x != nil { + return x.FromList + } + return nil +} + +func (x *Email) GetFromMailbox() string { + if x != nil { + return x.FromMailbox + } + return "" +} + +func (x *Email) GetFromMailboxes() []string { + if x != nil { + return x.FromMailboxes + } + return nil +} + +func (x *Email) GetHttpHeaders() []*HttpHeader { + if x != nil { + return x.HttpHeaders + } + return nil +} + +func (x *Email) GetIsRead() bool { + if x != nil { + return x.IsRead + } + return false +} + +func (x *Email) GetMessageUid() string { + if x != nil { + return x.MessageUid + } + return "" +} + +func (x *Email) GetRawHeader() string { + if x != nil { + return x.RawHeader + } + return "" +} + +func (x *Email) GetReplyTo() string { + if x != nil { + return x.ReplyTo + } + return "" +} + +func (x *Email) GetReplyToList() []string { + if x != nil { + return x.ReplyToList + } + return nil +} + +func (x *Email) GetReplyToMailboxes() []string { + if x != nil { + return x.ReplyToMailboxes + } + return nil +} + +func (x *Email) GetReturnPath() string { + if x != nil { + return x.ReturnPath + } + return "" +} + +func (x *Email) GetSender() string { + if x != nil { + return x.Sender + } + return "" +} + +func (x *Email) GetSenderMailbox() string { + if x != nil { + return x.SenderMailbox + } + return "" +} + +func (x *Email) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *Email) GetSmtpFrom() string { + if x != nil { + return x.SmtpFrom + } + return "" +} + +func (x *Email) GetSmtpTo() []string { + if x != nil { + return x.SmtpTo + } + return nil +} + +func (x *Email) GetSubject() string { + if x != nil { + return x.Subject + } + return "" +} + +func (x *Email) GetTo() []string { + if x != nil { + return x.To + } + return nil +} + +func (x *Email) GetToMailboxes() []string { + if x != nil { + return x.ToMailboxes + } + return nil +} + +func (x *Email) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Email) GetUrls() []*Url { + if x != nil { + return x.Urls + } + return nil +} + +func (x *Email) GetXOriginatingIp() []string { + if x != nil { + return x.XOriginatingIp + } + return nil +} + +type EmailAuth struct { + state protoimpl.MessageState `protogen:"open.v1"` + Dkim string `protobuf:"bytes,1,opt,name=dkim,proto3" json:"dkim,omitempty"` + DkimDomain string `protobuf:"bytes,2,opt,name=dkim_domain,json=dkimDomain,proto3" json:"dkim_domain,omitempty"` + DkimSignature string `protobuf:"bytes,3,opt,name=dkim_signature,json=dkimSignature,proto3" json:"dkim_signature,omitempty"` + Dmarc string `protobuf:"bytes,4,opt,name=dmarc,proto3" json:"dmarc,omitempty"` + DmarcOverride string `protobuf:"bytes,5,opt,name=dmarc_override,json=dmarcOverride,proto3" json:"dmarc_override,omitempty"` + DmarcPolicy string `protobuf:"bytes,6,opt,name=dmarc_policy,json=dmarcPolicy,proto3" json:"dmarc_policy,omitempty"` + Spf string `protobuf:"bytes,7,opt,name=spf,proto3" json:"spf,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EmailAuth) Reset() { + *x = EmailAuth{} + mi := &file_api_entity_proto_msgTypes[38] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EmailAuth) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EmailAuth) ProtoMessage() {} + +func (x *EmailAuth) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[38] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EmailAuth.ProtoReflect.Descriptor instead. +func (*EmailAuth) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{38} +} + +func (x *EmailAuth) GetDkim() string { + if x != nil { + return x.Dkim + } + return "" +} + +func (x *EmailAuth) GetDkimDomain() string { + if x != nil { + return x.DkimDomain + } + return "" +} + +func (x *EmailAuth) GetDkimSignature() string { + if x != nil { + return x.DkimSignature + } + return "" +} + +func (x *EmailAuth) GetDmarc() string { + if x != nil { + return x.Dmarc + } + return "" +} + +func (x *EmailAuth) GetDmarcOverride() string { + if x != nil { + return x.DmarcOverride + } + return "" +} + +func (x *EmailAuth) GetDmarcPolicy() string { + if x != nil { + return x.DmarcPolicy + } + return "" +} + +func (x *EmailAuth) GetSpf() string { + if x != nil { + return x.Spf + } + return "" +} + +type EncryptionDetails struct { + state protoimpl.MessageState `protogen:"open.v1"` + Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"` + AlgorithmId EncryptionDetails_AlgorithmId `protobuf:"varint,2,opt,name=algorithm_id,json=algorithmId,proto3,enum=ocsf.v1.EncryptionDetails_AlgorithmId" json:"algorithm_id,omitempty"` + KeyLength int32 `protobuf:"varint,3,opt,name=key_length,json=keyLength,proto3" json:"key_length,omitempty"` + KeyUid string `protobuf:"bytes,4,opt,name=key_uid,json=keyUid,proto3" json:"key_uid,omitempty"` + Type string `protobuf:"bytes,5,opt,name=type,proto3" json:"type,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EncryptionDetails) Reset() { + *x = EncryptionDetails{} + mi := &file_api_entity_proto_msgTypes[39] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EncryptionDetails) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EncryptionDetails) ProtoMessage() {} + +func (x *EncryptionDetails) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[39] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EncryptionDetails.ProtoReflect.Descriptor instead. +func (*EncryptionDetails) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{39} +} + +func (x *EncryptionDetails) GetAlgorithm() string { + if x != nil { + return x.Algorithm + } + return "" +} + +func (x *EncryptionDetails) GetAlgorithmId() EncryptionDetails_AlgorithmId { + if x != nil { + return x.AlgorithmId + } + return EncryptionDetails_ALGORITHM_ID_UNKNOWN +} + +func (x *EncryptionDetails) GetKeyLength() int32 { + if x != nil { + return x.KeyLength + } + return 0 +} + +func (x *EncryptionDetails) GetKeyUid() string { + if x != nil { + return x.KeyUid + } + return "" +} + +func (x *EncryptionDetails) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +type Enrichment struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Data *structpb.Value `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"` + Desc string `protobuf:"bytes,4,opt,name=desc,proto3" json:"desc,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + Provider string `protobuf:"bytes,6,opt,name=provider,proto3" json:"provider,omitempty"` + Reputation *Reputation `protobuf:"bytes,7,opt,name=reputation,proto3" json:"reputation,omitempty"` + ShortDesc string `protobuf:"bytes,8,opt,name=short_desc,json=shortDesc,proto3" json:"short_desc,omitempty"` + SrcUrl string `protobuf:"bytes,9,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Type string `protobuf:"bytes,10,opt,name=type,proto3" json:"type,omitempty"` + Value string `protobuf:"bytes,11,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Enrichment) Reset() { + *x = Enrichment{} + mi := &file_api_entity_proto_msgTypes[40] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Enrichment) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Enrichment) ProtoMessage() {} + +func (x *Enrichment) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[40] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Enrichment.ProtoReflect.Descriptor instead. +func (*Enrichment) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{40} +} + +func (x *Enrichment) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Enrichment) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Enrichment) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Enrichment) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Enrichment) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Enrichment) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *Enrichment) GetReputation() *Reputation { + if x != nil { + return x.Reputation + } + return nil +} + +func (x *Enrichment) GetShortDesc() string { + if x != nil { + return x.ShortDesc + } + return "" +} + +func (x *Enrichment) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Enrichment) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Enrichment) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type EnvironmentVariable struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EnvironmentVariable) Reset() { + *x = EnvironmentVariable{} + mi := &file_api_entity_proto_msgTypes[41] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EnvironmentVariable) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EnvironmentVariable) ProtoMessage() {} + +func (x *EnvironmentVariable) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[41] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EnvironmentVariable.ProtoReflect.Descriptor instead. +func (*EnvironmentVariable) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{41} +} + +func (x *EnvironmentVariable) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *EnvironmentVariable) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type Epss struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Percentile float64 `protobuf:"fixed64,3,opt,name=percentile,proto3" json:"percentile,omitempty"` + Score string `protobuf:"bytes,4,opt,name=score,proto3" json:"score,omitempty"` + Version string `protobuf:"bytes,5,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Epss) Reset() { + *x = Epss{} + mi := &file_api_entity_proto_msgTypes[42] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Epss) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Epss) ProtoMessage() {} + +func (x *Epss) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[42] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Epss.ProtoReflect.Descriptor instead. +func (*Epss) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{42} +} + +func (x *Epss) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Epss) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Epss) GetPercentile() float64 { + if x != nil { + return x.Percentile + } + return 0 +} + +func (x *Epss) GetScore() string { + if x != nil { + return x.Score + } + return "" +} + +func (x *Epss) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Extension struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Extension) Reset() { + *x = Extension{} + mi := &file_api_entity_proto_msgTypes[43] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Extension) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Extension) ProtoMessage() {} + +func (x *Extension) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[43] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Extension.ProtoReflect.Descriptor instead. +func (*Extension) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{43} +} + +func (x *Extension) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Extension) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Extension) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Feature struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Feature) Reset() { + *x = Feature{} + mi := &file_api_entity_proto_msgTypes[44] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Feature) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Feature) ProtoMessage() {} + +func (x *Feature) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[44] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Feature.ProtoReflect.Descriptor instead. +func (*Feature) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{44} +} + +func (x *Feature) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Feature) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Feature) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type File struct { + state protoimpl.MessageState `protogen:"open.v1"` + AccessedTime int64 `protobuf:"varint,1,opt,name=accessed_time,json=accessedTime,proto3" json:"accessed_time,omitempty"` + AccessedTimeDt string `protobuf:"bytes,2,opt,name=accessed_time_dt,json=accessedTimeDt,proto3" json:"accessed_time_dt,omitempty"` + Accessor *User `protobuf:"bytes,3,opt,name=accessor,proto3" json:"accessor,omitempty"` + Attributes int32 `protobuf:"varint,4,opt,name=attributes,proto3" json:"attributes,omitempty"` + CompanyName string `protobuf:"bytes,5,opt,name=company_name,json=companyName,proto3" json:"company_name,omitempty"` + Confidentiality string `protobuf:"bytes,6,opt,name=confidentiality,proto3" json:"confidentiality,omitempty"` + ConfidentialityId File_ConfidentialityId `protobuf:"varint,7,opt,name=confidentiality_id,json=confidentialityId,proto3,enum=ocsf.v1.File_ConfidentialityId" json:"confidentiality_id,omitempty"` + CreatedTime int64 `protobuf:"varint,8,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,9,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Creator *User `protobuf:"bytes,10,opt,name=creator,proto3" json:"creator,omitempty"` + DataClassification *DataClassification `protobuf:"bytes,11,opt,name=data_classification,json=dataClassification,proto3" json:"data_classification,omitempty"` + DataClassifications []*DataClassification `protobuf:"bytes,12,rep,name=data_classifications,json=dataClassifications,proto3" json:"data_classifications,omitempty"` + Desc string `protobuf:"bytes,13,opt,name=desc,proto3" json:"desc,omitempty"` + DriveType string `protobuf:"bytes,14,opt,name=drive_type,json=driveType,proto3" json:"drive_type,omitempty"` + DriveTypeId File_DriveTypeId `protobuf:"varint,15,opt,name=drive_type_id,json=driveTypeId,proto3,enum=ocsf.v1.File_DriveTypeId" json:"drive_type_id,omitempty"` + EncryptionDetails *EncryptionDetails `protobuf:"bytes,16,opt,name=encryption_details,json=encryptionDetails,proto3" json:"encryption_details,omitempty"` + Ext string `protobuf:"bytes,17,opt,name=ext,proto3" json:"ext,omitempty"` + Hashes []*Fingerprint `protobuf:"bytes,18,rep,name=hashes,proto3" json:"hashes,omitempty"` + ImportedSymbols []string `protobuf:"bytes,19,rep,name=imported_symbols,json=importedSymbols,proto3" json:"imported_symbols,omitempty"` + InternalName string `protobuf:"bytes,20,opt,name=internal_name,json=internalName,proto3" json:"internal_name,omitempty"` + IsDeleted bool `protobuf:"varint,21,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"` + IsEncrypted bool `protobuf:"varint,22,opt,name=is_encrypted,json=isEncrypted,proto3" json:"is_encrypted,omitempty"` + IsPublic bool `protobuf:"varint,23,opt,name=is_public,json=isPublic,proto3" json:"is_public,omitempty"` + IsReadonly bool `protobuf:"varint,24,opt,name=is_readonly,json=isReadonly,proto3" json:"is_readonly,omitempty"` + IsSystem bool `protobuf:"varint,25,opt,name=is_system,json=isSystem,proto3" json:"is_system,omitempty"` + MimeType string `protobuf:"bytes,26,opt,name=mime_type,json=mimeType,proto3" json:"mime_type,omitempty"` + ModifiedTime int64 `protobuf:"varint,27,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,28,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Modifier *User `protobuf:"bytes,29,opt,name=modifier,proto3" json:"modifier,omitempty"` + Name string `protobuf:"bytes,30,opt,name=name,proto3" json:"name,omitempty"` + Owner *User `protobuf:"bytes,31,opt,name=owner,proto3" json:"owner,omitempty"` + ParentFolder string `protobuf:"bytes,32,opt,name=parent_folder,json=parentFolder,proto3" json:"parent_folder,omitempty"` + Path string `protobuf:"bytes,33,opt,name=path,proto3" json:"path,omitempty"` + Product *Product `protobuf:"bytes,34,opt,name=product,proto3" json:"product,omitempty"` + SecurityDescriptor string `protobuf:"bytes,35,opt,name=security_descriptor,json=securityDescriptor,proto3" json:"security_descriptor,omitempty"` + Signature *DigitalSignature `protobuf:"bytes,36,opt,name=signature,proto3" json:"signature,omitempty"` + Signatures []*DigitalSignature `protobuf:"bytes,37,rep,name=signatures,proto3" json:"signatures,omitempty"` + Size int64 `protobuf:"varint,38,opt,name=size,proto3" json:"size,omitempty"` + StorageClass string `protobuf:"bytes,39,opt,name=storage_class,json=storageClass,proto3" json:"storage_class,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,40,rep,name=tags,proto3" json:"tags,omitempty"` + Type string `protobuf:"bytes,41,opt,name=type,proto3" json:"type,omitempty"` + TypeId File_TypeId `protobuf:"varint,42,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.File_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,43,opt,name=uid,proto3" json:"uid,omitempty"` + Uri string `protobuf:"bytes,44,opt,name=uri,proto3" json:"uri,omitempty"` + Url *Url `protobuf:"bytes,45,opt,name=url,proto3" json:"url,omitempty"` + Version string `protobuf:"bytes,46,opt,name=version,proto3" json:"version,omitempty"` + Volume string `protobuf:"bytes,47,opt,name=volume,proto3" json:"volume,omitempty"` + Xattributes *structpb.Value `protobuf:"bytes,48,opt,name=xattributes,proto3" json:"xattributes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *File) Reset() { + *x = File{} + mi := &file_api_entity_proto_msgTypes[45] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *File) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*File) ProtoMessage() {} + +func (x *File) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[45] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use File.ProtoReflect.Descriptor instead. +func (*File) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{45} +} + +func (x *File) GetAccessedTime() int64 { + if x != nil { + return x.AccessedTime + } + return 0 +} + +func (x *File) GetAccessedTimeDt() string { + if x != nil { + return x.AccessedTimeDt + } + return "" +} + +func (x *File) GetAccessor() *User { + if x != nil { + return x.Accessor + } + return nil +} + +func (x *File) GetAttributes() int32 { + if x != nil { + return x.Attributes + } + return 0 +} + +func (x *File) GetCompanyName() string { + if x != nil { + return x.CompanyName + } + return "" +} + +func (x *File) GetConfidentiality() string { + if x != nil { + return x.Confidentiality + } + return "" +} + +func (x *File) GetConfidentialityId() File_ConfidentialityId { + if x != nil { + return x.ConfidentialityId + } + return File_CONFIDENTIALITY_ID_UNKNOWN +} + +func (x *File) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *File) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *File) GetCreator() *User { + if x != nil { + return x.Creator + } + return nil +} + +func (x *File) GetDataClassification() *DataClassification { + if x != nil { + return x.DataClassification + } + return nil +} + +func (x *File) GetDataClassifications() []*DataClassification { + if x != nil { + return x.DataClassifications + } + return nil +} + +func (x *File) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *File) GetDriveType() string { + if x != nil { + return x.DriveType + } + return "" +} + +func (x *File) GetDriveTypeId() File_DriveTypeId { + if x != nil { + return x.DriveTypeId + } + return File_DRIVE_TYPE_ID_UNKNOWN +} + +func (x *File) GetEncryptionDetails() *EncryptionDetails { + if x != nil { + return x.EncryptionDetails + } + return nil +} + +func (x *File) GetExt() string { + if x != nil { + return x.Ext + } + return "" +} + +func (x *File) GetHashes() []*Fingerprint { + if x != nil { + return x.Hashes + } + return nil +} + +func (x *File) GetImportedSymbols() []string { + if x != nil { + return x.ImportedSymbols + } + return nil +} + +func (x *File) GetInternalName() string { + if x != nil { + return x.InternalName + } + return "" +} + +func (x *File) GetIsDeleted() bool { + if x != nil { + return x.IsDeleted + } + return false +} + +func (x *File) GetIsEncrypted() bool { + if x != nil { + return x.IsEncrypted + } + return false +} + +func (x *File) GetIsPublic() bool { + if x != nil { + return x.IsPublic + } + return false +} + +func (x *File) GetIsReadonly() bool { + if x != nil { + return x.IsReadonly + } + return false +} + +func (x *File) GetIsSystem() bool { + if x != nil { + return x.IsSystem + } + return false +} + +func (x *File) GetMimeType() string { + if x != nil { + return x.MimeType + } + return "" +} + +func (x *File) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *File) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *File) GetModifier() *User { + if x != nil { + return x.Modifier + } + return nil +} + +func (x *File) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *File) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *File) GetParentFolder() string { + if x != nil { + return x.ParentFolder + } + return "" +} + +func (x *File) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *File) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *File) GetSecurityDescriptor() string { + if x != nil { + return x.SecurityDescriptor + } + return "" +} + +func (x *File) GetSignature() *DigitalSignature { + if x != nil { + return x.Signature + } + return nil +} + +func (x *File) GetSignatures() []*DigitalSignature { + if x != nil { + return x.Signatures + } + return nil +} + +func (x *File) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *File) GetStorageClass() string { + if x != nil { + return x.StorageClass + } + return "" +} + +func (x *File) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *File) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *File) GetTypeId() File_TypeId { + if x != nil { + return x.TypeId + } + return File_TYPE_ID_UNKNOWN +} + +func (x *File) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *File) GetUri() string { + if x != nil { + return x.Uri + } + return "" +} + +func (x *File) GetUrl() *Url { + if x != nil { + return x.Url + } + return nil +} + +func (x *File) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +func (x *File) GetVolume() string { + if x != nil { + return x.Volume + } + return "" +} + +func (x *File) GetXattributes() *structpb.Value { + if x != nil { + return x.Xattributes + } + return nil +} + +type Fingerprint struct { + state protoimpl.MessageState `protogen:"open.v1"` + Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"` + AlgorithmId Fingerprint_AlgorithmId `protobuf:"varint,2,opt,name=algorithm_id,json=algorithmId,proto3,enum=ocsf.v1.Fingerprint_AlgorithmId" json:"algorithm_id,omitempty"` + Value string `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Fingerprint) Reset() { + *x = Fingerprint{} + mi := &file_api_entity_proto_msgTypes[46] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Fingerprint) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Fingerprint) ProtoMessage() {} + +func (x *Fingerprint) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[46] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Fingerprint.ProtoReflect.Descriptor instead. +func (*Fingerprint) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{46} +} + +func (x *Fingerprint) GetAlgorithm() string { + if x != nil { + return x.Algorithm + } + return "" +} + +func (x *Fingerprint) GetAlgorithmId() Fingerprint_AlgorithmId { + if x != nil { + return x.AlgorithmId + } + return Fingerprint_ALGORITHM_ID_UNKNOWN +} + +func (x *Fingerprint) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type FirewallRule struct { + state protoimpl.MessageState `protogen:"open.v1"` + Category string `protobuf:"bytes,1,opt,name=category,proto3" json:"category,omitempty"` + Condition string `protobuf:"bytes,2,opt,name=condition,proto3" json:"condition,omitempty"` + Desc string `protobuf:"bytes,3,opt,name=desc,proto3" json:"desc,omitempty"` + Duration int64 `protobuf:"varint,4,opt,name=duration,proto3" json:"duration,omitempty"` + MatchDetails []string `protobuf:"bytes,5,rep,name=match_details,json=matchDetails,proto3" json:"match_details,omitempty"` + MatchLocation string `protobuf:"bytes,6,opt,name=match_location,json=matchLocation,proto3" json:"match_location,omitempty"` + Name string `protobuf:"bytes,7,opt,name=name,proto3" json:"name,omitempty"` + RateLimit int32 `protobuf:"varint,8,opt,name=rate_limit,json=rateLimit,proto3" json:"rate_limit,omitempty"` + Sensitivity string `protobuf:"bytes,9,opt,name=sensitivity,proto3" json:"sensitivity,omitempty"` + Type string `protobuf:"bytes,10,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,11,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,12,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *FirewallRule) Reset() { + *x = FirewallRule{} + mi := &file_api_entity_proto_msgTypes[47] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *FirewallRule) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*FirewallRule) ProtoMessage() {} + +func (x *FirewallRule) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[47] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use FirewallRule.ProtoReflect.Descriptor instead. +func (*FirewallRule) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{47} +} + +func (x *FirewallRule) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *FirewallRule) GetCondition() string { + if x != nil { + return x.Condition + } + return "" +} + +func (x *FirewallRule) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *FirewallRule) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *FirewallRule) GetMatchDetails() []string { + if x != nil { + return x.MatchDetails + } + return nil +} + +func (x *FirewallRule) GetMatchLocation() string { + if x != nil { + return x.MatchLocation + } + return "" +} + +func (x *FirewallRule) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *FirewallRule) GetRateLimit() int32 { + if x != nil { + return x.RateLimit + } + return 0 +} + +func (x *FirewallRule) GetSensitivity() string { + if x != nil { + return x.Sensitivity + } + return "" +} + +func (x *FirewallRule) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *FirewallRule) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *FirewallRule) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type GpuInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + BusType string `protobuf:"bytes,1,opt,name=bus_type,json=busType,proto3" json:"bus_type,omitempty"` + BusTypeId GpuInfo_BusTypeId `protobuf:"varint,2,opt,name=bus_type_id,json=busTypeId,proto3,enum=ocsf.v1.GpuInfo_BusTypeId" json:"bus_type_id,omitempty"` + Cores int32 `protobuf:"varint,3,opt,name=cores,proto3" json:"cores,omitempty"` + Model string `protobuf:"bytes,4,opt,name=model,proto3" json:"model,omitempty"` + VendorName string `protobuf:"bytes,5,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + VramMode string `protobuf:"bytes,6,opt,name=vram_mode,json=vramMode,proto3" json:"vram_mode,omitempty"` + VramModeId GpuInfo_VramModeId `protobuf:"varint,7,opt,name=vram_mode_id,json=vramModeId,proto3,enum=ocsf.v1.GpuInfo_VramModeId" json:"vram_mode_id,omitempty"` + VramSize int32 `protobuf:"varint,8,opt,name=vram_size,json=vramSize,proto3" json:"vram_size,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GpuInfo) Reset() { + *x = GpuInfo{} + mi := &file_api_entity_proto_msgTypes[48] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GpuInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GpuInfo) ProtoMessage() {} + +func (x *GpuInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[48] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GpuInfo.ProtoReflect.Descriptor instead. +func (*GpuInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{48} +} + +func (x *GpuInfo) GetBusType() string { + if x != nil { + return x.BusType + } + return "" +} + +func (x *GpuInfo) GetBusTypeId() GpuInfo_BusTypeId { + if x != nil { + return x.BusTypeId + } + return GpuInfo_BUS_TYPE_ID_UNKNOWN +} + +func (x *GpuInfo) GetCores() int32 { + if x != nil { + return x.Cores + } + return 0 +} + +func (x *GpuInfo) GetModel() string { + if x != nil { + return x.Model + } + return "" +} + +func (x *GpuInfo) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *GpuInfo) GetVramMode() string { + if x != nil { + return x.VramMode + } + return "" +} + +func (x *GpuInfo) GetVramModeId() GpuInfo_VramModeId { + if x != nil { + return x.VramModeId + } + return GpuInfo_VRAM_MODE_ID_UNKNOWN +} + +func (x *GpuInfo) GetVramSize() int32 { + if x != nil { + return x.VramSize + } + return 0 +} + +type Graph struct { + state protoimpl.MessageState `protogen:"open.v1"` + Desc string `protobuf:"bytes,1,opt,name=desc,proto3" json:"desc,omitempty"` + Edges []*Edge `protobuf:"bytes,2,rep,name=edges,proto3" json:"edges,omitempty"` + IsDirected bool `protobuf:"varint,3,opt,name=is_directed,json=isDirected,proto3" json:"is_directed,omitempty"` + Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` + Nodes []*Node `protobuf:"bytes,5,rep,name=nodes,proto3" json:"nodes,omitempty"` + QueryLanguage string `protobuf:"bytes,6,opt,name=query_language,json=queryLanguage,proto3" json:"query_language,omitempty"` + QueryLanguageId Graph_QueryLanguageId `protobuf:"varint,7,opt,name=query_language_id,json=queryLanguageId,proto3,enum=ocsf.v1.Graph_QueryLanguageId" json:"query_language_id,omitempty"` + Type string `protobuf:"bytes,8,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,9,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Graph) Reset() { + *x = Graph{} + mi := &file_api_entity_proto_msgTypes[49] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Graph) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Graph) ProtoMessage() {} + +func (x *Graph) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[49] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Graph.ProtoReflect.Descriptor instead. +func (*Graph) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{49} +} + +func (x *Graph) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Graph) GetEdges() []*Edge { + if x != nil { + return x.Edges + } + return nil +} + +func (x *Graph) GetIsDirected() bool { + if x != nil { + return x.IsDirected + } + return false +} + +func (x *Graph) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Graph) GetNodes() []*Node { + if x != nil { + return x.Nodes + } + return nil +} + +func (x *Graph) GetQueryLanguage() string { + if x != nil { + return x.QueryLanguage + } + return "" +} + +func (x *Graph) GetQueryLanguageId() Graph_QueryLanguageId { + if x != nil { + return x.QueryLanguageId + } + return Graph_QUERY_LANGUAGE_ID_UNKNOWN +} + +func (x *Graph) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Graph) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Group struct { + state protoimpl.MessageState `protogen:"open.v1"` + Desc string `protobuf:"bytes,1,opt,name=desc,proto3" json:"desc,omitempty"` + Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + Privileges []string `protobuf:"bytes,4,rep,name=privileges,proto3" json:"privileges,omitempty"` + Type string `protobuf:"bytes,5,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,6,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,7,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Group) Reset() { + *x = Group{} + mi := &file_api_entity_proto_msgTypes[50] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Group) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Group) ProtoMessage() {} + +func (x *Group) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[50] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Group.ProtoReflect.Descriptor instead. +func (*Group) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{50} +} + +func (x *Group) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Group) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *Group) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Group) GetPrivileges() []string { + if x != nil { + return x.Privileges + } + return nil +} + +func (x *Group) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Group) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Group) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +type HttpHeader struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *HttpHeader) Reset() { + *x = HttpHeader{} + mi := &file_api_entity_proto_msgTypes[51] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *HttpHeader) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*HttpHeader) ProtoMessage() {} + +func (x *HttpHeader) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[51] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use HttpHeader.ProtoReflect.Descriptor instead. +func (*HttpHeader) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{51} +} + +func (x *HttpHeader) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *HttpHeader) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type HttpRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Args string `protobuf:"bytes,1,opt,name=args,proto3" json:"args,omitempty"` + BodyLength int32 `protobuf:"varint,2,opt,name=body_length,json=bodyLength,proto3" json:"body_length,omitempty"` + HttpHeaders []*HttpHeader `protobuf:"bytes,3,rep,name=http_headers,json=httpHeaders,proto3" json:"http_headers,omitempty"` + HttpMethod string `protobuf:"bytes,4,opt,name=http_method,json=httpMethod,proto3" json:"http_method,omitempty"` + Length int32 `protobuf:"varint,5,opt,name=length,proto3" json:"length,omitempty"` + Referrer string `protobuf:"bytes,6,opt,name=referrer,proto3" json:"referrer,omitempty"` + Uid string `protobuf:"bytes,7,opt,name=uid,proto3" json:"uid,omitempty"` + Url *Url `protobuf:"bytes,8,opt,name=url,proto3" json:"url,omitempty"` + UserAgent string `protobuf:"bytes,9,opt,name=user_agent,json=userAgent,proto3" json:"user_agent,omitempty"` + Version string `protobuf:"bytes,10,opt,name=version,proto3" json:"version,omitempty"` + XForwardedFor []string `protobuf:"bytes,11,rep,name=x_forwarded_for,json=xForwardedFor,proto3" json:"x_forwarded_for,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *HttpRequest) Reset() { + *x = HttpRequest{} + mi := &file_api_entity_proto_msgTypes[52] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *HttpRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*HttpRequest) ProtoMessage() {} + +func (x *HttpRequest) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[52] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use HttpRequest.ProtoReflect.Descriptor instead. +func (*HttpRequest) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{52} +} + +func (x *HttpRequest) GetArgs() string { + if x != nil { + return x.Args + } + return "" +} + +func (x *HttpRequest) GetBodyLength() int32 { + if x != nil { + return x.BodyLength + } + return 0 +} + +func (x *HttpRequest) GetHttpHeaders() []*HttpHeader { + if x != nil { + return x.HttpHeaders + } + return nil +} + +func (x *HttpRequest) GetHttpMethod() string { + if x != nil { + return x.HttpMethod + } + return "" +} + +func (x *HttpRequest) GetLength() int32 { + if x != nil { + return x.Length + } + return 0 +} + +func (x *HttpRequest) GetReferrer() string { + if x != nil { + return x.Referrer + } + return "" +} + +func (x *HttpRequest) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *HttpRequest) GetUrl() *Url { + if x != nil { + return x.Url + } + return nil +} + +func (x *HttpRequest) GetUserAgent() string { + if x != nil { + return x.UserAgent + } + return "" +} + +func (x *HttpRequest) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +func (x *HttpRequest) GetXForwardedFor() []string { + if x != nil { + return x.XForwardedFor + } + return nil +} + +type HttpResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + BodyLength int32 `protobuf:"varint,1,opt,name=body_length,json=bodyLength,proto3" json:"body_length,omitempty"` + Code int32 `protobuf:"varint,2,opt,name=code,proto3" json:"code,omitempty"` + ContentType string `protobuf:"bytes,3,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"` + HttpHeaders []*HttpHeader `protobuf:"bytes,4,rep,name=http_headers,json=httpHeaders,proto3" json:"http_headers,omitempty"` + Latency int32 `protobuf:"varint,5,opt,name=latency,proto3" json:"latency,omitempty"` + Length int32 `protobuf:"varint,6,opt,name=length,proto3" json:"length,omitempty"` + Message string `protobuf:"bytes,7,opt,name=message,proto3" json:"message,omitempty"` + Status string `protobuf:"bytes,8,opt,name=status,proto3" json:"status,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *HttpResponse) Reset() { + *x = HttpResponse{} + mi := &file_api_entity_proto_msgTypes[53] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *HttpResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*HttpResponse) ProtoMessage() {} + +func (x *HttpResponse) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[53] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use HttpResponse.ProtoReflect.Descriptor instead. +func (*HttpResponse) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{53} +} + +func (x *HttpResponse) GetBodyLength() int32 { + if x != nil { + return x.BodyLength + } + return 0 +} + +func (x *HttpResponse) GetCode() int32 { + if x != nil { + return x.Code + } + return 0 +} + +func (x *HttpResponse) GetContentType() string { + if x != nil { + return x.ContentType + } + return "" +} + +func (x *HttpResponse) GetHttpHeaders() []*HttpHeader { + if x != nil { + return x.HttpHeaders + } + return nil +} + +func (x *HttpResponse) GetLatency() int32 { + if x != nil { + return x.Latency + } + return 0 +} + +func (x *HttpResponse) GetLength() int32 { + if x != nil { + return x.Length + } + return 0 +} + +func (x *HttpResponse) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *HttpResponse) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +type Idp struct { + state protoimpl.MessageState `protogen:"open.v1"` + AuthFactors []*AuthFactor `protobuf:"bytes,1,rep,name=auth_factors,json=authFactors,proto3" json:"auth_factors,omitempty"` + Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"` + Fingerprint *Fingerprint `protobuf:"bytes,3,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"` + HasMfa bool `protobuf:"varint,4,opt,name=has_mfa,json=hasMfa,proto3" json:"has_mfa,omitempty"` + Issuer string `protobuf:"bytes,5,opt,name=issuer,proto3" json:"issuer,omitempty"` + Name string `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"` + ProtocolName string `protobuf:"bytes,7,opt,name=protocol_name,json=protocolName,proto3" json:"protocol_name,omitempty"` + Scim *Scim `protobuf:"bytes,8,opt,name=scim,proto3" json:"scim,omitempty"` + Sso *Sso `protobuf:"bytes,9,opt,name=sso,proto3" json:"sso,omitempty"` + State string `protobuf:"bytes,10,opt,name=state,proto3" json:"state,omitempty"` + StateId Idp_StateId `protobuf:"varint,11,opt,name=state_id,json=stateId,proto3,enum=ocsf.v1.Idp_StateId" json:"state_id,omitempty"` + TenantUid string `protobuf:"bytes,12,opt,name=tenant_uid,json=tenantUid,proto3" json:"tenant_uid,omitempty"` + Uid string `protobuf:"bytes,13,opt,name=uid,proto3" json:"uid,omitempty"` + UrlString string `protobuf:"bytes,14,opt,name=url_string,json=urlString,proto3" json:"url_string,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Idp) Reset() { + *x = Idp{} + mi := &file_api_entity_proto_msgTypes[54] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Idp) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Idp) ProtoMessage() {} + +func (x *Idp) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[54] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Idp.ProtoReflect.Descriptor instead. +func (*Idp) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{54} +} + +func (x *Idp) GetAuthFactors() []*AuthFactor { + if x != nil { + return x.AuthFactors + } + return nil +} + +func (x *Idp) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *Idp) GetFingerprint() *Fingerprint { + if x != nil { + return x.Fingerprint + } + return nil +} + +func (x *Idp) GetHasMfa() bool { + if x != nil { + return x.HasMfa + } + return false +} + +func (x *Idp) GetIssuer() string { + if x != nil { + return x.Issuer + } + return "" +} + +func (x *Idp) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Idp) GetProtocolName() string { + if x != nil { + return x.ProtocolName + } + return "" +} + +func (x *Idp) GetScim() *Scim { + if x != nil { + return x.Scim + } + return nil +} + +func (x *Idp) GetSso() *Sso { + if x != nil { + return x.Sso + } + return nil +} + +func (x *Idp) GetState() string { + if x != nil { + return x.State + } + return "" +} + +func (x *Idp) GetStateId() Idp_StateId { + if x != nil { + return x.StateId + } + return Idp_STATE_ID_UNKNOWN +} + +func (x *Idp) GetTenantUid() string { + if x != nil { + return x.TenantUid + } + return "" +} + +func (x *Idp) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Idp) GetUrlString() string { + if x != nil { + return x.UrlString + } + return "" +} + +type Image struct { + state protoimpl.MessageState `protogen:"open.v1"` + Labels []string `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Path string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"` + Tag string `protobuf:"bytes,4,opt,name=tag,proto3" json:"tag,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,5,rep,name=tags,proto3" json:"tags,omitempty"` + Uid string `protobuf:"bytes,6,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Image) Reset() { + *x = Image{} + mi := &file_api_entity_proto_msgTypes[55] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Image) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Image) ProtoMessage() {} + +func (x *Image) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[55] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Image.ProtoReflect.Descriptor instead. +func (*Image) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{55} +} + +func (x *Image) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Image) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Image) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *Image) GetTag() string { + if x != nil { + return x.Tag + } + return "" +} + +func (x *Image) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Image) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type KbArticle struct { + state protoimpl.MessageState `protogen:"open.v1"` + AvgTimespan *Timespan `protobuf:"bytes,1,opt,name=avg_timespan,json=avgTimespan,proto3" json:"avg_timespan,omitempty"` + Bulletin string `protobuf:"bytes,2,opt,name=bulletin,proto3" json:"bulletin,omitempty"` + Classification string `protobuf:"bytes,3,opt,name=classification,proto3" json:"classification,omitempty"` + CreatedTime int64 `protobuf:"varint,4,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,5,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + InstallState string `protobuf:"bytes,6,opt,name=install_state,json=installState,proto3" json:"install_state,omitempty"` + InstallStateId KbArticle_InstallStateId `protobuf:"varint,7,opt,name=install_state_id,json=installStateId,proto3,enum=ocsf.v1.KbArticle_InstallStateId" json:"install_state_id,omitempty"` + IsSuperseded bool `protobuf:"varint,8,opt,name=is_superseded,json=isSuperseded,proto3" json:"is_superseded,omitempty"` + Os *Os `protobuf:"bytes,9,opt,name=os,proto3" json:"os,omitempty"` + Product *Product `protobuf:"bytes,10,opt,name=product,proto3" json:"product,omitempty"` + Severity string `protobuf:"bytes,11,opt,name=severity,proto3" json:"severity,omitempty"` + Size int64 `protobuf:"varint,12,opt,name=size,proto3" json:"size,omitempty"` + SrcUrl string `protobuf:"bytes,13,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Title string `protobuf:"bytes,14,opt,name=title,proto3" json:"title,omitempty"` + Uid string `protobuf:"bytes,15,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *KbArticle) Reset() { + *x = KbArticle{} + mi := &file_api_entity_proto_msgTypes[56] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *KbArticle) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*KbArticle) ProtoMessage() {} + +func (x *KbArticle) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[56] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use KbArticle.ProtoReflect.Descriptor instead. +func (*KbArticle) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{56} +} + +func (x *KbArticle) GetAvgTimespan() *Timespan { + if x != nil { + return x.AvgTimespan + } + return nil +} + +func (x *KbArticle) GetBulletin() string { + if x != nil { + return x.Bulletin + } + return "" +} + +func (x *KbArticle) GetClassification() string { + if x != nil { + return x.Classification + } + return "" +} + +func (x *KbArticle) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *KbArticle) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *KbArticle) GetInstallState() string { + if x != nil { + return x.InstallState + } + return "" +} + +func (x *KbArticle) GetInstallStateId() KbArticle_InstallStateId { + if x != nil { + return x.InstallStateId + } + return KbArticle_INSTALL_STATE_ID_UNKNOWN +} + +func (x *KbArticle) GetIsSuperseded() bool { + if x != nil { + return x.IsSuperseded + } + return false +} + +func (x *KbArticle) GetOs() *Os { + if x != nil { + return x.Os + } + return nil +} + +func (x *KbArticle) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *KbArticle) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *KbArticle) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *KbArticle) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *KbArticle) GetTitle() string { + if x != nil { + return x.Title + } + return "" +} + +func (x *KbArticle) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type KeyValueObject struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + Values []string `protobuf:"bytes,3,rep,name=values,proto3" json:"values,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *KeyValueObject) Reset() { + *x = KeyValueObject{} + mi := &file_api_entity_proto_msgTypes[57] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *KeyValueObject) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*KeyValueObject) ProtoMessage() {} + +func (x *KeyValueObject) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[57] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use KeyValueObject.ProtoReflect.Descriptor instead. +func (*KeyValueObject) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{57} +} + +func (x *KeyValueObject) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *KeyValueObject) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +func (x *KeyValueObject) GetValues() []string { + if x != nil { + return x.Values + } + return nil +} + +type KeyboardInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + FunctionKeys int32 `protobuf:"varint,1,opt,name=function_keys,json=functionKeys,proto3" json:"function_keys,omitempty"` + Ime string `protobuf:"bytes,2,opt,name=ime,proto3" json:"ime,omitempty"` + KeyboardLayout string `protobuf:"bytes,3,opt,name=keyboard_layout,json=keyboardLayout,proto3" json:"keyboard_layout,omitempty"` + KeyboardSubtype int32 `protobuf:"varint,4,opt,name=keyboard_subtype,json=keyboardSubtype,proto3" json:"keyboard_subtype,omitempty"` + KeyboardType string `protobuf:"bytes,5,opt,name=keyboard_type,json=keyboardType,proto3" json:"keyboard_type,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *KeyboardInfo) Reset() { + *x = KeyboardInfo{} + mi := &file_api_entity_proto_msgTypes[58] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *KeyboardInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*KeyboardInfo) ProtoMessage() {} + +func (x *KeyboardInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[58] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use KeyboardInfo.ProtoReflect.Descriptor instead. +func (*KeyboardInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{58} +} + +func (x *KeyboardInfo) GetFunctionKeys() int32 { + if x != nil { + return x.FunctionKeys + } + return 0 +} + +func (x *KeyboardInfo) GetIme() string { + if x != nil { + return x.Ime + } + return "" +} + +func (x *KeyboardInfo) GetKeyboardLayout() string { + if x != nil { + return x.KeyboardLayout + } + return "" +} + +func (x *KeyboardInfo) GetKeyboardSubtype() int32 { + if x != nil { + return x.KeyboardSubtype + } + return 0 +} + +func (x *KeyboardInfo) GetKeyboardType() string { + if x != nil { + return x.KeyboardType + } + return "" +} + +type KillChainPhase struct { + state protoimpl.MessageState `protogen:"open.v1"` + Phase string `protobuf:"bytes,1,opt,name=phase,proto3" json:"phase,omitempty"` + PhaseId KillChainPhase_PhaseId `protobuf:"varint,2,opt,name=phase_id,json=phaseId,proto3,enum=ocsf.v1.KillChainPhase_PhaseId" json:"phase_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *KillChainPhase) Reset() { + *x = KillChainPhase{} + mi := &file_api_entity_proto_msgTypes[59] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *KillChainPhase) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*KillChainPhase) ProtoMessage() {} + +func (x *KillChainPhase) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[59] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use KillChainPhase.ProtoReflect.Descriptor instead. +func (*KillChainPhase) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{59} +} + +func (x *KillChainPhase) GetPhase() string { + if x != nil { + return x.Phase + } + return "" +} + +func (x *KillChainPhase) GetPhaseId() KillChainPhase_PhaseId { + if x != nil { + return x.PhaseId + } + return KillChainPhase_PHASE_ID_UNKNOWN +} + +type LdapPerson struct { + state protoimpl.MessageState `protogen:"open.v1"` + CostCenter string `protobuf:"bytes,1,opt,name=cost_center,json=costCenter,proto3" json:"cost_center,omitempty"` + CreatedTime int64 `protobuf:"varint,2,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,3,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + DeletedTime int64 `protobuf:"varint,4,opt,name=deleted_time,json=deletedTime,proto3" json:"deleted_time,omitempty"` + DeletedTimeDt string `protobuf:"bytes,5,opt,name=deleted_time_dt,json=deletedTimeDt,proto3" json:"deleted_time_dt,omitempty"` + Department string `protobuf:"bytes,6,opt,name=department,proto3" json:"department,omitempty"` + DisplayName string `protobuf:"bytes,7,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` + EmailAddrs []string `protobuf:"bytes,8,rep,name=email_addrs,json=emailAddrs,proto3" json:"email_addrs,omitempty"` + EmployeeUid string `protobuf:"bytes,9,opt,name=employee_uid,json=employeeUid,proto3" json:"employee_uid,omitempty"` + GivenName string `protobuf:"bytes,10,opt,name=given_name,json=givenName,proto3" json:"given_name,omitempty"` + HireTime int64 `protobuf:"varint,11,opt,name=hire_time,json=hireTime,proto3" json:"hire_time,omitempty"` + HireTimeDt string `protobuf:"bytes,12,opt,name=hire_time_dt,json=hireTimeDt,proto3" json:"hire_time_dt,omitempty"` + JobTitle string `protobuf:"bytes,13,opt,name=job_title,json=jobTitle,proto3" json:"job_title,omitempty"` + Labels []string `protobuf:"bytes,14,rep,name=labels,proto3" json:"labels,omitempty"` + LastLoginTime int64 `protobuf:"varint,15,opt,name=last_login_time,json=lastLoginTime,proto3" json:"last_login_time,omitempty"` + LastLoginTimeDt string `protobuf:"bytes,16,opt,name=last_login_time_dt,json=lastLoginTimeDt,proto3" json:"last_login_time_dt,omitempty"` + LdapCn string `protobuf:"bytes,17,opt,name=ldap_cn,json=ldapCn,proto3" json:"ldap_cn,omitempty"` + LdapDn string `protobuf:"bytes,18,opt,name=ldap_dn,json=ldapDn,proto3" json:"ldap_dn,omitempty"` + LeaveTime int64 `protobuf:"varint,19,opt,name=leave_time,json=leaveTime,proto3" json:"leave_time,omitempty"` + LeaveTimeDt string `protobuf:"bytes,20,opt,name=leave_time_dt,json=leaveTimeDt,proto3" json:"leave_time_dt,omitempty"` + Location *Location `protobuf:"bytes,21,opt,name=location,proto3" json:"location,omitempty"` + Manager *User `protobuf:"bytes,22,opt,name=manager,proto3" json:"manager,omitempty"` + ModifiedTime int64 `protobuf:"varint,23,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,24,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + OfficeLocation string `protobuf:"bytes,25,opt,name=office_location,json=officeLocation,proto3" json:"office_location,omitempty"` + PhoneNumber string `protobuf:"bytes,26,opt,name=phone_number,json=phoneNumber,proto3" json:"phone_number,omitempty"` + Surname string `protobuf:"bytes,27,opt,name=surname,proto3" json:"surname,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,28,rep,name=tags,proto3" json:"tags,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *LdapPerson) Reset() { + *x = LdapPerson{} + mi := &file_api_entity_proto_msgTypes[60] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *LdapPerson) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*LdapPerson) ProtoMessage() {} + +func (x *LdapPerson) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[60] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use LdapPerson.ProtoReflect.Descriptor instead. +func (*LdapPerson) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{60} +} + +func (x *LdapPerson) GetCostCenter() string { + if x != nil { + return x.CostCenter + } + return "" +} + +func (x *LdapPerson) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *LdapPerson) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *LdapPerson) GetDeletedTime() int64 { + if x != nil { + return x.DeletedTime + } + return 0 +} + +func (x *LdapPerson) GetDeletedTimeDt() string { + if x != nil { + return x.DeletedTimeDt + } + return "" +} + +func (x *LdapPerson) GetDepartment() string { + if x != nil { + return x.Department + } + return "" +} + +func (x *LdapPerson) GetDisplayName() string { + if x != nil { + return x.DisplayName + } + return "" +} + +func (x *LdapPerson) GetEmailAddrs() []string { + if x != nil { + return x.EmailAddrs + } + return nil +} + +func (x *LdapPerson) GetEmployeeUid() string { + if x != nil { + return x.EmployeeUid + } + return "" +} + +func (x *LdapPerson) GetGivenName() string { + if x != nil { + return x.GivenName + } + return "" +} + +func (x *LdapPerson) GetHireTime() int64 { + if x != nil { + return x.HireTime + } + return 0 +} + +func (x *LdapPerson) GetHireTimeDt() string { + if x != nil { + return x.HireTimeDt + } + return "" +} + +func (x *LdapPerson) GetJobTitle() string { + if x != nil { + return x.JobTitle + } + return "" +} + +func (x *LdapPerson) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *LdapPerson) GetLastLoginTime() int64 { + if x != nil { + return x.LastLoginTime + } + return 0 +} + +func (x *LdapPerson) GetLastLoginTimeDt() string { + if x != nil { + return x.LastLoginTimeDt + } + return "" +} + +func (x *LdapPerson) GetLdapCn() string { + if x != nil { + return x.LdapCn + } + return "" +} + +func (x *LdapPerson) GetLdapDn() string { + if x != nil { + return x.LdapDn + } + return "" +} + +func (x *LdapPerson) GetLeaveTime() int64 { + if x != nil { + return x.LeaveTime + } + return 0 +} + +func (x *LdapPerson) GetLeaveTimeDt() string { + if x != nil { + return x.LeaveTimeDt + } + return "" +} + +func (x *LdapPerson) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *LdapPerson) GetManager() *User { + if x != nil { + return x.Manager + } + return nil +} + +func (x *LdapPerson) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *LdapPerson) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *LdapPerson) GetOfficeLocation() string { + if x != nil { + return x.OfficeLocation + } + return "" +} + +func (x *LdapPerson) GetPhoneNumber() string { + if x != nil { + return x.PhoneNumber + } + return "" +} + +func (x *LdapPerson) GetSurname() string { + if x != nil { + return x.Surname + } + return "" +} + +func (x *LdapPerson) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +type Location struct { + state protoimpl.MessageState `protogen:"open.v1"` + AerialHeight string `protobuf:"bytes,1,opt,name=aerial_height,json=aerialHeight,proto3" json:"aerial_height,omitempty"` + City string `protobuf:"bytes,2,opt,name=city,proto3" json:"city,omitempty"` + Continent string `protobuf:"bytes,3,opt,name=continent,proto3" json:"continent,omitempty"` + Coordinates []float64 `protobuf:"fixed64,4,rep,packed,name=coordinates,proto3" json:"coordinates,omitempty"` + Country string `protobuf:"bytes,5,opt,name=country,proto3" json:"country,omitempty"` + Desc string `protobuf:"bytes,6,opt,name=desc,proto3" json:"desc,omitempty"` + GeodeticAltitude string `protobuf:"bytes,7,opt,name=geodetic_altitude,json=geodeticAltitude,proto3" json:"geodetic_altitude,omitempty"` + GeodeticVerticalAccuracy string `protobuf:"bytes,8,opt,name=geodetic_vertical_accuracy,json=geodeticVerticalAccuracy,proto3" json:"geodetic_vertical_accuracy,omitempty"` + Geohash string `protobuf:"bytes,9,opt,name=geohash,proto3" json:"geohash,omitempty"` + HorizontalAccuracy string `protobuf:"bytes,10,opt,name=horizontal_accuracy,json=horizontalAccuracy,proto3" json:"horizontal_accuracy,omitempty"` + IsOnPremises bool `protobuf:"varint,11,opt,name=is_on_premises,json=isOnPremises,proto3" json:"is_on_premises,omitempty"` + Isp string `protobuf:"bytes,12,opt,name=isp,proto3" json:"isp,omitempty"` + Lat float64 `protobuf:"fixed64,13,opt,name=lat,proto3" json:"lat,omitempty"` + Long float64 `protobuf:"fixed64,14,opt,name=long,proto3" json:"long,omitempty"` + PostalCode string `protobuf:"bytes,15,opt,name=postal_code,json=postalCode,proto3" json:"postal_code,omitempty"` + PressureAltitude string `protobuf:"bytes,16,opt,name=pressure_altitude,json=pressureAltitude,proto3" json:"pressure_altitude,omitempty"` + Provider string `protobuf:"bytes,17,opt,name=provider,proto3" json:"provider,omitempty"` + Region string `protobuf:"bytes,18,opt,name=region,proto3" json:"region,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Location) Reset() { + *x = Location{} + mi := &file_api_entity_proto_msgTypes[61] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Location) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Location) ProtoMessage() {} + +func (x *Location) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[61] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Location.ProtoReflect.Descriptor instead. +func (*Location) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{61} +} + +func (x *Location) GetAerialHeight() string { + if x != nil { + return x.AerialHeight + } + return "" +} + +func (x *Location) GetCity() string { + if x != nil { + return x.City + } + return "" +} + +func (x *Location) GetContinent() string { + if x != nil { + return x.Continent + } + return "" +} + +func (x *Location) GetCoordinates() []float64 { + if x != nil { + return x.Coordinates + } + return nil +} + +func (x *Location) GetCountry() string { + if x != nil { + return x.Country + } + return "" +} + +func (x *Location) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Location) GetGeodeticAltitude() string { + if x != nil { + return x.GeodeticAltitude + } + return "" +} + +func (x *Location) GetGeodeticVerticalAccuracy() string { + if x != nil { + return x.GeodeticVerticalAccuracy + } + return "" +} + +func (x *Location) GetGeohash() string { + if x != nil { + return x.Geohash + } + return "" +} + +func (x *Location) GetHorizontalAccuracy() string { + if x != nil { + return x.HorizontalAccuracy + } + return "" +} + +func (x *Location) GetIsOnPremises() bool { + if x != nil { + return x.IsOnPremises + } + return false +} + +func (x *Location) GetIsp() string { + if x != nil { + return x.Isp + } + return "" +} + +func (x *Location) GetLat() float64 { + if x != nil { + return x.Lat + } + return 0 +} + +func (x *Location) GetLong() float64 { + if x != nil { + return x.Long + } + return 0 +} + +func (x *Location) GetPostalCode() string { + if x != nil { + return x.PostalCode + } + return "" +} + +func (x *Location) GetPressureAltitude() string { + if x != nil { + return x.PressureAltitude + } + return "" +} + +func (x *Location) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *Location) GetRegion() string { + if x != nil { + return x.Region + } + return "" +} + +type Logger struct { + state protoimpl.MessageState `protogen:"open.v1"` + Device *Device `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"` + EventUid string `protobuf:"bytes,2,opt,name=event_uid,json=eventUid,proto3" json:"event_uid,omitempty"` + IsTruncated bool `protobuf:"varint,3,opt,name=is_truncated,json=isTruncated,proto3" json:"is_truncated,omitempty"` + LogFormat string `protobuf:"bytes,4,opt,name=log_format,json=logFormat,proto3" json:"log_format,omitempty"` + LogLevel string `protobuf:"bytes,5,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"` + LogName string `protobuf:"bytes,6,opt,name=log_name,json=logName,proto3" json:"log_name,omitempty"` + LogProvider string `protobuf:"bytes,7,opt,name=log_provider,json=logProvider,proto3" json:"log_provider,omitempty"` + LogVersion string `protobuf:"bytes,8,opt,name=log_version,json=logVersion,proto3" json:"log_version,omitempty"` + LoggedTime int64 `protobuf:"varint,9,opt,name=logged_time,json=loggedTime,proto3" json:"logged_time,omitempty"` + LoggedTimeDt string `protobuf:"bytes,10,opt,name=logged_time_dt,json=loggedTimeDt,proto3" json:"logged_time_dt,omitempty"` + Name string `protobuf:"bytes,11,opt,name=name,proto3" json:"name,omitempty"` + Product *Product `protobuf:"bytes,12,opt,name=product,proto3" json:"product,omitempty"` + TransmitTime int64 `protobuf:"varint,13,opt,name=transmit_time,json=transmitTime,proto3" json:"transmit_time,omitempty"` + TransmitTimeDt string `protobuf:"bytes,14,opt,name=transmit_time_dt,json=transmitTimeDt,proto3" json:"transmit_time_dt,omitempty"` + Uid string `protobuf:"bytes,15,opt,name=uid,proto3" json:"uid,omitempty"` + UntruncatedSize int32 `protobuf:"varint,16,opt,name=untruncated_size,json=untruncatedSize,proto3" json:"untruncated_size,omitempty"` + Version string `protobuf:"bytes,17,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Logger) Reset() { + *x = Logger{} + mi := &file_api_entity_proto_msgTypes[62] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Logger) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Logger) ProtoMessage() {} + +func (x *Logger) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[62] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Logger.ProtoReflect.Descriptor instead. +func (*Logger) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{62} +} + +func (x *Logger) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *Logger) GetEventUid() string { + if x != nil { + return x.EventUid + } + return "" +} + +func (x *Logger) GetIsTruncated() bool { + if x != nil { + return x.IsTruncated + } + return false +} + +func (x *Logger) GetLogFormat() string { + if x != nil { + return x.LogFormat + } + return "" +} + +func (x *Logger) GetLogLevel() string { + if x != nil { + return x.LogLevel + } + return "" +} + +func (x *Logger) GetLogName() string { + if x != nil { + return x.LogName + } + return "" +} + +func (x *Logger) GetLogProvider() string { + if x != nil { + return x.LogProvider + } + return "" +} + +func (x *Logger) GetLogVersion() string { + if x != nil { + return x.LogVersion + } + return "" +} + +func (x *Logger) GetLoggedTime() int64 { + if x != nil { + return x.LoggedTime + } + return 0 +} + +func (x *Logger) GetLoggedTimeDt() string { + if x != nil { + return x.LoggedTimeDt + } + return "" +} + +func (x *Logger) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Logger) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *Logger) GetTransmitTime() int64 { + if x != nil { + return x.TransmitTime + } + return 0 +} + +func (x *Logger) GetTransmitTimeDt() string { + if x != nil { + return x.TransmitTimeDt + } + return "" +} + +func (x *Logger) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Logger) GetUntruncatedSize() int32 { + if x != nil { + return x.UntruncatedSize + } + return 0 +} + +func (x *Logger) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type LongString struct { + state protoimpl.MessageState `protogen:"open.v1"` + IsTruncated bool `protobuf:"varint,1,opt,name=is_truncated,json=isTruncated,proto3" json:"is_truncated,omitempty"` + UntruncatedSize int32 `protobuf:"varint,2,opt,name=untruncated_size,json=untruncatedSize,proto3" json:"untruncated_size,omitempty"` + Value string `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *LongString) Reset() { + *x = LongString{} + mi := &file_api_entity_proto_msgTypes[63] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *LongString) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*LongString) ProtoMessage() {} + +func (x *LongString) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[63] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use LongString.ProtoReflect.Descriptor instead. +func (*LongString) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{63} +} + +func (x *LongString) GetIsTruncated() bool { + if x != nil { + return x.IsTruncated + } + return false +} + +func (x *LongString) GetUntruncatedSize() int32 { + if x != nil { + return x.UntruncatedSize + } + return 0 +} + +func (x *LongString) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type Malware struct { + state protoimpl.MessageState `protogen:"open.v1"` + ClassificationIds []Malware_ClassificationIds `protobuf:"varint,1,rep,packed,name=classification_ids,json=classificationIds,proto3,enum=ocsf.v1.Malware_ClassificationIds" json:"classification_ids,omitempty"` + Classifications []string `protobuf:"bytes,2,rep,name=classifications,proto3" json:"classifications,omitempty"` + Cves []*Cve `protobuf:"bytes,3,rep,name=cves,proto3" json:"cves,omitempty"` + Files []*File `protobuf:"bytes,4,rep,name=files,proto3" json:"files,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + NumInfected int32 `protobuf:"varint,6,opt,name=num_infected,json=numInfected,proto3" json:"num_infected,omitempty"` + Path string `protobuf:"bytes,7,opt,name=path,proto3" json:"path,omitempty"` + Provider string `protobuf:"bytes,8,opt,name=provider,proto3" json:"provider,omitempty"` + Severity string `protobuf:"bytes,9,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId Malware_SeverityId `protobuf:"varint,10,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.Malware_SeverityId" json:"severity_id,omitempty"` + Uid string `protobuf:"bytes,11,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Malware) Reset() { + *x = Malware{} + mi := &file_api_entity_proto_msgTypes[64] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Malware) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Malware) ProtoMessage() {} + +func (x *Malware) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[64] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Malware.ProtoReflect.Descriptor instead. +func (*Malware) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{64} +} + +func (x *Malware) GetClassificationIds() []Malware_ClassificationIds { + if x != nil { + return x.ClassificationIds + } + return nil +} + +func (x *Malware) GetClassifications() []string { + if x != nil { + return x.Classifications + } + return nil +} + +func (x *Malware) GetCves() []*Cve { + if x != nil { + return x.Cves + } + return nil +} + +func (x *Malware) GetFiles() []*File { + if x != nil { + return x.Files + } + return nil +} + +func (x *Malware) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Malware) GetNumInfected() int32 { + if x != nil { + return x.NumInfected + } + return 0 +} + +func (x *Malware) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *Malware) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *Malware) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *Malware) GetSeverityId() Malware_SeverityId { + if x != nil { + return x.SeverityId + } + return Malware_SEVERITY_ID_UNKNOWN +} + +func (x *Malware) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type MalwareScanInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + EndTime int64 `protobuf:"varint,1,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,2,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + NumFiles int32 `protobuf:"varint,4,opt,name=num_files,json=numFiles,proto3" json:"num_files,omitempty"` + NumInfected int32 `protobuf:"varint,5,opt,name=num_infected,json=numInfected,proto3" json:"num_infected,omitempty"` + NumVolumes int32 `protobuf:"varint,6,opt,name=num_volumes,json=numVolumes,proto3" json:"num_volumes,omitempty"` + Size int64 `protobuf:"varint,7,opt,name=size,proto3" json:"size,omitempty"` + StartTime int64 `protobuf:"varint,8,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,9,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Type string `protobuf:"bytes,10,opt,name=type,proto3" json:"type,omitempty"` + TypeId MalwareScanInfo_TypeId `protobuf:"varint,11,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.MalwareScanInfo_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,12,opt,name=uid,proto3" json:"uid,omitempty"` + UniqueMalwareCount int32 `protobuf:"varint,13,opt,name=unique_malware_count,json=uniqueMalwareCount,proto3" json:"unique_malware_count,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *MalwareScanInfo) Reset() { + *x = MalwareScanInfo{} + mi := &file_api_entity_proto_msgTypes[65] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *MalwareScanInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*MalwareScanInfo) ProtoMessage() {} + +func (x *MalwareScanInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[65] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use MalwareScanInfo.ProtoReflect.Descriptor instead. +func (*MalwareScanInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{65} +} + +func (x *MalwareScanInfo) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *MalwareScanInfo) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *MalwareScanInfo) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *MalwareScanInfo) GetNumFiles() int32 { + if x != nil { + return x.NumFiles + } + return 0 +} + +func (x *MalwareScanInfo) GetNumInfected() int32 { + if x != nil { + return x.NumInfected + } + return 0 +} + +func (x *MalwareScanInfo) GetNumVolumes() int32 { + if x != nil { + return x.NumVolumes + } + return 0 +} + +func (x *MalwareScanInfo) GetSize() int64 { + if x != nil { + return x.Size + } + return 0 +} + +func (x *MalwareScanInfo) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *MalwareScanInfo) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *MalwareScanInfo) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *MalwareScanInfo) GetTypeId() MalwareScanInfo_TypeId { + if x != nil { + return x.TypeId + } + return MalwareScanInfo_TYPE_ID_UNKNOWN +} + +func (x *MalwareScanInfo) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *MalwareScanInfo) GetUniqueMalwareCount() int32 { + if x != nil { + return x.UniqueMalwareCount + } + return 0 +} + +type ManagedEntity struct { + state protoimpl.MessageState `protogen:"open.v1"` + Data *structpb.Value `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` + Device *Device `protobuf:"bytes,2,opt,name=device,proto3" json:"device,omitempty"` + Email *Email `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"` + Group *Group `protobuf:"bytes,4,opt,name=group,proto3" json:"group,omitempty"` + Location *Location `protobuf:"bytes,5,opt,name=location,proto3" json:"location,omitempty"` + Name string `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"` + Org *Organization `protobuf:"bytes,7,opt,name=org,proto3" json:"org,omitempty"` + Policy *Policy `protobuf:"bytes,8,opt,name=policy,proto3" json:"policy,omitempty"` + Type string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"` + TypeId ManagedEntity_TypeId `protobuf:"varint,10,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.ManagedEntity_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,11,opt,name=uid,proto3" json:"uid,omitempty"` + User *User `protobuf:"bytes,12,opt,name=user,proto3" json:"user,omitempty"` + Version string `protobuf:"bytes,13,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ManagedEntity) Reset() { + *x = ManagedEntity{} + mi := &file_api_entity_proto_msgTypes[66] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ManagedEntity) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ManagedEntity) ProtoMessage() {} + +func (x *ManagedEntity) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[66] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ManagedEntity.ProtoReflect.Descriptor instead. +func (*ManagedEntity) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{66} +} + +func (x *ManagedEntity) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *ManagedEntity) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *ManagedEntity) GetEmail() *Email { + if x != nil { + return x.Email + } + return nil +} + +func (x *ManagedEntity) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *ManagedEntity) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *ManagedEntity) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ManagedEntity) GetOrg() *Organization { + if x != nil { + return x.Org + } + return nil +} + +func (x *ManagedEntity) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *ManagedEntity) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *ManagedEntity) GetTypeId() ManagedEntity_TypeId { + if x != nil { + return x.TypeId + } + return ManagedEntity_TYPE_ID_UNKNOWN +} + +func (x *ManagedEntity) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *ManagedEntity) GetUser() *User { + if x != nil { + return x.User + } + return nil +} + +func (x *ManagedEntity) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type MessageContext struct { + state protoimpl.MessageState `protogen:"open.v1"` + AiRole string `protobuf:"bytes,1,opt,name=ai_role,json=aiRole,proto3" json:"ai_role,omitempty"` + AiRoleId MessageContext_AiRoleId `protobuf:"varint,2,opt,name=ai_role_id,json=aiRoleId,proto3,enum=ocsf.v1.MessageContext_AiRoleId" json:"ai_role_id,omitempty"` + Application *Application `protobuf:"bytes,3,opt,name=application,proto3" json:"application,omitempty"` + CompletionTokens int32 `protobuf:"varint,4,opt,name=completion_tokens,json=completionTokens,proto3" json:"completion_tokens,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + PromptTokens int32 `protobuf:"varint,6,opt,name=prompt_tokens,json=promptTokens,proto3" json:"prompt_tokens,omitempty"` + Service *Service `protobuf:"bytes,7,opt,name=service,proto3" json:"service,omitempty"` + TotalTokens int32 `protobuf:"varint,8,opt,name=total_tokens,json=totalTokens,proto3" json:"total_tokens,omitempty"` + Uid string `protobuf:"bytes,9,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *MessageContext) Reset() { + *x = MessageContext{} + mi := &file_api_entity_proto_msgTypes[67] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *MessageContext) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*MessageContext) ProtoMessage() {} + +func (x *MessageContext) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[67] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use MessageContext.ProtoReflect.Descriptor instead. +func (*MessageContext) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{67} +} + +func (x *MessageContext) GetAiRole() string { + if x != nil { + return x.AiRole + } + return "" +} + +func (x *MessageContext) GetAiRoleId() MessageContext_AiRoleId { + if x != nil { + return x.AiRoleId + } + return MessageContext_AI_ROLE_ID_UNKNOWN +} + +func (x *MessageContext) GetApplication() *Application { + if x != nil { + return x.Application + } + return nil +} + +func (x *MessageContext) GetCompletionTokens() int32 { + if x != nil { + return x.CompletionTokens + } + return 0 +} + +func (x *MessageContext) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *MessageContext) GetPromptTokens() int32 { + if x != nil { + return x.PromptTokens + } + return 0 +} + +func (x *MessageContext) GetService() *Service { + if x != nil { + return x.Service + } + return nil +} + +func (x *MessageContext) GetTotalTokens() int32 { + if x != nil { + return x.TotalTokens + } + return 0 +} + +func (x *MessageContext) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Metadata struct { + state protoimpl.MessageState `protogen:"open.v1"` + CorrelationUid string `protobuf:"bytes,1,opt,name=correlation_uid,json=correlationUid,proto3" json:"correlation_uid,omitempty"` + DataClassification *DataClassification `protobuf:"bytes,2,opt,name=data_classification,json=dataClassification,proto3" json:"data_classification,omitempty"` + DataClassifications []*DataClassification `protobuf:"bytes,3,rep,name=data_classifications,json=dataClassifications,proto3" json:"data_classifications,omitempty"` + Debug []string `protobuf:"bytes,4,rep,name=debug,proto3" json:"debug,omitempty"` + EventCode string `protobuf:"bytes,5,opt,name=event_code,json=eventCode,proto3" json:"event_code,omitempty"` + Extension *Extension `protobuf:"bytes,6,opt,name=extension,proto3" json:"extension,omitempty"` + Extensions []*Extension `protobuf:"bytes,7,rep,name=extensions,proto3" json:"extensions,omitempty"` + IsTruncated bool `protobuf:"varint,8,opt,name=is_truncated,json=isTruncated,proto3" json:"is_truncated,omitempty"` + Labels []string `protobuf:"bytes,9,rep,name=labels,proto3" json:"labels,omitempty"` + LogFormat string `protobuf:"bytes,10,opt,name=log_format,json=logFormat,proto3" json:"log_format,omitempty"` + LogLevel string `protobuf:"bytes,11,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"` + LogName string `protobuf:"bytes,12,opt,name=log_name,json=logName,proto3" json:"log_name,omitempty"` + LogProvider string `protobuf:"bytes,13,opt,name=log_provider,json=logProvider,proto3" json:"log_provider,omitempty"` + LogSource string `protobuf:"bytes,14,opt,name=log_source,json=logSource,proto3" json:"log_source,omitempty"` + LogVersion string `protobuf:"bytes,15,opt,name=log_version,json=logVersion,proto3" json:"log_version,omitempty"` + LoggedTime int64 `protobuf:"varint,16,opt,name=logged_time,json=loggedTime,proto3" json:"logged_time,omitempty"` + LoggedTimeDt string `protobuf:"bytes,17,opt,name=logged_time_dt,json=loggedTimeDt,proto3" json:"logged_time_dt,omitempty"` + Loggers []*Logger `protobuf:"bytes,18,rep,name=loggers,proto3" json:"loggers,omitempty"` + ModifiedTime int64 `protobuf:"varint,19,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,20,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + OriginalEventUid string `protobuf:"bytes,21,opt,name=original_event_uid,json=originalEventUid,proto3" json:"original_event_uid,omitempty"` + OriginalTime string `protobuf:"bytes,22,opt,name=original_time,json=originalTime,proto3" json:"original_time,omitempty"` + ProcessedTime int64 `protobuf:"varint,23,opt,name=processed_time,json=processedTime,proto3" json:"processed_time,omitempty"` + ProcessedTimeDt string `protobuf:"bytes,24,opt,name=processed_time_dt,json=processedTimeDt,proto3" json:"processed_time_dt,omitempty"` + Product *Product `protobuf:"bytes,25,opt,name=product,proto3" json:"product,omitempty"` + Profiles []string `protobuf:"bytes,26,rep,name=profiles,proto3" json:"profiles,omitempty"` + Reporter *Reporter `protobuf:"bytes,27,opt,name=reporter,proto3" json:"reporter,omitempty"` + Sequence int32 `protobuf:"varint,28,opt,name=sequence,proto3" json:"sequence,omitempty"` + Source string `protobuf:"bytes,29,opt,name=source,proto3" json:"source,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,30,rep,name=tags,proto3" json:"tags,omitempty"` + TenantUid string `protobuf:"bytes,31,opt,name=tenant_uid,json=tenantUid,proto3" json:"tenant_uid,omitempty"` + TotalQueuedDuration *Timespan `protobuf:"bytes,32,opt,name=total_queued_duration,json=totalQueuedDuration,proto3" json:"total_queued_duration,omitempty"` + TransformationInfoList []*TransformationInfo `protobuf:"bytes,33,rep,name=transformation_info_list,json=transformationInfoList,proto3" json:"transformation_info_list,omitempty"` + TransmitTime int64 `protobuf:"varint,34,opt,name=transmit_time,json=transmitTime,proto3" json:"transmit_time,omitempty"` + TransmitTimeDt string `protobuf:"bytes,35,opt,name=transmit_time_dt,json=transmitTimeDt,proto3" json:"transmit_time_dt,omitempty"` + Type string `protobuf:"bytes,36,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,37,opt,name=uid,proto3" json:"uid,omitempty"` + UntruncatedSize int32 `protobuf:"varint,38,opt,name=untruncated_size,json=untruncatedSize,proto3" json:"untruncated_size,omitempty"` + Version string `protobuf:"bytes,39,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Metadata) Reset() { + *x = Metadata{} + mi := &file_api_entity_proto_msgTypes[68] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Metadata) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Metadata) ProtoMessage() {} + +func (x *Metadata) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[68] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Metadata.ProtoReflect.Descriptor instead. +func (*Metadata) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{68} +} + +func (x *Metadata) GetCorrelationUid() string { + if x != nil { + return x.CorrelationUid + } + return "" +} + +func (x *Metadata) GetDataClassification() *DataClassification { + if x != nil { + return x.DataClassification + } + return nil +} + +func (x *Metadata) GetDataClassifications() []*DataClassification { + if x != nil { + return x.DataClassifications + } + return nil +} + +func (x *Metadata) GetDebug() []string { + if x != nil { + return x.Debug + } + return nil +} + +func (x *Metadata) GetEventCode() string { + if x != nil { + return x.EventCode + } + return "" +} + +func (x *Metadata) GetExtension() *Extension { + if x != nil { + return x.Extension + } + return nil +} + +func (x *Metadata) GetExtensions() []*Extension { + if x != nil { + return x.Extensions + } + return nil +} + +func (x *Metadata) GetIsTruncated() bool { + if x != nil { + return x.IsTruncated + } + return false +} + +func (x *Metadata) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Metadata) GetLogFormat() string { + if x != nil { + return x.LogFormat + } + return "" +} + +func (x *Metadata) GetLogLevel() string { + if x != nil { + return x.LogLevel + } + return "" +} + +func (x *Metadata) GetLogName() string { + if x != nil { + return x.LogName + } + return "" +} + +func (x *Metadata) GetLogProvider() string { + if x != nil { + return x.LogProvider + } + return "" +} + +func (x *Metadata) GetLogSource() string { + if x != nil { + return x.LogSource + } + return "" +} + +func (x *Metadata) GetLogVersion() string { + if x != nil { + return x.LogVersion + } + return "" +} + +func (x *Metadata) GetLoggedTime() int64 { + if x != nil { + return x.LoggedTime + } + return 0 +} + +func (x *Metadata) GetLoggedTimeDt() string { + if x != nil { + return x.LoggedTimeDt + } + return "" +} + +func (x *Metadata) GetLoggers() []*Logger { + if x != nil { + return x.Loggers + } + return nil +} + +func (x *Metadata) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Metadata) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Metadata) GetOriginalEventUid() string { + if x != nil { + return x.OriginalEventUid + } + return "" +} + +func (x *Metadata) GetOriginalTime() string { + if x != nil { + return x.OriginalTime + } + return "" +} + +func (x *Metadata) GetProcessedTime() int64 { + if x != nil { + return x.ProcessedTime + } + return 0 +} + +func (x *Metadata) GetProcessedTimeDt() string { + if x != nil { + return x.ProcessedTimeDt + } + return "" +} + +func (x *Metadata) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *Metadata) GetProfiles() []string { + if x != nil { + return x.Profiles + } + return nil +} + +func (x *Metadata) GetReporter() *Reporter { + if x != nil { + return x.Reporter + } + return nil +} + +func (x *Metadata) GetSequence() int32 { + if x != nil { + return x.Sequence + } + return 0 +} + +func (x *Metadata) GetSource() string { + if x != nil { + return x.Source + } + return "" +} + +func (x *Metadata) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Metadata) GetTenantUid() string { + if x != nil { + return x.TenantUid + } + return "" +} + +func (x *Metadata) GetTotalQueuedDuration() *Timespan { + if x != nil { + return x.TotalQueuedDuration + } + return nil +} + +func (x *Metadata) GetTransformationInfoList() []*TransformationInfo { + if x != nil { + return x.TransformationInfoList + } + return nil +} + +func (x *Metadata) GetTransmitTime() int64 { + if x != nil { + return x.TransmitTime + } + return 0 +} + +func (x *Metadata) GetTransmitTimeDt() string { + if x != nil { + return x.TransmitTimeDt + } + return "" +} + +func (x *Metadata) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Metadata) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Metadata) GetUntruncatedSize() int32 { + if x != nil { + return x.UntruncatedSize + } + return 0 +} + +func (x *Metadata) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Metric struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Metric) Reset() { + *x = Metric{} + mi := &file_api_entity_proto_msgTypes[69] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Metric) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Metric) ProtoMessage() {} + +func (x *Metric) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[69] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Metric.ProtoReflect.Descriptor instead. +func (*Metric) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{69} +} + +func (x *Metric) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Metric) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type Mitigation struct { + state protoimpl.MessageState `protogen:"open.v1"` + Countermeasures []*D3Fend `protobuf:"bytes,1,rep,name=countermeasures,proto3" json:"countermeasures,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,3,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Mitigation) Reset() { + *x = Mitigation{} + mi := &file_api_entity_proto_msgTypes[70] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Mitigation) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Mitigation) ProtoMessage() {} + +func (x *Mitigation) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[70] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Mitigation.ProtoReflect.Descriptor instead. +func (*Mitigation) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{70} +} + +func (x *Mitigation) GetCountermeasures() []*D3Fend { + if x != nil { + return x.Countermeasures + } + return nil +} + +func (x *Mitigation) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Mitigation) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Mitigation) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type NetworkEndpoint struct { + state protoimpl.MessageState `protogen:"open.v1"` + AgentList []*Agent `protobuf:"bytes,1,rep,name=agent_list,json=agentList,proto3" json:"agent_list,omitempty"` + AutonomousSystem *AutonomousSystem `protobuf:"bytes,2,opt,name=autonomous_system,json=autonomousSystem,proto3" json:"autonomous_system,omitempty"` + Container *Container `protobuf:"bytes,3,opt,name=container,proto3" json:"container,omitempty"` + Domain string `protobuf:"bytes,4,opt,name=domain,proto3" json:"domain,omitempty"` + Fingerprints []*Fingerprint `protobuf:"bytes,5,rep,name=fingerprints,proto3" json:"fingerprints,omitempty"` + Hostname string `protobuf:"bytes,6,opt,name=hostname,proto3" json:"hostname,omitempty"` + HwInfo *DeviceHwInfo `protobuf:"bytes,7,opt,name=hw_info,json=hwInfo,proto3" json:"hw_info,omitempty"` + InstanceUid string `protobuf:"bytes,8,opt,name=instance_uid,json=instanceUid,proto3" json:"instance_uid,omitempty"` + InterfaceName string `protobuf:"bytes,9,opt,name=interface_name,json=interfaceName,proto3" json:"interface_name,omitempty"` + InterfaceUid string `protobuf:"bytes,10,opt,name=interface_uid,json=interfaceUid,proto3" json:"interface_uid,omitempty"` + IntermediateIps []string `protobuf:"bytes,11,rep,name=intermediate_ips,json=intermediateIps,proto3" json:"intermediate_ips,omitempty"` + Ip string `protobuf:"bytes,12,opt,name=ip,proto3" json:"ip,omitempty"` + Isp string `protobuf:"bytes,13,opt,name=isp,proto3" json:"isp,omitempty"` + IspOrg string `protobuf:"bytes,14,opt,name=isp_org,json=ispOrg,proto3" json:"isp_org,omitempty"` + Location *Location `protobuf:"bytes,15,opt,name=location,proto3" json:"location,omitempty"` + Mac string `protobuf:"bytes,16,opt,name=mac,proto3" json:"mac,omitempty"` + MacVendor string `protobuf:"bytes,17,opt,name=mac_vendor,json=macVendor,proto3" json:"mac_vendor,omitempty"` + Name string `protobuf:"bytes,18,opt,name=name,proto3" json:"name,omitempty"` + NamespacePid int32 `protobuf:"varint,19,opt,name=namespace_pid,json=namespacePid,proto3" json:"namespace_pid,omitempty"` + NetworkScope string `protobuf:"bytes,20,opt,name=network_scope,json=networkScope,proto3" json:"network_scope,omitempty"` + NetworkScopeId NetworkEndpoint_NetworkScopeId `protobuf:"varint,21,opt,name=network_scope_id,json=networkScopeId,proto3,enum=ocsf.v1.NetworkEndpoint_NetworkScopeId" json:"network_scope_id,omitempty"` + Os *Os `protobuf:"bytes,22,opt,name=os,proto3" json:"os,omitempty"` + Owner *User `protobuf:"bytes,23,opt,name=owner,proto3" json:"owner,omitempty"` + Pool *Group `protobuf:"bytes,24,opt,name=pool,proto3" json:"pool,omitempty"` + Port int32 `protobuf:"varint,25,opt,name=port,proto3" json:"port,omitempty"` + ProxyEndpoint *NetworkProxy `protobuf:"bytes,26,opt,name=proxy_endpoint,json=proxyEndpoint,proto3" json:"proxy_endpoint,omitempty"` + SubnetUid string `protobuf:"bytes,27,opt,name=subnet_uid,json=subnetUid,proto3" json:"subnet_uid,omitempty"` + SvcName string `protobuf:"bytes,28,opt,name=svc_name,json=svcName,proto3" json:"svc_name,omitempty"` + Type string `protobuf:"bytes,29,opt,name=type,proto3" json:"type,omitempty"` + TypeId NetworkEndpoint_TypeId `protobuf:"varint,30,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.NetworkEndpoint_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,31,opt,name=uid,proto3" json:"uid,omitempty"` + VlanUid string `protobuf:"bytes,32,opt,name=vlan_uid,json=vlanUid,proto3" json:"vlan_uid,omitempty"` + VpcUid string `protobuf:"bytes,33,opt,name=vpc_uid,json=vpcUid,proto3" json:"vpc_uid,omitempty"` + Zone string `protobuf:"bytes,34,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *NetworkEndpoint) Reset() { + *x = NetworkEndpoint{} + mi := &file_api_entity_proto_msgTypes[71] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *NetworkEndpoint) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*NetworkEndpoint) ProtoMessage() {} + +func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[71] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead. +func (*NetworkEndpoint) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{71} +} + +func (x *NetworkEndpoint) GetAgentList() []*Agent { + if x != nil { + return x.AgentList + } + return nil +} + +func (x *NetworkEndpoint) GetAutonomousSystem() *AutonomousSystem { + if x != nil { + return x.AutonomousSystem + } + return nil +} + +func (x *NetworkEndpoint) GetContainer() *Container { + if x != nil { + return x.Container + } + return nil +} + +func (x *NetworkEndpoint) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *NetworkEndpoint) GetFingerprints() []*Fingerprint { + if x != nil { + return x.Fingerprints + } + return nil +} + +func (x *NetworkEndpoint) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *NetworkEndpoint) GetHwInfo() *DeviceHwInfo { + if x != nil { + return x.HwInfo + } + return nil +} + +func (x *NetworkEndpoint) GetInstanceUid() string { + if x != nil { + return x.InstanceUid + } + return "" +} + +func (x *NetworkEndpoint) GetInterfaceName() string { + if x != nil { + return x.InterfaceName + } + return "" +} + +func (x *NetworkEndpoint) GetInterfaceUid() string { + if x != nil { + return x.InterfaceUid + } + return "" +} + +func (x *NetworkEndpoint) GetIntermediateIps() []string { + if x != nil { + return x.IntermediateIps + } + return nil +} + +func (x *NetworkEndpoint) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *NetworkEndpoint) GetIsp() string { + if x != nil { + return x.Isp + } + return "" +} + +func (x *NetworkEndpoint) GetIspOrg() string { + if x != nil { + return x.IspOrg + } + return "" +} + +func (x *NetworkEndpoint) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *NetworkEndpoint) GetMac() string { + if x != nil { + return x.Mac + } + return "" +} + +func (x *NetworkEndpoint) GetMacVendor() string { + if x != nil { + return x.MacVendor + } + return "" +} + +func (x *NetworkEndpoint) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *NetworkEndpoint) GetNamespacePid() int32 { + if x != nil { + return x.NamespacePid + } + return 0 +} + +func (x *NetworkEndpoint) GetNetworkScope() string { + if x != nil { + return x.NetworkScope + } + return "" +} + +func (x *NetworkEndpoint) GetNetworkScopeId() NetworkEndpoint_NetworkScopeId { + if x != nil { + return x.NetworkScopeId + } + return NetworkEndpoint_NETWORK_SCOPE_ID_UNKNOWN +} + +func (x *NetworkEndpoint) GetOs() *Os { + if x != nil { + return x.Os + } + return nil +} + +func (x *NetworkEndpoint) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *NetworkEndpoint) GetPool() *Group { + if x != nil { + return x.Pool + } + return nil +} + +func (x *NetworkEndpoint) GetPort() int32 { + if x != nil { + return x.Port + } + return 0 +} + +func (x *NetworkEndpoint) GetProxyEndpoint() *NetworkProxy { + if x != nil { + return x.ProxyEndpoint + } + return nil +} + +func (x *NetworkEndpoint) GetSubnetUid() string { + if x != nil { + return x.SubnetUid + } + return "" +} + +func (x *NetworkEndpoint) GetSvcName() string { + if x != nil { + return x.SvcName + } + return "" +} + +func (x *NetworkEndpoint) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *NetworkEndpoint) GetTypeId() NetworkEndpoint_TypeId { + if x != nil { + return x.TypeId + } + return NetworkEndpoint_TYPE_ID_UNKNOWN +} + +func (x *NetworkEndpoint) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *NetworkEndpoint) GetVlanUid() string { + if x != nil { + return x.VlanUid + } + return "" +} + +func (x *NetworkEndpoint) GetVpcUid() string { + if x != nil { + return x.VpcUid + } + return "" +} + +func (x *NetworkEndpoint) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type NetworkInterface struct { + state protoimpl.MessageState `protogen:"open.v1"` + Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"` + Ip string `protobuf:"bytes,2,opt,name=ip,proto3" json:"ip,omitempty"` + Mac string `protobuf:"bytes,3,opt,name=mac,proto3" json:"mac,omitempty"` + Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` + Namespace string `protobuf:"bytes,5,opt,name=namespace,proto3" json:"namespace,omitempty"` + OpenPorts []*PortInfo `protobuf:"bytes,6,rep,name=open_ports,json=openPorts,proto3" json:"open_ports,omitempty"` + SubnetPrefix int32 `protobuf:"varint,7,opt,name=subnet_prefix,json=subnetPrefix,proto3" json:"subnet_prefix,omitempty"` + Type string `protobuf:"bytes,8,opt,name=type,proto3" json:"type,omitempty"` + TypeId NetworkInterface_TypeId `protobuf:"varint,9,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.NetworkInterface_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,10,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *NetworkInterface) Reset() { + *x = NetworkInterface{} + mi := &file_api_entity_proto_msgTypes[72] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *NetworkInterface) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*NetworkInterface) ProtoMessage() {} + +func (x *NetworkInterface) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[72] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use NetworkInterface.ProtoReflect.Descriptor instead. +func (*NetworkInterface) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{72} +} + +func (x *NetworkInterface) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *NetworkInterface) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *NetworkInterface) GetMac() string { + if x != nil { + return x.Mac + } + return "" +} + +func (x *NetworkInterface) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *NetworkInterface) GetNamespace() string { + if x != nil { + return x.Namespace + } + return "" +} + +func (x *NetworkInterface) GetOpenPorts() []*PortInfo { + if x != nil { + return x.OpenPorts + } + return nil +} + +func (x *NetworkInterface) GetSubnetPrefix() int32 { + if x != nil { + return x.SubnetPrefix + } + return 0 +} + +func (x *NetworkInterface) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *NetworkInterface) GetTypeId() NetworkInterface_TypeId { + if x != nil { + return x.TypeId + } + return NetworkInterface_TYPE_ID_UNKNOWN +} + +func (x *NetworkInterface) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type NetworkProxy struct { + state protoimpl.MessageState `protogen:"open.v1"` + AgentList []*Agent `protobuf:"bytes,1,rep,name=agent_list,json=agentList,proto3" json:"agent_list,omitempty"` + AutonomousSystem *AutonomousSystem `protobuf:"bytes,2,opt,name=autonomous_system,json=autonomousSystem,proto3" json:"autonomous_system,omitempty"` + Container *Container `protobuf:"bytes,3,opt,name=container,proto3" json:"container,omitempty"` + Domain string `protobuf:"bytes,4,opt,name=domain,proto3" json:"domain,omitempty"` + Fingerprints []*Fingerprint `protobuf:"bytes,5,rep,name=fingerprints,proto3" json:"fingerprints,omitempty"` + Hostname string `protobuf:"bytes,6,opt,name=hostname,proto3" json:"hostname,omitempty"` + HwInfo *DeviceHwInfo `protobuf:"bytes,7,opt,name=hw_info,json=hwInfo,proto3" json:"hw_info,omitempty"` + InstanceUid string `protobuf:"bytes,8,opt,name=instance_uid,json=instanceUid,proto3" json:"instance_uid,omitempty"` + InterfaceName string `protobuf:"bytes,9,opt,name=interface_name,json=interfaceName,proto3" json:"interface_name,omitempty"` + InterfaceUid string `protobuf:"bytes,10,opt,name=interface_uid,json=interfaceUid,proto3" json:"interface_uid,omitempty"` + IntermediateIps []string `protobuf:"bytes,11,rep,name=intermediate_ips,json=intermediateIps,proto3" json:"intermediate_ips,omitempty"` + Ip string `protobuf:"bytes,12,opt,name=ip,proto3" json:"ip,omitempty"` + Isp string `protobuf:"bytes,13,opt,name=isp,proto3" json:"isp,omitempty"` + IspOrg string `protobuf:"bytes,14,opt,name=isp_org,json=ispOrg,proto3" json:"isp_org,omitempty"` + Location *Location `protobuf:"bytes,15,opt,name=location,proto3" json:"location,omitempty"` + Mac string `protobuf:"bytes,16,opt,name=mac,proto3" json:"mac,omitempty"` + MacVendor string `protobuf:"bytes,17,opt,name=mac_vendor,json=macVendor,proto3" json:"mac_vendor,omitempty"` + Name string `protobuf:"bytes,18,opt,name=name,proto3" json:"name,omitempty"` + NamespacePid int32 `protobuf:"varint,19,opt,name=namespace_pid,json=namespacePid,proto3" json:"namespace_pid,omitempty"` + NetworkScope string `protobuf:"bytes,20,opt,name=network_scope,json=networkScope,proto3" json:"network_scope,omitempty"` + NetworkScopeId NetworkProxy_NetworkScopeId `protobuf:"varint,21,opt,name=network_scope_id,json=networkScopeId,proto3,enum=ocsf.v1.NetworkProxy_NetworkScopeId" json:"network_scope_id,omitempty"` + Os *Os `protobuf:"bytes,22,opt,name=os,proto3" json:"os,omitempty"` + Owner *User `protobuf:"bytes,23,opt,name=owner,proto3" json:"owner,omitempty"` + Pool *Group `protobuf:"bytes,24,opt,name=pool,proto3" json:"pool,omitempty"` + Port int32 `protobuf:"varint,25,opt,name=port,proto3" json:"port,omitempty"` + ProxyEndpoint *NetworkProxy `protobuf:"bytes,26,opt,name=proxy_endpoint,json=proxyEndpoint,proto3" json:"proxy_endpoint,omitempty"` + SubnetUid string `protobuf:"bytes,27,opt,name=subnet_uid,json=subnetUid,proto3" json:"subnet_uid,omitempty"` + SvcName string `protobuf:"bytes,28,opt,name=svc_name,json=svcName,proto3" json:"svc_name,omitempty"` + Type string `protobuf:"bytes,29,opt,name=type,proto3" json:"type,omitempty"` + TypeId NetworkProxy_TypeId `protobuf:"varint,30,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.NetworkProxy_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,31,opt,name=uid,proto3" json:"uid,omitempty"` + VlanUid string `protobuf:"bytes,32,opt,name=vlan_uid,json=vlanUid,proto3" json:"vlan_uid,omitempty"` + VpcUid string `protobuf:"bytes,33,opt,name=vpc_uid,json=vpcUid,proto3" json:"vpc_uid,omitempty"` + Zone string `protobuf:"bytes,34,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *NetworkProxy) Reset() { + *x = NetworkProxy{} + mi := &file_api_entity_proto_msgTypes[73] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *NetworkProxy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*NetworkProxy) ProtoMessage() {} + +func (x *NetworkProxy) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[73] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use NetworkProxy.ProtoReflect.Descriptor instead. +func (*NetworkProxy) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{73} +} + +func (x *NetworkProxy) GetAgentList() []*Agent { + if x != nil { + return x.AgentList + } + return nil +} + +func (x *NetworkProxy) GetAutonomousSystem() *AutonomousSystem { + if x != nil { + return x.AutonomousSystem + } + return nil +} + +func (x *NetworkProxy) GetContainer() *Container { + if x != nil { + return x.Container + } + return nil +} + +func (x *NetworkProxy) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *NetworkProxy) GetFingerprints() []*Fingerprint { + if x != nil { + return x.Fingerprints + } + return nil +} + +func (x *NetworkProxy) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *NetworkProxy) GetHwInfo() *DeviceHwInfo { + if x != nil { + return x.HwInfo + } + return nil +} + +func (x *NetworkProxy) GetInstanceUid() string { + if x != nil { + return x.InstanceUid + } + return "" +} + +func (x *NetworkProxy) GetInterfaceName() string { + if x != nil { + return x.InterfaceName + } + return "" +} + +func (x *NetworkProxy) GetInterfaceUid() string { + if x != nil { + return x.InterfaceUid + } + return "" +} + +func (x *NetworkProxy) GetIntermediateIps() []string { + if x != nil { + return x.IntermediateIps + } + return nil +} + +func (x *NetworkProxy) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *NetworkProxy) GetIsp() string { + if x != nil { + return x.Isp + } + return "" +} + +func (x *NetworkProxy) GetIspOrg() string { + if x != nil { + return x.IspOrg + } + return "" +} + +func (x *NetworkProxy) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *NetworkProxy) GetMac() string { + if x != nil { + return x.Mac + } + return "" +} + +func (x *NetworkProxy) GetMacVendor() string { + if x != nil { + return x.MacVendor + } + return "" +} + +func (x *NetworkProxy) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *NetworkProxy) GetNamespacePid() int32 { + if x != nil { + return x.NamespacePid + } + return 0 +} + +func (x *NetworkProxy) GetNetworkScope() string { + if x != nil { + return x.NetworkScope + } + return "" +} + +func (x *NetworkProxy) GetNetworkScopeId() NetworkProxy_NetworkScopeId { + if x != nil { + return x.NetworkScopeId + } + return NetworkProxy_NETWORK_SCOPE_ID_UNKNOWN +} + +func (x *NetworkProxy) GetOs() *Os { + if x != nil { + return x.Os + } + return nil +} + +func (x *NetworkProxy) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *NetworkProxy) GetPool() *Group { + if x != nil { + return x.Pool + } + return nil +} + +func (x *NetworkProxy) GetPort() int32 { + if x != nil { + return x.Port + } + return 0 +} + +func (x *NetworkProxy) GetProxyEndpoint() *NetworkProxy { + if x != nil { + return x.ProxyEndpoint + } + return nil +} + +func (x *NetworkProxy) GetSubnetUid() string { + if x != nil { + return x.SubnetUid + } + return "" +} + +func (x *NetworkProxy) GetSvcName() string { + if x != nil { + return x.SvcName + } + return "" +} + +func (x *NetworkProxy) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *NetworkProxy) GetTypeId() NetworkProxy_TypeId { + if x != nil { + return x.TypeId + } + return NetworkProxy_TYPE_ID_UNKNOWN +} + +func (x *NetworkProxy) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *NetworkProxy) GetVlanUid() string { + if x != nil { + return x.VlanUid + } + return "" +} + +func (x *NetworkProxy) GetVpcUid() string { + if x != nil { + return x.VpcUid + } + return "" +} + +func (x *NetworkProxy) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type Node struct { + state protoimpl.MessageState `protogen:"open.v1"` + Data *structpb.Value `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` + Desc string `protobuf:"bytes,2,opt,name=desc,proto3" json:"desc,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Node) Reset() { + *x = Node{} + mi := &file_api_entity_proto_msgTypes[74] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Node) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Node) ProtoMessage() {} + +func (x *Node) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[74] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Node.ProtoReflect.Descriptor instead. +func (*Node) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{74} +} + +func (x *Node) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Node) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Node) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Node) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Node) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Observable struct { + state protoimpl.MessageState `protogen:"open.v1"` + EventUid string `protobuf:"bytes,1,opt,name=event_uid,json=eventUid,proto3" json:"event_uid,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Reputation *Reputation `protobuf:"bytes,3,opt,name=reputation,proto3" json:"reputation,omitempty"` + Type string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"` + TypeId Observable_TypeId `protobuf:"varint,5,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Observable_TypeId" json:"type_id,omitempty"` + TypeUid int64 `protobuf:"varint,6,opt,name=type_uid,json=typeUid,proto3" json:"type_uid,omitempty"` + Value string `protobuf:"bytes,7,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Observable) Reset() { + *x = Observable{} + mi := &file_api_entity_proto_msgTypes[75] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Observable) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Observable) ProtoMessage() {} + +func (x *Observable) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[75] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Observable.ProtoReflect.Descriptor instead. +func (*Observable) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{75} +} + +func (x *Observable) GetEventUid() string { + if x != nil { + return x.EventUid + } + return "" +} + +func (x *Observable) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Observable) GetReputation() *Reputation { + if x != nil { + return x.Reputation + } + return nil +} + +func (x *Observable) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Observable) GetTypeId() Observable_TypeId { + if x != nil { + return x.TypeId + } + return Observable_TYPE_ID_UNKNOWN +} + +func (x *Observable) GetTypeUid() int64 { + if x != nil { + return x.TypeUid + } + return 0 +} + +func (x *Observable) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +type OccurrenceDetails struct { + state protoimpl.MessageState `protogen:"open.v1"` + CellName string `protobuf:"bytes,1,opt,name=cell_name,json=cellName,proto3" json:"cell_name,omitempty"` + ColumnName string `protobuf:"bytes,2,opt,name=column_name,json=columnName,proto3" json:"column_name,omitempty"` + ColumnNumber int32 `protobuf:"varint,3,opt,name=column_number,json=columnNumber,proto3" json:"column_number,omitempty"` + EndLine int32 `protobuf:"varint,4,opt,name=end_line,json=endLine,proto3" json:"end_line,omitempty"` + JsonPath string `protobuf:"bytes,5,opt,name=json_path,json=jsonPath,proto3" json:"json_path,omitempty"` + PageNumber int32 `protobuf:"varint,6,opt,name=page_number,json=pageNumber,proto3" json:"page_number,omitempty"` + RecordIndexInArray int32 `protobuf:"varint,7,opt,name=record_index_in_array,json=recordIndexInArray,proto3" json:"record_index_in_array,omitempty"` + RowNumber int32 `protobuf:"varint,8,opt,name=row_number,json=rowNumber,proto3" json:"row_number,omitempty"` + StartLine int32 `protobuf:"varint,9,opt,name=start_line,json=startLine,proto3" json:"start_line,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *OccurrenceDetails) Reset() { + *x = OccurrenceDetails{} + mi := &file_api_entity_proto_msgTypes[76] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *OccurrenceDetails) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OccurrenceDetails) ProtoMessage() {} + +func (x *OccurrenceDetails) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[76] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OccurrenceDetails.ProtoReflect.Descriptor instead. +func (*OccurrenceDetails) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{76} +} + +func (x *OccurrenceDetails) GetCellName() string { + if x != nil { + return x.CellName + } + return "" +} + +func (x *OccurrenceDetails) GetColumnName() string { + if x != nil { + return x.ColumnName + } + return "" +} + +func (x *OccurrenceDetails) GetColumnNumber() int32 { + if x != nil { + return x.ColumnNumber + } + return 0 +} + +func (x *OccurrenceDetails) GetEndLine() int32 { + if x != nil { + return x.EndLine + } + return 0 +} + +func (x *OccurrenceDetails) GetJsonPath() string { + if x != nil { + return x.JsonPath + } + return "" +} + +func (x *OccurrenceDetails) GetPageNumber() int32 { + if x != nil { + return x.PageNumber + } + return 0 +} + +func (x *OccurrenceDetails) GetRecordIndexInArray() int32 { + if x != nil { + return x.RecordIndexInArray + } + return 0 +} + +func (x *OccurrenceDetails) GetRowNumber() int32 { + if x != nil { + return x.RowNumber + } + return 0 +} + +func (x *OccurrenceDetails) GetStartLine() int32 { + if x != nil { + return x.StartLine + } + return 0 +} + +type Organization struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + OuName string `protobuf:"bytes,2,opt,name=ou_name,json=ouName,proto3" json:"ou_name,omitempty"` + OuUid string `protobuf:"bytes,3,opt,name=ou_uid,json=ouUid,proto3" json:"ou_uid,omitempty"` + Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Organization) Reset() { + *x = Organization{} + mi := &file_api_entity_proto_msgTypes[77] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Organization) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Organization) ProtoMessage() {} + +func (x *Organization) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[77] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Organization.ProtoReflect.Descriptor instead. +func (*Organization) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{77} +} + +func (x *Organization) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Organization) GetOuName() string { + if x != nil { + return x.OuName + } + return "" +} + +func (x *Organization) GetOuUid() string { + if x != nil { + return x.OuUid + } + return "" +} + +func (x *Organization) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Os struct { + state protoimpl.MessageState `protogen:"open.v1"` + Build string `protobuf:"bytes,1,opt,name=build,proto3" json:"build,omitempty"` + Country string `protobuf:"bytes,2,opt,name=country,proto3" json:"country,omitempty"` + CpeName string `protobuf:"bytes,3,opt,name=cpe_name,json=cpeName,proto3" json:"cpe_name,omitempty"` + CpuBits int32 `protobuf:"varint,4,opt,name=cpu_bits,json=cpuBits,proto3" json:"cpu_bits,omitempty"` + Edition string `protobuf:"bytes,5,opt,name=edition,proto3" json:"edition,omitempty"` + KernelRelease string `protobuf:"bytes,6,opt,name=kernel_release,json=kernelRelease,proto3" json:"kernel_release,omitempty"` + Lang string `protobuf:"bytes,7,opt,name=lang,proto3" json:"lang,omitempty"` + Name string `protobuf:"bytes,8,opt,name=name,proto3" json:"name,omitempty"` + SpName string `protobuf:"bytes,9,opt,name=sp_name,json=spName,proto3" json:"sp_name,omitempty"` + SpVer int32 `protobuf:"varint,10,opt,name=sp_ver,json=spVer,proto3" json:"sp_ver,omitempty"` + Type string `protobuf:"bytes,11,opt,name=type,proto3" json:"type,omitempty"` + TypeId Os_TypeId `protobuf:"varint,12,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Os_TypeId" json:"type_id,omitempty"` + Version string `protobuf:"bytes,13,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Os) Reset() { + *x = Os{} + mi := &file_api_entity_proto_msgTypes[78] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Os) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Os) ProtoMessage() {} + +func (x *Os) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[78] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Os.ProtoReflect.Descriptor instead. +func (*Os) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{78} +} + +func (x *Os) GetBuild() string { + if x != nil { + return x.Build + } + return "" +} + +func (x *Os) GetCountry() string { + if x != nil { + return x.Country + } + return "" +} + +func (x *Os) GetCpeName() string { + if x != nil { + return x.CpeName + } + return "" +} + +func (x *Os) GetCpuBits() int32 { + if x != nil { + return x.CpuBits + } + return 0 +} + +func (x *Os) GetEdition() string { + if x != nil { + return x.Edition + } + return "" +} + +func (x *Os) GetKernelRelease() string { + if x != nil { + return x.KernelRelease + } + return "" +} + +func (x *Os) GetLang() string { + if x != nil { + return x.Lang + } + return "" +} + +func (x *Os) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Os) GetSpName() string { + if x != nil { + return x.SpName + } + return "" +} + +func (x *Os) GetSpVer() int32 { + if x != nil { + return x.SpVer + } + return 0 +} + +func (x *Os) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Os) GetTypeId() Os_TypeId { + if x != nil { + return x.TypeId + } + return Os_TYPE_ID_UNKNOWN +} + +func (x *Os) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Osint struct { + state protoimpl.MessageState `protogen:"open.v1"` + Answers []*DnsAnswer `protobuf:"bytes,1,rep,name=answers,proto3" json:"answers,omitempty"` + Attacks []*Attack `protobuf:"bytes,2,rep,name=attacks,proto3" json:"attacks,omitempty"` + AutonomousSystem *AutonomousSystem `protobuf:"bytes,3,opt,name=autonomous_system,json=autonomousSystem,proto3" json:"autonomous_system,omitempty"` + Campaign *Campaign `protobuf:"bytes,4,opt,name=campaign,proto3" json:"campaign,omitempty"` + Category string `protobuf:"bytes,5,opt,name=category,proto3" json:"category,omitempty"` + Comment string `protobuf:"bytes,6,opt,name=comment,proto3" json:"comment,omitempty"` + Confidence string `protobuf:"bytes,7,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId Osint_ConfidenceId `protobuf:"varint,8,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.Osint_ConfidenceId" json:"confidence_id,omitempty"` + CreatedTime int64 `protobuf:"varint,9,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,10,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Creator *User `protobuf:"bytes,11,opt,name=creator,proto3" json:"creator,omitempty"` + Desc string `protobuf:"bytes,12,opt,name=desc,proto3" json:"desc,omitempty"` + DetectionPattern string `protobuf:"bytes,13,opt,name=detection_pattern,json=detectionPattern,proto3" json:"detection_pattern,omitempty"` + DetectionPatternType string `protobuf:"bytes,14,opt,name=detection_pattern_type,json=detectionPatternType,proto3" json:"detection_pattern_type,omitempty"` + DetectionPatternTypeId Osint_DetectionPatternTypeId `protobuf:"varint,15,opt,name=detection_pattern_type_id,json=detectionPatternTypeId,proto3,enum=ocsf.v1.Osint_DetectionPatternTypeId" json:"detection_pattern_type_id,omitempty"` + Email *Email `protobuf:"bytes,16,opt,name=email,proto3" json:"email,omitempty"` + EmailAuth *EmailAuth `protobuf:"bytes,17,opt,name=email_auth,json=emailAuth,proto3" json:"email_auth,omitempty"` + ExpirationTime int64 `protobuf:"varint,18,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"` + ExpirationTimeDt string `protobuf:"bytes,19,opt,name=expiration_time_dt,json=expirationTimeDt,proto3" json:"expiration_time_dt,omitempty"` + ExternalUid string `protobuf:"bytes,20,opt,name=external_uid,json=externalUid,proto3" json:"external_uid,omitempty"` + File *File `protobuf:"bytes,21,opt,name=file,proto3" json:"file,omitempty"` + IntrusionSets []string `protobuf:"bytes,22,rep,name=intrusion_sets,json=intrusionSets,proto3" json:"intrusion_sets,omitempty"` + KillChain []*KillChainPhase `protobuf:"bytes,23,rep,name=kill_chain,json=killChain,proto3" json:"kill_chain,omitempty"` + Labels []string `protobuf:"bytes,24,rep,name=labels,proto3" json:"labels,omitempty"` + Location *Location `protobuf:"bytes,25,opt,name=location,proto3" json:"location,omitempty"` + Malware []*Malware `protobuf:"bytes,26,rep,name=malware,proto3" json:"malware,omitempty"` + ModifiedTime int64 `protobuf:"varint,27,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,28,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,29,opt,name=name,proto3" json:"name,omitempty"` + References []string `protobuf:"bytes,30,rep,name=references,proto3" json:"references,omitempty"` + RelatedAnalytics []*Analytic `protobuf:"bytes,31,rep,name=related_analytics,json=relatedAnalytics,proto3" json:"related_analytics,omitempty"` + Reputation *Reputation `protobuf:"bytes,32,opt,name=reputation,proto3" json:"reputation,omitempty"` + RiskScore int32 `protobuf:"varint,33,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Script *Script `protobuf:"bytes,34,opt,name=script,proto3" json:"script,omitempty"` + Severity string `protobuf:"bytes,35,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId Osint_SeverityId `protobuf:"varint,36,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.Osint_SeverityId" json:"severity_id,omitempty"` + Signatures []*DigitalSignature `protobuf:"bytes,37,rep,name=signatures,proto3" json:"signatures,omitempty"` + SrcUrl string `protobuf:"bytes,38,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Subdomains []string `protobuf:"bytes,39,rep,name=subdomains,proto3" json:"subdomains,omitempty"` + Subnet string `protobuf:"bytes,40,opt,name=subnet,proto3" json:"subnet,omitempty"` + ThreatActor *ThreatActor `protobuf:"bytes,41,opt,name=threat_actor,json=threatActor,proto3" json:"threat_actor,omitempty"` + Tlp string `protobuf:"bytes,42,opt,name=tlp,proto3" json:"tlp,omitempty"` + Type string `protobuf:"bytes,43,opt,name=type,proto3" json:"type,omitempty"` + TypeId Osint_TypeId `protobuf:"varint,44,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Osint_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,45,opt,name=uid,proto3" json:"uid,omitempty"` + UploadedTime int64 `protobuf:"varint,46,opt,name=uploaded_time,json=uploadedTime,proto3" json:"uploaded_time,omitempty"` + UploadedTimeDt string `protobuf:"bytes,47,opt,name=uploaded_time_dt,json=uploadedTimeDt,proto3" json:"uploaded_time_dt,omitempty"` + Value string `protobuf:"bytes,48,opt,name=value,proto3" json:"value,omitempty"` + VendorName string `protobuf:"bytes,49,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Vulnerabilities []*Vulnerability `protobuf:"bytes,50,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"` + Whois *Whois `protobuf:"bytes,51,opt,name=whois,proto3" json:"whois,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Osint) Reset() { + *x = Osint{} + mi := &file_api_entity_proto_msgTypes[79] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Osint) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Osint) ProtoMessage() {} + +func (x *Osint) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[79] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Osint.ProtoReflect.Descriptor instead. +func (*Osint) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{79} +} + +func (x *Osint) GetAnswers() []*DnsAnswer { + if x != nil { + return x.Answers + } + return nil +} + +func (x *Osint) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *Osint) GetAutonomousSystem() *AutonomousSystem { + if x != nil { + return x.AutonomousSystem + } + return nil +} + +func (x *Osint) GetCampaign() *Campaign { + if x != nil { + return x.Campaign + } + return nil +} + +func (x *Osint) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *Osint) GetComment() string { + if x != nil { + return x.Comment + } + return "" +} + +func (x *Osint) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *Osint) GetConfidenceId() Osint_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return Osint_CONFIDENCE_ID_UNKNOWN +} + +func (x *Osint) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Osint) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Osint) GetCreator() *User { + if x != nil { + return x.Creator + } + return nil +} + +func (x *Osint) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Osint) GetDetectionPattern() string { + if x != nil { + return x.DetectionPattern + } + return "" +} + +func (x *Osint) GetDetectionPatternType() string { + if x != nil { + return x.DetectionPatternType + } + return "" +} + +func (x *Osint) GetDetectionPatternTypeId() Osint_DetectionPatternTypeId { + if x != nil { + return x.DetectionPatternTypeId + } + return Osint_DETECTION_PATTERN_TYPE_ID_UNKNOWN +} + +func (x *Osint) GetEmail() *Email { + if x != nil { + return x.Email + } + return nil +} + +func (x *Osint) GetEmailAuth() *EmailAuth { + if x != nil { + return x.EmailAuth + } + return nil +} + +func (x *Osint) GetExpirationTime() int64 { + if x != nil { + return x.ExpirationTime + } + return 0 +} + +func (x *Osint) GetExpirationTimeDt() string { + if x != nil { + return x.ExpirationTimeDt + } + return "" +} + +func (x *Osint) GetExternalUid() string { + if x != nil { + return x.ExternalUid + } + return "" +} + +func (x *Osint) GetFile() *File { + if x != nil { + return x.File + } + return nil +} + +func (x *Osint) GetIntrusionSets() []string { + if x != nil { + return x.IntrusionSets + } + return nil +} + +func (x *Osint) GetKillChain() []*KillChainPhase { + if x != nil { + return x.KillChain + } + return nil +} + +func (x *Osint) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Osint) GetLocation() *Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *Osint) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *Osint) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Osint) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Osint) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Osint) GetReferences() []string { + if x != nil { + return x.References + } + return nil +} + +func (x *Osint) GetRelatedAnalytics() []*Analytic { + if x != nil { + return x.RelatedAnalytics + } + return nil +} + +func (x *Osint) GetReputation() *Reputation { + if x != nil { + return x.Reputation + } + return nil +} + +func (x *Osint) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *Osint) GetScript() *Script { + if x != nil { + return x.Script + } + return nil +} + +func (x *Osint) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *Osint) GetSeverityId() Osint_SeverityId { + if x != nil { + return x.SeverityId + } + return Osint_SEVERITY_ID_UNKNOWN +} + +func (x *Osint) GetSignatures() []*DigitalSignature { + if x != nil { + return x.Signatures + } + return nil +} + +func (x *Osint) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Osint) GetSubdomains() []string { + if x != nil { + return x.Subdomains + } + return nil +} + +func (x *Osint) GetSubnet() string { + if x != nil { + return x.Subnet + } + return "" +} + +func (x *Osint) GetThreatActor() *ThreatActor { + if x != nil { + return x.ThreatActor + } + return nil +} + +func (x *Osint) GetTlp() string { + if x != nil { + return x.Tlp + } + return "" +} + +func (x *Osint) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Osint) GetTypeId() Osint_TypeId { + if x != nil { + return x.TypeId + } + return Osint_TYPE_ID_UNKNOWN +} + +func (x *Osint) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Osint) GetUploadedTime() int64 { + if x != nil { + return x.UploadedTime + } + return 0 +} + +func (x *Osint) GetUploadedTimeDt() string { + if x != nil { + return x.UploadedTimeDt + } + return "" +} + +func (x *Osint) GetValue() string { + if x != nil { + return x.Value + } + return "" +} + +func (x *Osint) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Osint) GetVulnerabilities() []*Vulnerability { + if x != nil { + return x.Vulnerabilities + } + return nil +} + +func (x *Osint) GetWhois() *Whois { + if x != nil { + return x.Whois + } + return nil +} + +type Package struct { + state protoimpl.MessageState `protogen:"open.v1"` + Architecture string `protobuf:"bytes,1,opt,name=architecture,proto3" json:"architecture,omitempty"` + CpeName string `protobuf:"bytes,2,opt,name=cpe_name,json=cpeName,proto3" json:"cpe_name,omitempty"` + Epoch int32 `protobuf:"varint,3,opt,name=epoch,proto3" json:"epoch,omitempty"` + Hash *Fingerprint `protobuf:"bytes,4,opt,name=hash,proto3" json:"hash,omitempty"` + License string `protobuf:"bytes,5,opt,name=license,proto3" json:"license,omitempty"` + LicenseUrl string `protobuf:"bytes,6,opt,name=license_url,json=licenseUrl,proto3" json:"license_url,omitempty"` + Name string `protobuf:"bytes,7,opt,name=name,proto3" json:"name,omitempty"` + PackageManager string `protobuf:"bytes,8,opt,name=package_manager,json=packageManager,proto3" json:"package_manager,omitempty"` + PackageManagerUrl string `protobuf:"bytes,9,opt,name=package_manager_url,json=packageManagerUrl,proto3" json:"package_manager_url,omitempty"` + Purl string `protobuf:"bytes,10,opt,name=purl,proto3" json:"purl,omitempty"` + Release string `protobuf:"bytes,11,opt,name=release,proto3" json:"release,omitempty"` + SrcUrl string `protobuf:"bytes,12,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Type string `protobuf:"bytes,13,opt,name=type,proto3" json:"type,omitempty"` + TypeId Package_TypeId `protobuf:"varint,14,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Package_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,15,opt,name=uid,proto3" json:"uid,omitempty"` + VendorName string `protobuf:"bytes,16,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,17,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Package) Reset() { + *x = Package{} + mi := &file_api_entity_proto_msgTypes[80] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Package) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Package) ProtoMessage() {} + +func (x *Package) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[80] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Package.ProtoReflect.Descriptor instead. +func (*Package) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{80} +} + +func (x *Package) GetArchitecture() string { + if x != nil { + return x.Architecture + } + return "" +} + +func (x *Package) GetCpeName() string { + if x != nil { + return x.CpeName + } + return "" +} + +func (x *Package) GetEpoch() int32 { + if x != nil { + return x.Epoch + } + return 0 +} + +func (x *Package) GetHash() *Fingerprint { + if x != nil { + return x.Hash + } + return nil +} + +func (x *Package) GetLicense() string { + if x != nil { + return x.License + } + return "" +} + +func (x *Package) GetLicenseUrl() string { + if x != nil { + return x.LicenseUrl + } + return "" +} + +func (x *Package) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Package) GetPackageManager() string { + if x != nil { + return x.PackageManager + } + return "" +} + +func (x *Package) GetPackageManagerUrl() string { + if x != nil { + return x.PackageManagerUrl + } + return "" +} + +func (x *Package) GetPurl() string { + if x != nil { + return x.Purl + } + return "" +} + +func (x *Package) GetRelease() string { + if x != nil { + return x.Release + } + return "" +} + +func (x *Package) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Package) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Package) GetTypeId() Package_TypeId { + if x != nil { + return x.TypeId + } + return Package_TYPE_ID_UNKNOWN +} + +func (x *Package) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Package) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Package) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Policy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Data *structpb.Value `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` + Desc string `protobuf:"bytes,2,opt,name=desc,proto3" json:"desc,omitempty"` + Group *Group `protobuf:"bytes,3,opt,name=group,proto3" json:"group,omitempty"` + IsApplied bool `protobuf:"varint,4,opt,name=is_applied,json=isApplied,proto3" json:"is_applied,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,7,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,8,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Policy) Reset() { + *x = Policy{} + mi := &file_api_entity_proto_msgTypes[81] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Policy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Policy) ProtoMessage() {} + +func (x *Policy) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[81] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Policy.ProtoReflect.Descriptor instead. +func (*Policy) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{81} +} + +func (x *Policy) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Policy) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Policy) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *Policy) GetIsApplied() bool { + if x != nil { + return x.IsApplied + } + return false +} + +func (x *Policy) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Policy) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Policy) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Policy) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type PortInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + Port int32 `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"` + ProtocolName string `protobuf:"bytes,2,opt,name=protocol_name,json=protocolName,proto3" json:"protocol_name,omitempty"` + ProtocolNum int32 `protobuf:"varint,3,opt,name=protocol_num,json=protocolNum,proto3" json:"protocol_num,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *PortInfo) Reset() { + *x = PortInfo{} + mi := &file_api_entity_proto_msgTypes[82] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *PortInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*PortInfo) ProtoMessage() {} + +func (x *PortInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[82] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use PortInfo.ProtoReflect.Descriptor instead. +func (*PortInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{82} +} + +func (x *PortInfo) GetPort() int32 { + if x != nil { + return x.Port + } + return 0 +} + +func (x *PortInfo) GetProtocolName() string { + if x != nil { + return x.ProtocolName + } + return "" +} + +func (x *PortInfo) GetProtocolNum() int32 { + if x != nil { + return x.ProtocolNum + } + return 0 +} + +type Process struct { + state protoimpl.MessageState `protogen:"open.v1"` + Ancestry []*ProcessEntity `protobuf:"bytes,1,rep,name=ancestry,proto3" json:"ancestry,omitempty"` + Auid int32 `protobuf:"varint,2,opt,name=auid,proto3" json:"auid,omitempty"` + CmdLine string `protobuf:"bytes,3,opt,name=cmd_line,json=cmdLine,proto3" json:"cmd_line,omitempty"` + Container *Container `protobuf:"bytes,4,opt,name=container,proto3" json:"container,omitempty"` + Cpid string `protobuf:"bytes,5,opt,name=cpid,proto3" json:"cpid,omitempty"` + CreatedTime int64 `protobuf:"varint,6,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,7,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Egid int32 `protobuf:"varint,8,opt,name=egid,proto3" json:"egid,omitempty"` + EnvironmentVariables []*EnvironmentVariable `protobuf:"bytes,9,rep,name=environment_variables,json=environmentVariables,proto3" json:"environment_variables,omitempty"` + Euid int32 `protobuf:"varint,10,opt,name=euid,proto3" json:"euid,omitempty"` + File *File `protobuf:"bytes,11,opt,name=file,proto3" json:"file,omitempty"` + Group *Group `protobuf:"bytes,12,opt,name=group,proto3" json:"group,omitempty"` + HostedServices []*WinService `protobuf:"bytes,13,rep,name=hosted_services,json=hostedServices,proto3" json:"hosted_services,omitempty"` + Integrity string `protobuf:"bytes,14,opt,name=integrity,proto3" json:"integrity,omitempty"` + IntegrityId Process_IntegrityId `protobuf:"varint,15,opt,name=integrity_id,json=integrityId,proto3,enum=ocsf.v1.Process_IntegrityId" json:"integrity_id,omitempty"` + Lineage []string `protobuf:"bytes,16,rep,name=lineage,proto3" json:"lineage,omitempty"` + LoadedModules []string `protobuf:"bytes,17,rep,name=loaded_modules,json=loadedModules,proto3" json:"loaded_modules,omitempty"` + Name string `protobuf:"bytes,18,opt,name=name,proto3" json:"name,omitempty"` + NamespacePid int32 `protobuf:"varint,19,opt,name=namespace_pid,json=namespacePid,proto3" json:"namespace_pid,omitempty"` + ParentProcess *Process `protobuf:"bytes,20,opt,name=parent_process,json=parentProcess,proto3" json:"parent_process,omitempty"` + Path string `protobuf:"bytes,21,opt,name=path,proto3" json:"path,omitempty"` + Pid int32 `protobuf:"varint,22,opt,name=pid,proto3" json:"pid,omitempty"` + Ptid int64 `protobuf:"varint,23,opt,name=ptid,proto3" json:"ptid,omitempty"` + Sandbox string `protobuf:"bytes,24,opt,name=sandbox,proto3" json:"sandbox,omitempty"` + Session *Session `protobuf:"bytes,25,opt,name=session,proto3" json:"session,omitempty"` + TerminatedTime int64 `protobuf:"varint,26,opt,name=terminated_time,json=terminatedTime,proto3" json:"terminated_time,omitempty"` + TerminatedTimeDt string `protobuf:"bytes,27,opt,name=terminated_time_dt,json=terminatedTimeDt,proto3" json:"terminated_time_dt,omitempty"` + Tid int32 `protobuf:"varint,28,opt,name=tid,proto3" json:"tid,omitempty"` + Uid string `protobuf:"bytes,29,opt,name=uid,proto3" json:"uid,omitempty"` + User *User `protobuf:"bytes,30,opt,name=user,proto3" json:"user,omitempty"` + WorkingDirectory string `protobuf:"bytes,31,opt,name=working_directory,json=workingDirectory,proto3" json:"working_directory,omitempty"` + Xattributes *structpb.Value `protobuf:"bytes,32,opt,name=xattributes,proto3" json:"xattributes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Process) Reset() { + *x = Process{} + mi := &file_api_entity_proto_msgTypes[83] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Process) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Process) ProtoMessage() {} + +func (x *Process) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[83] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Process.ProtoReflect.Descriptor instead. +func (*Process) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{83} +} + +func (x *Process) GetAncestry() []*ProcessEntity { + if x != nil { + return x.Ancestry + } + return nil +} + +func (x *Process) GetAuid() int32 { + if x != nil { + return x.Auid + } + return 0 +} + +func (x *Process) GetCmdLine() string { + if x != nil { + return x.CmdLine + } + return "" +} + +func (x *Process) GetContainer() *Container { + if x != nil { + return x.Container + } + return nil +} + +func (x *Process) GetCpid() string { + if x != nil { + return x.Cpid + } + return "" +} + +func (x *Process) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Process) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Process) GetEgid() int32 { + if x != nil { + return x.Egid + } + return 0 +} + +func (x *Process) GetEnvironmentVariables() []*EnvironmentVariable { + if x != nil { + return x.EnvironmentVariables + } + return nil +} + +func (x *Process) GetEuid() int32 { + if x != nil { + return x.Euid + } + return 0 +} + +func (x *Process) GetFile() *File { + if x != nil { + return x.File + } + return nil +} + +func (x *Process) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *Process) GetHostedServices() []*WinService { + if x != nil { + return x.HostedServices + } + return nil +} + +func (x *Process) GetIntegrity() string { + if x != nil { + return x.Integrity + } + return "" +} + +func (x *Process) GetIntegrityId() Process_IntegrityId { + if x != nil { + return x.IntegrityId + } + return Process_INTEGRITY_ID_UNKNOWN +} + +func (x *Process) GetLineage() []string { + if x != nil { + return x.Lineage + } + return nil +} + +func (x *Process) GetLoadedModules() []string { + if x != nil { + return x.LoadedModules + } + return nil +} + +func (x *Process) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Process) GetNamespacePid() int32 { + if x != nil { + return x.NamespacePid + } + return 0 +} + +func (x *Process) GetParentProcess() *Process { + if x != nil { + return x.ParentProcess + } + return nil +} + +func (x *Process) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *Process) GetPid() int32 { + if x != nil { + return x.Pid + } + return 0 +} + +func (x *Process) GetPtid() int64 { + if x != nil { + return x.Ptid + } + return 0 +} + +func (x *Process) GetSandbox() string { + if x != nil { + return x.Sandbox + } + return "" +} + +func (x *Process) GetSession() *Session { + if x != nil { + return x.Session + } + return nil +} + +func (x *Process) GetTerminatedTime() int64 { + if x != nil { + return x.TerminatedTime + } + return 0 +} + +func (x *Process) GetTerminatedTimeDt() string { + if x != nil { + return x.TerminatedTimeDt + } + return "" +} + +func (x *Process) GetTid() int32 { + if x != nil { + return x.Tid + } + return 0 +} + +func (x *Process) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Process) GetUser() *User { + if x != nil { + return x.User + } + return nil +} + +func (x *Process) GetWorkingDirectory() string { + if x != nil { + return x.WorkingDirectory + } + return "" +} + +func (x *Process) GetXattributes() *structpb.Value { + if x != nil { + return x.Xattributes + } + return nil +} + +type ProcessEntity struct { + state protoimpl.MessageState `protogen:"open.v1"` + CmdLine string `protobuf:"bytes,1,opt,name=cmd_line,json=cmdLine,proto3" json:"cmd_line,omitempty"` + Cpid string `protobuf:"bytes,2,opt,name=cpid,proto3" json:"cpid,omitempty"` + CreatedTime int64 `protobuf:"varint,3,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,4,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + Path string `protobuf:"bytes,6,opt,name=path,proto3" json:"path,omitempty"` + Pid int32 `protobuf:"varint,7,opt,name=pid,proto3" json:"pid,omitempty"` + Uid string `protobuf:"bytes,8,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ProcessEntity) Reset() { + *x = ProcessEntity{} + mi := &file_api_entity_proto_msgTypes[84] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ProcessEntity) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ProcessEntity) ProtoMessage() {} + +func (x *ProcessEntity) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[84] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ProcessEntity.ProtoReflect.Descriptor instead. +func (*ProcessEntity) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{84} +} + +func (x *ProcessEntity) GetCmdLine() string { + if x != nil { + return x.CmdLine + } + return "" +} + +func (x *ProcessEntity) GetCpid() string { + if x != nil { + return x.Cpid + } + return "" +} + +func (x *ProcessEntity) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *ProcessEntity) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *ProcessEntity) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ProcessEntity) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *ProcessEntity) GetPid() int32 { + if x != nil { + return x.Pid + } + return 0 +} + +func (x *ProcessEntity) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Product struct { + state protoimpl.MessageState `protogen:"open.v1"` + CpeName string `protobuf:"bytes,1,opt,name=cpe_name,json=cpeName,proto3" json:"cpe_name,omitempty"` + DataClassification *DataClassification `protobuf:"bytes,2,opt,name=data_classification,json=dataClassification,proto3" json:"data_classification,omitempty"` + DataClassifications []*DataClassification `protobuf:"bytes,3,rep,name=data_classifications,json=dataClassifications,proto3" json:"data_classifications,omitempty"` + Feature *Feature `protobuf:"bytes,4,opt,name=feature,proto3" json:"feature,omitempty"` + Lang string `protobuf:"bytes,5,opt,name=lang,proto3" json:"lang,omitempty"` + Name string `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"` + Path string `protobuf:"bytes,7,opt,name=path,proto3" json:"path,omitempty"` + Uid string `protobuf:"bytes,8,opt,name=uid,proto3" json:"uid,omitempty"` + UrlString string `protobuf:"bytes,9,opt,name=url_string,json=urlString,proto3" json:"url_string,omitempty"` + VendorName string `protobuf:"bytes,10,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,11,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Product) Reset() { + *x = Product{} + mi := &file_api_entity_proto_msgTypes[85] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Product) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Product) ProtoMessage() {} + +func (x *Product) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[85] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Product.ProtoReflect.Descriptor instead. +func (*Product) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{85} +} + +func (x *Product) GetCpeName() string { + if x != nil { + return x.CpeName + } + return "" +} + +func (x *Product) GetDataClassification() *DataClassification { + if x != nil { + return x.DataClassification + } + return nil +} + +func (x *Product) GetDataClassifications() []*DataClassification { + if x != nil { + return x.DataClassifications + } + return nil +} + +func (x *Product) GetFeature() *Feature { + if x != nil { + return x.Feature + } + return nil +} + +func (x *Product) GetLang() string { + if x != nil { + return x.Lang + } + return "" +} + +func (x *Product) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Product) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *Product) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Product) GetUrlString() string { + if x != nil { + return x.UrlString + } + return "" +} + +func (x *Product) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Product) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type ProgrammaticCredential struct { + state protoimpl.MessageState `protogen:"open.v1"` + LastUsedTime int64 `protobuf:"varint,1,opt,name=last_used_time,json=lastUsedTime,proto3" json:"last_used_time,omitempty"` + LastUsedTimeDt string `protobuf:"bytes,2,opt,name=last_used_time_dt,json=lastUsedTimeDt,proto3" json:"last_used_time_dt,omitempty"` + Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ProgrammaticCredential) Reset() { + *x = ProgrammaticCredential{} + mi := &file_api_entity_proto_msgTypes[86] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ProgrammaticCredential) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ProgrammaticCredential) ProtoMessage() {} + +func (x *ProgrammaticCredential) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[86] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ProgrammaticCredential.ProtoReflect.Descriptor instead. +func (*ProgrammaticCredential) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{86} +} + +func (x *ProgrammaticCredential) GetLastUsedTime() int64 { + if x != nil { + return x.LastUsedTime + } + return 0 +} + +func (x *ProgrammaticCredential) GetLastUsedTimeDt() string { + if x != nil { + return x.LastUsedTimeDt + } + return "" +} + +func (x *ProgrammaticCredential) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *ProgrammaticCredential) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Remediation struct { + state protoimpl.MessageState `protogen:"open.v1"` + CisControls []*CisControl `protobuf:"bytes,1,rep,name=cis_controls,json=cisControls,proto3" json:"cis_controls,omitempty"` + Desc string `protobuf:"bytes,2,opt,name=desc,proto3" json:"desc,omitempty"` + KbArticleList []*KbArticle `protobuf:"bytes,3,rep,name=kb_article_list,json=kbArticleList,proto3" json:"kb_article_list,omitempty"` + KbArticles []string `protobuf:"bytes,4,rep,name=kb_articles,json=kbArticles,proto3" json:"kb_articles,omitempty"` + References []string `protobuf:"bytes,5,rep,name=references,proto3" json:"references,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Remediation) Reset() { + *x = Remediation{} + mi := &file_api_entity_proto_msgTypes[87] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Remediation) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Remediation) ProtoMessage() {} + +func (x *Remediation) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[87] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Remediation.ProtoReflect.Descriptor instead. +func (*Remediation) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{87} +} + +func (x *Remediation) GetCisControls() []*CisControl { + if x != nil { + return x.CisControls + } + return nil +} + +func (x *Remediation) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Remediation) GetKbArticleList() []*KbArticle { + if x != nil { + return x.KbArticleList + } + return nil +} + +func (x *Remediation) GetKbArticles() []string { + if x != nil { + return x.KbArticles + } + return nil +} + +func (x *Remediation) GetReferences() []string { + if x != nil { + return x.References + } + return nil +} + +type Reporter struct { + state protoimpl.MessageState `protogen:"open.v1"` + Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"` + Ip string `protobuf:"bytes,2,opt,name=ip,proto3" json:"ip,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + Org *Organization `protobuf:"bytes,4,opt,name=org,proto3" json:"org,omitempty"` + Uid string `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Reporter) Reset() { + *x = Reporter{} + mi := &file_api_entity_proto_msgTypes[88] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Reporter) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Reporter) ProtoMessage() {} + +func (x *Reporter) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[88] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Reporter.ProtoReflect.Descriptor instead. +func (*Reporter) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{88} +} + +func (x *Reporter) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *Reporter) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *Reporter) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Reporter) GetOrg() *Organization { + if x != nil { + return x.Org + } + return nil +} + +func (x *Reporter) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Reputation struct { + state protoimpl.MessageState `protogen:"open.v1"` + BaseScore float64 `protobuf:"fixed64,1,opt,name=base_score,json=baseScore,proto3" json:"base_score,omitempty"` + Provider string `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"` + Score string `protobuf:"bytes,3,opt,name=score,proto3" json:"score,omitempty"` + ScoreId Reputation_ScoreId `protobuf:"varint,4,opt,name=score_id,json=scoreId,proto3,enum=ocsf.v1.Reputation_ScoreId" json:"score_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Reputation) Reset() { + *x = Reputation{} + mi := &file_api_entity_proto_msgTypes[89] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Reputation) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Reputation) ProtoMessage() {} + +func (x *Reputation) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[89] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Reputation.ProtoReflect.Descriptor instead. +func (*Reputation) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{89} +} + +func (x *Reputation) GetBaseScore() float64 { + if x != nil { + return x.BaseScore + } + return 0 +} + +func (x *Reputation) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *Reputation) GetScore() string { + if x != nil { + return x.Score + } + return "" +} + +func (x *Reputation) GetScoreId() Reputation_ScoreId { + if x != nil { + return x.ScoreId + } + return Reputation_SCORE_ID_UNKNOWN +} + +type Request struct { + state protoimpl.MessageState `protogen:"open.v1"` + Containers []*Container `protobuf:"bytes,1,rep,name=containers,proto3" json:"containers,omitempty"` + Data *structpb.Value `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"` + Flags []string `protobuf:"bytes,3,rep,name=flags,proto3" json:"flags,omitempty"` + Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Request) Reset() { + *x = Request{} + mi := &file_api_entity_proto_msgTypes[90] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Request) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Request) ProtoMessage() {} + +func (x *Request) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[90] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Request.ProtoReflect.Descriptor instead. +func (*Request) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{90} +} + +func (x *Request) GetContainers() []*Container { + if x != nil { + return x.Containers + } + return nil +} + +func (x *Request) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Request) GetFlags() []string { + if x != nil { + return x.Flags + } + return nil +} + +func (x *Request) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type ResourceDetails struct { + state protoimpl.MessageState `protogen:"open.v1"` + AgentList []*Agent `protobuf:"bytes,1,rep,name=agent_list,json=agentList,proto3" json:"agent_list,omitempty"` + CloudPartition string `protobuf:"bytes,2,opt,name=cloud_partition,json=cloudPartition,proto3" json:"cloud_partition,omitempty"` + CreatedTime int64 `protobuf:"varint,3,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,4,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Criticality string `protobuf:"bytes,5,opt,name=criticality,proto3" json:"criticality,omitempty"` + Data *structpb.Value `protobuf:"bytes,6,opt,name=data,proto3" json:"data,omitempty"` + DataClassification *DataClassification `protobuf:"bytes,7,opt,name=data_classification,json=dataClassification,proto3" json:"data_classification,omitempty"` + DataClassifications []*DataClassification `protobuf:"bytes,8,rep,name=data_classifications,json=dataClassifications,proto3" json:"data_classifications,omitempty"` + Group *Group `protobuf:"bytes,9,opt,name=group,proto3" json:"group,omitempty"` + Hostname string `protobuf:"bytes,10,opt,name=hostname,proto3" json:"hostname,omitempty"` + Ip string `protobuf:"bytes,11,opt,name=ip,proto3" json:"ip,omitempty"` + IsBackedUp bool `protobuf:"varint,12,opt,name=is_backed_up,json=isBackedUp,proto3" json:"is_backed_up,omitempty"` + Labels []string `protobuf:"bytes,13,rep,name=labels,proto3" json:"labels,omitempty"` + ModifiedTime int64 `protobuf:"varint,14,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,15,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,16,opt,name=name,proto3" json:"name,omitempty"` + Namespace string `protobuf:"bytes,17,opt,name=namespace,proto3" json:"namespace,omitempty"` + Owner *User `protobuf:"bytes,18,opt,name=owner,proto3" json:"owner,omitempty"` + Provider string `protobuf:"bytes,19,opt,name=provider,proto3" json:"provider,omitempty"` + Region string `protobuf:"bytes,20,opt,name=region,proto3" json:"region,omitempty"` + ResourceRelationship *Graph `protobuf:"bytes,21,opt,name=resource_relationship,json=resourceRelationship,proto3" json:"resource_relationship,omitempty"` + Role string `protobuf:"bytes,22,opt,name=role,proto3" json:"role,omitempty"` + RoleId ResourceDetails_RoleId `protobuf:"varint,23,opt,name=role_id,json=roleId,proto3,enum=ocsf.v1.ResourceDetails_RoleId" json:"role_id,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,24,rep,name=tags,proto3" json:"tags,omitempty"` + Type string `protobuf:"bytes,25,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,26,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,27,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + Version string `protobuf:"bytes,28,opt,name=version,proto3" json:"version,omitempty"` + Zone string `protobuf:"bytes,29,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResourceDetails) Reset() { + *x = ResourceDetails{} + mi := &file_api_entity_proto_msgTypes[91] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResourceDetails) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResourceDetails) ProtoMessage() {} + +func (x *ResourceDetails) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[91] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResourceDetails.ProtoReflect.Descriptor instead. +func (*ResourceDetails) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{91} +} + +func (x *ResourceDetails) GetAgentList() []*Agent { + if x != nil { + return x.AgentList + } + return nil +} + +func (x *ResourceDetails) GetCloudPartition() string { + if x != nil { + return x.CloudPartition + } + return "" +} + +func (x *ResourceDetails) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *ResourceDetails) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *ResourceDetails) GetCriticality() string { + if x != nil { + return x.Criticality + } + return "" +} + +func (x *ResourceDetails) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *ResourceDetails) GetDataClassification() *DataClassification { + if x != nil { + return x.DataClassification + } + return nil +} + +func (x *ResourceDetails) GetDataClassifications() []*DataClassification { + if x != nil { + return x.DataClassifications + } + return nil +} + +func (x *ResourceDetails) GetGroup() *Group { + if x != nil { + return x.Group + } + return nil +} + +func (x *ResourceDetails) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *ResourceDetails) GetIp() string { + if x != nil { + return x.Ip + } + return "" +} + +func (x *ResourceDetails) GetIsBackedUp() bool { + if x != nil { + return x.IsBackedUp + } + return false +} + +func (x *ResourceDetails) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *ResourceDetails) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *ResourceDetails) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *ResourceDetails) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ResourceDetails) GetNamespace() string { + if x != nil { + return x.Namespace + } + return "" +} + +func (x *ResourceDetails) GetOwner() *User { + if x != nil { + return x.Owner + } + return nil +} + +func (x *ResourceDetails) GetProvider() string { + if x != nil { + return x.Provider + } + return "" +} + +func (x *ResourceDetails) GetRegion() string { + if x != nil { + return x.Region + } + return "" +} + +func (x *ResourceDetails) GetResourceRelationship() *Graph { + if x != nil { + return x.ResourceRelationship + } + return nil +} + +func (x *ResourceDetails) GetRole() string { + if x != nil { + return x.Role + } + return "" +} + +func (x *ResourceDetails) GetRoleId() ResourceDetails_RoleId { + if x != nil { + return x.RoleId + } + return ResourceDetails_ROLE_ID_UNKNOWN +} + +func (x *ResourceDetails) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *ResourceDetails) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *ResourceDetails) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *ResourceDetails) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *ResourceDetails) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +func (x *ResourceDetails) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type Response struct { + state protoimpl.MessageState `protogen:"open.v1"` + Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"` + Containers []*Container `protobuf:"bytes,2,rep,name=containers,proto3" json:"containers,omitempty"` + Data *structpb.Value `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"` + Error string `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"` + ErrorMessage string `protobuf:"bytes,5,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"` + Flags []string `protobuf:"bytes,6,rep,name=flags,proto3" json:"flags,omitempty"` + Message string `protobuf:"bytes,7,opt,name=message,proto3" json:"message,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Response) Reset() { + *x = Response{} + mi := &file_api_entity_proto_msgTypes[92] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Response) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Response) ProtoMessage() {} + +func (x *Response) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[92] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Response.ProtoReflect.Descriptor instead. +func (*Response) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{92} +} + +func (x *Response) GetCode() int32 { + if x != nil { + return x.Code + } + return 0 +} + +func (x *Response) GetContainers() []*Container { + if x != nil { + return x.Containers + } + return nil +} + +func (x *Response) GetData() *structpb.Value { + if x != nil { + return x.Data + } + return nil +} + +func (x *Response) GetError() string { + if x != nil { + return x.Error + } + return "" +} + +func (x *Response) GetErrorMessage() string { + if x != nil { + return x.ErrorMessage + } + return "" +} + +func (x *Response) GetFlags() []string { + if x != nil { + return x.Flags + } + return nil +} + +func (x *Response) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +type Rule struct { + state protoimpl.MessageState `protogen:"open.v1"` + Category string `protobuf:"bytes,1,opt,name=category,proto3" json:"category,omitempty"` + Desc string `protobuf:"bytes,2,opt,name=desc,proto3" json:"desc,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,4,opt,name=type,proto3" json:"type,omitempty"` + Uid string `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,6,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Rule) Reset() { + *x = Rule{} + mi := &file_api_entity_proto_msgTypes[93] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Rule) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Rule) ProtoMessage() {} + +func (x *Rule) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[93] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Rule.ProtoReflect.Descriptor instead. +func (*Rule) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{93} +} + +func (x *Rule) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *Rule) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Rule) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Rule) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Rule) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Rule) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type San struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *San) Reset() { + *x = San{} + mi := &file_api_entity_proto_msgTypes[94] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *San) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*San) ProtoMessage() {} + +func (x *San) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[94] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use San.ProtoReflect.Descriptor instead. +func (*San) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{94} +} + +func (x *San) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *San) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +type Sbom struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + Package *Package `protobuf:"bytes,3,opt,name=package,proto3" json:"package,omitempty"` + Product *Product `protobuf:"bytes,4,opt,name=product,proto3" json:"product,omitempty"` + SoftwareComponents []*SoftwareComponent `protobuf:"bytes,5,rep,name=software_components,json=softwareComponents,proto3" json:"software_components,omitempty"` + Type string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"` + TypeId Sbom_TypeId `protobuf:"varint,7,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Sbom_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,8,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,9,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Sbom) Reset() { + *x = Sbom{} + mi := &file_api_entity_proto_msgTypes[95] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Sbom) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Sbom) ProtoMessage() {} + +func (x *Sbom) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[95] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Sbom.ProtoReflect.Descriptor instead. +func (*Sbom) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{95} +} + +func (x *Sbom) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Sbom) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Sbom) GetPackage() *Package { + if x != nil { + return x.Package + } + return nil +} + +func (x *Sbom) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *Sbom) GetSoftwareComponents() []*SoftwareComponent { + if x != nil { + return x.SoftwareComponents + } + return nil +} + +func (x *Sbom) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Sbom) GetTypeId() Sbom_TypeId { + if x != nil { + return x.TypeId + } + return Sbom_TYPE_ID_UNKNOWN +} + +func (x *Sbom) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Sbom) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Scim struct { + state protoimpl.MessageState `protogen:"open.v1"` + AuthProtocol string `protobuf:"bytes,1,opt,name=auth_protocol,json=authProtocol,proto3" json:"auth_protocol,omitempty"` + AuthProtocolId Scim_AuthProtocolId `protobuf:"varint,2,opt,name=auth_protocol_id,json=authProtocolId,proto3,enum=ocsf.v1.Scim_AuthProtocolId" json:"auth_protocol_id,omitempty"` + CreatedTime int64 `protobuf:"varint,3,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,4,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + ErrorMessage string `protobuf:"bytes,5,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"` + IsGroupProvisioningEnabled bool `protobuf:"varint,6,opt,name=is_group_provisioning_enabled,json=isGroupProvisioningEnabled,proto3" json:"is_group_provisioning_enabled,omitempty"` + IsUserProvisioningEnabled bool `protobuf:"varint,7,opt,name=is_user_provisioning_enabled,json=isUserProvisioningEnabled,proto3" json:"is_user_provisioning_enabled,omitempty"` + LastRunTime int64 `protobuf:"varint,8,opt,name=last_run_time,json=lastRunTime,proto3" json:"last_run_time,omitempty"` + LastRunTimeDt string `protobuf:"bytes,9,opt,name=last_run_time_dt,json=lastRunTimeDt,proto3" json:"last_run_time_dt,omitempty"` + ModifiedTime int64 `protobuf:"varint,10,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,11,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,12,opt,name=name,proto3" json:"name,omitempty"` + ProtocolName string `protobuf:"bytes,13,opt,name=protocol_name,json=protocolName,proto3" json:"protocol_name,omitempty"` + RateLimit int32 `protobuf:"varint,14,opt,name=rate_limit,json=rateLimit,proto3" json:"rate_limit,omitempty"` + ScimGroupSchema *structpb.Value `protobuf:"bytes,15,opt,name=scim_group_schema,json=scimGroupSchema,proto3" json:"scim_group_schema,omitempty"` + ScimUserSchema *structpb.Value `protobuf:"bytes,16,opt,name=scim_user_schema,json=scimUserSchema,proto3" json:"scim_user_schema,omitempty"` + State string `protobuf:"bytes,17,opt,name=state,proto3" json:"state,omitempty"` + StateId Scim_StateId `protobuf:"varint,18,opt,name=state_id,json=stateId,proto3,enum=ocsf.v1.Scim_StateId" json:"state_id,omitempty"` + Uid string `protobuf:"bytes,19,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,20,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + UrlString string `protobuf:"bytes,21,opt,name=url_string,json=urlString,proto3" json:"url_string,omitempty"` + VendorName string `protobuf:"bytes,22,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + Version string `protobuf:"bytes,23,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Scim) Reset() { + *x = Scim{} + mi := &file_api_entity_proto_msgTypes[96] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Scim) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Scim) ProtoMessage() {} + +func (x *Scim) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[96] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Scim.ProtoReflect.Descriptor instead. +func (*Scim) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{96} +} + +func (x *Scim) GetAuthProtocol() string { + if x != nil { + return x.AuthProtocol + } + return "" +} + +func (x *Scim) GetAuthProtocolId() Scim_AuthProtocolId { + if x != nil { + return x.AuthProtocolId + } + return Scim_AUTH_PROTOCOL_ID_UNKNOWN +} + +func (x *Scim) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Scim) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Scim) GetErrorMessage() string { + if x != nil { + return x.ErrorMessage + } + return "" +} + +func (x *Scim) GetIsGroupProvisioningEnabled() bool { + if x != nil { + return x.IsGroupProvisioningEnabled + } + return false +} + +func (x *Scim) GetIsUserProvisioningEnabled() bool { + if x != nil { + return x.IsUserProvisioningEnabled + } + return false +} + +func (x *Scim) GetLastRunTime() int64 { + if x != nil { + return x.LastRunTime + } + return 0 +} + +func (x *Scim) GetLastRunTimeDt() string { + if x != nil { + return x.LastRunTimeDt + } + return "" +} + +func (x *Scim) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Scim) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Scim) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Scim) GetProtocolName() string { + if x != nil { + return x.ProtocolName + } + return "" +} + +func (x *Scim) GetRateLimit() int32 { + if x != nil { + return x.RateLimit + } + return 0 +} + +func (x *Scim) GetScimGroupSchema() *structpb.Value { + if x != nil { + return x.ScimGroupSchema + } + return nil +} + +func (x *Scim) GetScimUserSchema() *structpb.Value { + if x != nil { + return x.ScimUserSchema + } + return nil +} + +func (x *Scim) GetState() string { + if x != nil { + return x.State + } + return "" +} + +func (x *Scim) GetStateId() Scim_StateId { + if x != nil { + return x.StateId + } + return Scim_STATE_ID_UNKNOWN +} + +func (x *Scim) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Scim) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *Scim) GetUrlString() string { + if x != nil { + return x.UrlString + } + return "" +} + +func (x *Scim) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +func (x *Scim) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Script struct { + state protoimpl.MessageState `protogen:"open.v1"` + File *File `protobuf:"bytes,1,opt,name=file,proto3" json:"file,omitempty"` + Hashes []*Fingerprint `protobuf:"bytes,2,rep,name=hashes,proto3" json:"hashes,omitempty"` + Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` + ParentUid string `protobuf:"bytes,4,opt,name=parent_uid,json=parentUid,proto3" json:"parent_uid,omitempty"` + ScriptContent *LongString `protobuf:"bytes,5,opt,name=script_content,json=scriptContent,proto3" json:"script_content,omitempty"` + Type string `protobuf:"bytes,6,opt,name=type,proto3" json:"type,omitempty"` + TypeId Script_TypeId `protobuf:"varint,7,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Script_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,8,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Script) Reset() { + *x = Script{} + mi := &file_api_entity_proto_msgTypes[97] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Script) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Script) ProtoMessage() {} + +func (x *Script) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[97] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Script.ProtoReflect.Descriptor instead. +func (*Script) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{97} +} + +func (x *Script) GetFile() *File { + if x != nil { + return x.File + } + return nil +} + +func (x *Script) GetHashes() []*Fingerprint { + if x != nil { + return x.Hashes + } + return nil +} + +func (x *Script) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Script) GetParentUid() string { + if x != nil { + return x.ParentUid + } + return "" +} + +func (x *Script) GetScriptContent() *LongString { + if x != nil { + return x.ScriptContent + } + return nil +} + +func (x *Script) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Script) GetTypeId() Script_TypeId { + if x != nil { + return x.TypeId + } + return Script_TYPE_ID_UNKNOWN +} + +func (x *Script) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Service struct { + state protoimpl.MessageState `protogen:"open.v1"` + Labels []string `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"` + Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,5,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Service) Reset() { + *x = Service{} + mi := &file_api_entity_proto_msgTypes[98] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Service) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Service) ProtoMessage() {} + +func (x *Service) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[98] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Service.ProtoReflect.Descriptor instead. +func (*Service) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{98} +} + +func (x *Service) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *Service) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Service) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *Service) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Service) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Session struct { + state protoimpl.MessageState `protogen:"open.v1"` + Count int32 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"` + CreatedTime int64 `protobuf:"varint,2,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,3,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + CredentialUid string `protobuf:"bytes,4,opt,name=credential_uid,json=credentialUid,proto3" json:"credential_uid,omitempty"` + ExpirationReason string `protobuf:"bytes,5,opt,name=expiration_reason,json=expirationReason,proto3" json:"expiration_reason,omitempty"` + ExpirationTime int64 `protobuf:"varint,6,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"` + ExpirationTimeDt string `protobuf:"bytes,7,opt,name=expiration_time_dt,json=expirationTimeDt,proto3" json:"expiration_time_dt,omitempty"` + IsMfa bool `protobuf:"varint,8,opt,name=is_mfa,json=isMfa,proto3" json:"is_mfa,omitempty"` + IsRemote bool `protobuf:"varint,9,opt,name=is_remote,json=isRemote,proto3" json:"is_remote,omitempty"` + IsVpn bool `protobuf:"varint,10,opt,name=is_vpn,json=isVpn,proto3" json:"is_vpn,omitempty"` + Issuer string `protobuf:"bytes,11,opt,name=issuer,proto3" json:"issuer,omitempty"` + Terminal string `protobuf:"bytes,12,opt,name=terminal,proto3" json:"terminal,omitempty"` + Uid string `protobuf:"bytes,13,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,14,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + Uuid string `protobuf:"bytes,15,opt,name=uuid,proto3" json:"uuid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Session) Reset() { + *x = Session{} + mi := &file_api_entity_proto_msgTypes[99] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Session) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Session) ProtoMessage() {} + +func (x *Session) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[99] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Session.ProtoReflect.Descriptor instead. +func (*Session) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{99} +} + +func (x *Session) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *Session) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Session) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Session) GetCredentialUid() string { + if x != nil { + return x.CredentialUid + } + return "" +} + +func (x *Session) GetExpirationReason() string { + if x != nil { + return x.ExpirationReason + } + return "" +} + +func (x *Session) GetExpirationTime() int64 { + if x != nil { + return x.ExpirationTime + } + return 0 +} + +func (x *Session) GetExpirationTimeDt() string { + if x != nil { + return x.ExpirationTimeDt + } + return "" +} + +func (x *Session) GetIsMfa() bool { + if x != nil { + return x.IsMfa + } + return false +} + +func (x *Session) GetIsRemote() bool { + if x != nil { + return x.IsRemote + } + return false +} + +func (x *Session) GetIsVpn() bool { + if x != nil { + return x.IsVpn + } + return false +} + +func (x *Session) GetIssuer() string { + if x != nil { + return x.Issuer + } + return "" +} + +func (x *Session) GetTerminal() string { + if x != nil { + return x.Terminal + } + return "" +} + +func (x *Session) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Session) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +func (x *Session) GetUuid() string { + if x != nil { + return x.Uuid + } + return "" +} + +type SoftwareComponent struct { + state protoimpl.MessageState `protogen:"open.v1"` + Author string `protobuf:"bytes,1,opt,name=author,proto3" json:"author,omitempty"` + Hash *Fingerprint `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"` + License string `protobuf:"bytes,3,opt,name=license,proto3" json:"license,omitempty"` + Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` + Purl string `protobuf:"bytes,5,opt,name=purl,proto3" json:"purl,omitempty"` + RelatedComponent string `protobuf:"bytes,6,opt,name=related_component,json=relatedComponent,proto3" json:"related_component,omitempty"` + Relationship string `protobuf:"bytes,7,opt,name=relationship,proto3" json:"relationship,omitempty"` + RelationshipId SoftwareComponent_RelationshipId `protobuf:"varint,8,opt,name=relationship_id,json=relationshipId,proto3,enum=ocsf.v1.SoftwareComponent_RelationshipId" json:"relationship_id,omitempty"` + Type string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"` + TypeId SoftwareComponent_TypeId `protobuf:"varint,10,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.SoftwareComponent_TypeId" json:"type_id,omitempty"` + Version string `protobuf:"bytes,11,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SoftwareComponent) Reset() { + *x = SoftwareComponent{} + mi := &file_api_entity_proto_msgTypes[100] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SoftwareComponent) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SoftwareComponent) ProtoMessage() {} + +func (x *SoftwareComponent) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[100] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SoftwareComponent.ProtoReflect.Descriptor instead. +func (*SoftwareComponent) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{100} +} + +func (x *SoftwareComponent) GetAuthor() string { + if x != nil { + return x.Author + } + return "" +} + +func (x *SoftwareComponent) GetHash() *Fingerprint { + if x != nil { + return x.Hash + } + return nil +} + +func (x *SoftwareComponent) GetLicense() string { + if x != nil { + return x.License + } + return "" +} + +func (x *SoftwareComponent) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *SoftwareComponent) GetPurl() string { + if x != nil { + return x.Purl + } + return "" +} + +func (x *SoftwareComponent) GetRelatedComponent() string { + if x != nil { + return x.RelatedComponent + } + return "" +} + +func (x *SoftwareComponent) GetRelationship() string { + if x != nil { + return x.Relationship + } + return "" +} + +func (x *SoftwareComponent) GetRelationshipId() SoftwareComponent_RelationshipId { + if x != nil { + return x.RelationshipId + } + return SoftwareComponent_RELATIONSHIP_ID_UNKNOWN +} + +func (x *SoftwareComponent) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *SoftwareComponent) GetTypeId() SoftwareComponent_TypeId { + if x != nil { + return x.TypeId + } + return SoftwareComponent_TYPE_ID_UNKNOWN +} + +func (x *SoftwareComponent) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +type Span struct { + state protoimpl.MessageState `protogen:"open.v1"` + Duration int64 `protobuf:"varint,1,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,2,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,3,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` + Operation string `protobuf:"bytes,5,opt,name=operation,proto3" json:"operation,omitempty"` + ParentUid string `protobuf:"bytes,6,opt,name=parent_uid,json=parentUid,proto3" json:"parent_uid,omitempty"` + Service *Service `protobuf:"bytes,7,opt,name=service,proto3" json:"service,omitempty"` + StartTime int64 `protobuf:"varint,8,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,9,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + StatusCode string `protobuf:"bytes,10,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + Uid string `protobuf:"bytes,11,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Span) Reset() { + *x = Span{} + mi := &file_api_entity_proto_msgTypes[101] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Span) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Span) ProtoMessage() {} + +func (x *Span) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[101] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Span.ProtoReflect.Descriptor instead. +func (*Span) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{101} +} + +func (x *Span) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *Span) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *Span) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *Span) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *Span) GetOperation() string { + if x != nil { + return x.Operation + } + return "" +} + +func (x *Span) GetParentUid() string { + if x != nil { + return x.ParentUid + } + return "" +} + +func (x *Span) GetService() *Service { + if x != nil { + return x.Service + } + return nil +} + +func (x *Span) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *Span) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *Span) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *Span) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Sso struct { + state protoimpl.MessageState `protogen:"open.v1"` + AuthProtocol string `protobuf:"bytes,1,opt,name=auth_protocol,json=authProtocol,proto3" json:"auth_protocol,omitempty"` + AuthProtocolId Sso_AuthProtocolId `protobuf:"varint,2,opt,name=auth_protocol_id,json=authProtocolId,proto3,enum=ocsf.v1.Sso_AuthProtocolId" json:"auth_protocol_id,omitempty"` + Certificate *Certificate `protobuf:"bytes,3,opt,name=certificate,proto3" json:"certificate,omitempty"` + CreatedTime int64 `protobuf:"varint,4,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,5,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + DurationMins int32 `protobuf:"varint,6,opt,name=duration_mins,json=durationMins,proto3" json:"duration_mins,omitempty"` + IdleTimeout int32 `protobuf:"varint,7,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"` + LoginEndpoint string `protobuf:"bytes,8,opt,name=login_endpoint,json=loginEndpoint,proto3" json:"login_endpoint,omitempty"` + LogoutEndpoint string `protobuf:"bytes,9,opt,name=logout_endpoint,json=logoutEndpoint,proto3" json:"logout_endpoint,omitempty"` + MetadataEndpoint string `protobuf:"bytes,10,opt,name=metadata_endpoint,json=metadataEndpoint,proto3" json:"metadata_endpoint,omitempty"` + ModifiedTime int64 `protobuf:"varint,11,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,12,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,13,opt,name=name,proto3" json:"name,omitempty"` + ProtocolName string `protobuf:"bytes,14,opt,name=protocol_name,json=protocolName,proto3" json:"protocol_name,omitempty"` + Scopes []string `protobuf:"bytes,15,rep,name=scopes,proto3" json:"scopes,omitempty"` + Uid string `protobuf:"bytes,16,opt,name=uid,proto3" json:"uid,omitempty"` + VendorName string `protobuf:"bytes,17,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Sso) Reset() { + *x = Sso{} + mi := &file_api_entity_proto_msgTypes[102] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Sso) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Sso) ProtoMessage() {} + +func (x *Sso) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[102] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Sso.ProtoReflect.Descriptor instead. +func (*Sso) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{102} +} + +func (x *Sso) GetAuthProtocol() string { + if x != nil { + return x.AuthProtocol + } + return "" +} + +func (x *Sso) GetAuthProtocolId() Sso_AuthProtocolId { + if x != nil { + return x.AuthProtocolId + } + return Sso_AUTH_PROTOCOL_ID_UNKNOWN +} + +func (x *Sso) GetCertificate() *Certificate { + if x != nil { + return x.Certificate + } + return nil +} + +func (x *Sso) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Sso) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Sso) GetDurationMins() int32 { + if x != nil { + return x.DurationMins + } + return 0 +} + +func (x *Sso) GetIdleTimeout() int32 { + if x != nil { + return x.IdleTimeout + } + return 0 +} + +func (x *Sso) GetLoginEndpoint() string { + if x != nil { + return x.LoginEndpoint + } + return "" +} + +func (x *Sso) GetLogoutEndpoint() string { + if x != nil { + return x.LogoutEndpoint + } + return "" +} + +func (x *Sso) GetMetadataEndpoint() string { + if x != nil { + return x.MetadataEndpoint + } + return "" +} + +func (x *Sso) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Sso) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Sso) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Sso) GetProtocolName() string { + if x != nil { + return x.ProtocolName + } + return "" +} + +func (x *Sso) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + +func (x *Sso) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Sso) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +type SubTechnique struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SubTechnique) Reset() { + *x = SubTechnique{} + mi := &file_api_entity_proto_msgTypes[103] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SubTechnique) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SubTechnique) ProtoMessage() {} + +func (x *SubTechnique) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[103] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SubTechnique.ProtoReflect.Descriptor instead. +func (*SubTechnique) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{103} +} + +func (x *SubTechnique) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *SubTechnique) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *SubTechnique) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Tactic struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Tactic) Reset() { + *x = Tactic{} + mi := &file_api_entity_proto_msgTypes[104] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Tactic) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Tactic) ProtoMessage() {} + +func (x *Tactic) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[104] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Tactic.ProtoReflect.Descriptor instead. +func (*Tactic) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{104} +} + +func (x *Tactic) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Tactic) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Tactic) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type Technique struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + SrcUrl string `protobuf:"bytes,2,opt,name=src_url,json=srcUrl,proto3" json:"src_url,omitempty"` + Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Technique) Reset() { + *x = Technique{} + mi := &file_api_entity_proto_msgTypes[105] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Technique) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Technique) ProtoMessage() {} + +func (x *Technique) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[105] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Technique.ProtoReflect.Descriptor instead. +func (*Technique) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{105} +} + +func (x *Technique) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Technique) GetSrcUrl() string { + if x != nil { + return x.SrcUrl + } + return "" +} + +func (x *Technique) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type ThreatActor struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"` + TypeId ThreatActor_TypeId `protobuf:"varint,3,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.ThreatActor_TypeId" json:"type_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ThreatActor) Reset() { + *x = ThreatActor{} + mi := &file_api_entity_proto_msgTypes[106] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ThreatActor) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ThreatActor) ProtoMessage() {} + +func (x *ThreatActor) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[106] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ThreatActor.ProtoReflect.Descriptor instead. +func (*ThreatActor) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{106} +} + +func (x *ThreatActor) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ThreatActor) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *ThreatActor) GetTypeId() ThreatActor_TypeId { + if x != nil { + return x.TypeId + } + return ThreatActor_TYPE_ID_UNKNOWN +} + +type Timespan struct { + state protoimpl.MessageState `protogen:"open.v1"` + Duration int64 `protobuf:"varint,1,opt,name=duration,proto3" json:"duration,omitempty"` + DurationDays int32 `protobuf:"varint,2,opt,name=duration_days,json=durationDays,proto3" json:"duration_days,omitempty"` + DurationHours int32 `protobuf:"varint,3,opt,name=duration_hours,json=durationHours,proto3" json:"duration_hours,omitempty"` + DurationMins int32 `protobuf:"varint,4,opt,name=duration_mins,json=durationMins,proto3" json:"duration_mins,omitempty"` + DurationMonths int32 `protobuf:"varint,5,opt,name=duration_months,json=durationMonths,proto3" json:"duration_months,omitempty"` + DurationSecs int32 `protobuf:"varint,6,opt,name=duration_secs,json=durationSecs,proto3" json:"duration_secs,omitempty"` + DurationWeeks int32 `protobuf:"varint,7,opt,name=duration_weeks,json=durationWeeks,proto3" json:"duration_weeks,omitempty"` + DurationYears int32 `protobuf:"varint,8,opt,name=duration_years,json=durationYears,proto3" json:"duration_years,omitempty"` + EndTime int64 `protobuf:"varint,9,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,10,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + StartTime int64 `protobuf:"varint,11,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,12,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Type string `protobuf:"bytes,13,opt,name=type,proto3" json:"type,omitempty"` + TypeId Timespan_TypeId `protobuf:"varint,14,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Timespan_TypeId" json:"type_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Timespan) Reset() { + *x = Timespan{} + mi := &file_api_entity_proto_msgTypes[107] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Timespan) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Timespan) ProtoMessage() {} + +func (x *Timespan) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[107] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Timespan.ProtoReflect.Descriptor instead. +func (*Timespan) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{107} +} + +func (x *Timespan) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *Timespan) GetDurationDays() int32 { + if x != nil { + return x.DurationDays + } + return 0 +} + +func (x *Timespan) GetDurationHours() int32 { + if x != nil { + return x.DurationHours + } + return 0 +} + +func (x *Timespan) GetDurationMins() int32 { + if x != nil { + return x.DurationMins + } + return 0 +} + +func (x *Timespan) GetDurationMonths() int32 { + if x != nil { + return x.DurationMonths + } + return 0 +} + +func (x *Timespan) GetDurationSecs() int32 { + if x != nil { + return x.DurationSecs + } + return 0 +} + +func (x *Timespan) GetDurationWeeks() int32 { + if x != nil { + return x.DurationWeeks + } + return 0 +} + +func (x *Timespan) GetDurationYears() int32 { + if x != nil { + return x.DurationYears + } + return 0 +} + +func (x *Timespan) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *Timespan) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *Timespan) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *Timespan) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *Timespan) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Timespan) GetTypeId() Timespan_TypeId { + if x != nil { + return x.TypeId + } + return Timespan_TYPE_ID_UNKNOWN +} + +type Token struct { + state protoimpl.MessageState `protogen:"open.v1"` + CreatedTime int64 `protobuf:"varint,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,2,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + ExpirationTime int64 `protobuf:"varint,3,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"` + ExpirationTimeDt string `protobuf:"bytes,4,opt,name=expiration_time_dt,json=expirationTimeDt,proto3" json:"expiration_time_dt,omitempty"` + IsRenewable bool `protobuf:"varint,5,opt,name=is_renewable,json=isRenewable,proto3" json:"is_renewable,omitempty"` + ModifiedTime int64 `protobuf:"varint,6,opt,name=modified_time,json=modifiedTime,proto3" json:"modified_time,omitempty"` + ModifiedTimeDt string `protobuf:"bytes,7,opt,name=modified_time_dt,json=modifiedTimeDt,proto3" json:"modified_time_dt,omitempty"` + Name string `protobuf:"bytes,8,opt,name=name,proto3" json:"name,omitempty"` + TenantUid string `protobuf:"bytes,9,opt,name=tenant_uid,json=tenantUid,proto3" json:"tenant_uid,omitempty"` + Type string `protobuf:"bytes,10,opt,name=type,proto3" json:"type,omitempty"` + TypeId Token_TypeId `protobuf:"varint,11,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.Token_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,12,opt,name=uid,proto3" json:"uid,omitempty"` + Zone string `protobuf:"bytes,13,opt,name=zone,proto3" json:"zone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Token) Reset() { + *x = Token{} + mi := &file_api_entity_proto_msgTypes[108] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Token) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Token) ProtoMessage() {} + +func (x *Token) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[108] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Token.ProtoReflect.Descriptor instead. +func (*Token) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{108} +} + +func (x *Token) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Token) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Token) GetExpirationTime() int64 { + if x != nil { + return x.ExpirationTime + } + return 0 +} + +func (x *Token) GetExpirationTimeDt() string { + if x != nil { + return x.ExpirationTimeDt + } + return "" +} + +func (x *Token) GetIsRenewable() bool { + if x != nil { + return x.IsRenewable + } + return false +} + +func (x *Token) GetModifiedTime() int64 { + if x != nil { + return x.ModifiedTime + } + return 0 +} + +func (x *Token) GetModifiedTimeDt() string { + if x != nil { + return x.ModifiedTimeDt + } + return "" +} + +func (x *Token) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *Token) GetTenantUid() string { + if x != nil { + return x.TenantUid + } + return "" +} + +func (x *Token) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *Token) GetTypeId() Token_TypeId { + if x != nil { + return x.TypeId + } + return Token_TYPE_ID_UNKNOWN +} + +func (x *Token) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *Token) GetZone() string { + if x != nil { + return x.Zone + } + return "" +} + +type Trace struct { + state protoimpl.MessageState `protogen:"open.v1"` + Duration int64 `protobuf:"varint,1,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,2,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,3,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Flags []string `protobuf:"bytes,4,rep,name=flags,proto3" json:"flags,omitempty"` + Service *Service `protobuf:"bytes,5,opt,name=service,proto3" json:"service,omitempty"` + Span *Span `protobuf:"bytes,6,opt,name=span,proto3" json:"span,omitempty"` + StartTime int64 `protobuf:"varint,7,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,8,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Uid string `protobuf:"bytes,9,opt,name=uid,proto3" json:"uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Trace) Reset() { + *x = Trace{} + mi := &file_api_entity_proto_msgTypes[109] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Trace) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Trace) ProtoMessage() {} + +func (x *Trace) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[109] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Trace.ProtoReflect.Descriptor instead. +func (*Trace) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{109} +} + +func (x *Trace) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *Trace) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *Trace) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *Trace) GetFlags() []string { + if x != nil { + return x.Flags + } + return nil +} + +func (x *Trace) GetService() *Service { + if x != nil { + return x.Service + } + return nil +} + +func (x *Trace) GetSpan() *Span { + if x != nil { + return x.Span + } + return nil +} + +func (x *Trace) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *Trace) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *Trace) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +type TransformationInfo struct { + state protoimpl.MessageState `protogen:"open.v1"` + Lang string `protobuf:"bytes,1,opt,name=lang,proto3" json:"lang,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Product *Product `protobuf:"bytes,3,opt,name=product,proto3" json:"product,omitempty"` + Time int64 `protobuf:"varint,4,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,5,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + Uid string `protobuf:"bytes,6,opt,name=uid,proto3" json:"uid,omitempty"` + UrlString string `protobuf:"bytes,7,opt,name=url_string,json=urlString,proto3" json:"url_string,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *TransformationInfo) Reset() { + *x = TransformationInfo{} + mi := &file_api_entity_proto_msgTypes[110] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *TransformationInfo) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*TransformationInfo) ProtoMessage() {} + +func (x *TransformationInfo) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[110] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use TransformationInfo.ProtoReflect.Descriptor instead. +func (*TransformationInfo) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{110} +} + +func (x *TransformationInfo) GetLang() string { + if x != nil { + return x.Lang + } + return "" +} + +func (x *TransformationInfo) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *TransformationInfo) GetProduct() *Product { + if x != nil { + return x.Product + } + return nil +} + +func (x *TransformationInfo) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *TransformationInfo) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *TransformationInfo) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *TransformationInfo) GetUrlString() string { + if x != nil { + return x.UrlString + } + return "" +} + +type Url struct { + state protoimpl.MessageState `protogen:"open.v1"` + Categories []string `protobuf:"bytes,1,rep,name=categories,proto3" json:"categories,omitempty"` + CategoryIds []Url_CategoryIds `protobuf:"varint,2,rep,packed,name=category_ids,json=categoryIds,proto3,enum=ocsf.v1.Url_CategoryIds" json:"category_ids,omitempty"` + Domain string `protobuf:"bytes,3,opt,name=domain,proto3" json:"domain,omitempty"` + Hostname string `protobuf:"bytes,4,opt,name=hostname,proto3" json:"hostname,omitempty"` + Path string `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"` + Port int32 `protobuf:"varint,6,opt,name=port,proto3" json:"port,omitempty"` + QueryString string `protobuf:"bytes,7,opt,name=query_string,json=queryString,proto3" json:"query_string,omitempty"` + ResourceType string `protobuf:"bytes,8,opt,name=resource_type,json=resourceType,proto3" json:"resource_type,omitempty"` + Scheme string `protobuf:"bytes,9,opt,name=scheme,proto3" json:"scheme,omitempty"` + Subdomain string `protobuf:"bytes,10,opt,name=subdomain,proto3" json:"subdomain,omitempty"` + UrlString string `protobuf:"bytes,11,opt,name=url_string,json=urlString,proto3" json:"url_string,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Url) Reset() { + *x = Url{} + mi := &file_api_entity_proto_msgTypes[111] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Url) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Url) ProtoMessage() {} + +func (x *Url) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[111] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Url.ProtoReflect.Descriptor instead. +func (*Url) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{111} +} + +func (x *Url) GetCategories() []string { + if x != nil { + return x.Categories + } + return nil +} + +func (x *Url) GetCategoryIds() []Url_CategoryIds { + if x != nil { + return x.CategoryIds + } + return nil +} + +func (x *Url) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *Url) GetHostname() string { + if x != nil { + return x.Hostname + } + return "" +} + +func (x *Url) GetPath() string { + if x != nil { + return x.Path + } + return "" +} + +func (x *Url) GetPort() int32 { + if x != nil { + return x.Port + } + return 0 +} + +func (x *Url) GetQueryString() string { + if x != nil { + return x.QueryString + } + return "" +} + +func (x *Url) GetResourceType() string { + if x != nil { + return x.ResourceType + } + return "" +} + +func (x *Url) GetScheme() string { + if x != nil { + return x.Scheme + } + return "" +} + +func (x *Url) GetSubdomain() string { + if x != nil { + return x.Subdomain + } + return "" +} + +func (x *Url) GetUrlString() string { + if x != nil { + return x.UrlString + } + return "" +} + +type User struct { + state protoimpl.MessageState `protogen:"open.v1"` + Account *Account `protobuf:"bytes,1,opt,name=account,proto3" json:"account,omitempty"` + CredentialUid string `protobuf:"bytes,2,opt,name=credential_uid,json=credentialUid,proto3" json:"credential_uid,omitempty"` + DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` + Domain string `protobuf:"bytes,4,opt,name=domain,proto3" json:"domain,omitempty"` + EmailAddr string `protobuf:"bytes,5,opt,name=email_addr,json=emailAddr,proto3" json:"email_addr,omitempty"` + ForwardAddr string `protobuf:"bytes,6,opt,name=forward_addr,json=forwardAddr,proto3" json:"forward_addr,omitempty"` + FullName string `protobuf:"bytes,7,opt,name=full_name,json=fullName,proto3" json:"full_name,omitempty"` + Groups []*Group `protobuf:"bytes,8,rep,name=groups,proto3" json:"groups,omitempty"` + HasMfa bool `protobuf:"varint,9,opt,name=has_mfa,json=hasMfa,proto3" json:"has_mfa,omitempty"` + LdapPerson *LdapPerson `protobuf:"bytes,10,opt,name=ldap_person,json=ldapPerson,proto3" json:"ldap_person,omitempty"` + Name string `protobuf:"bytes,11,opt,name=name,proto3" json:"name,omitempty"` + Org *Organization `protobuf:"bytes,12,opt,name=org,proto3" json:"org,omitempty"` + PhoneNumber string `protobuf:"bytes,13,opt,name=phone_number,json=phoneNumber,proto3" json:"phone_number,omitempty"` + ProgrammaticCredentials []*ProgrammaticCredential `protobuf:"bytes,14,rep,name=programmatic_credentials,json=programmaticCredentials,proto3" json:"programmatic_credentials,omitempty"` + RiskLevel string `protobuf:"bytes,15,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId User_RiskLevelId `protobuf:"varint,16,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.User_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,17,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Type string `protobuf:"bytes,18,opt,name=type,proto3" json:"type,omitempty"` + TypeId User_TypeId `protobuf:"varint,19,opt,name=type_id,json=typeId,proto3,enum=ocsf.v1.User_TypeId" json:"type_id,omitempty"` + Uid string `protobuf:"bytes,20,opt,name=uid,proto3" json:"uid,omitempty"` + UidAlt string `protobuf:"bytes,21,opt,name=uid_alt,json=uidAlt,proto3" json:"uid_alt,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *User) Reset() { + *x = User{} + mi := &file_api_entity_proto_msgTypes[112] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *User) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*User) ProtoMessage() {} + +func (x *User) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[112] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use User.ProtoReflect.Descriptor instead. +func (*User) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{112} +} + +func (x *User) GetAccount() *Account { + if x != nil { + return x.Account + } + return nil +} + +func (x *User) GetCredentialUid() string { + if x != nil { + return x.CredentialUid + } + return "" +} + +func (x *User) GetDisplayName() string { + if x != nil { + return x.DisplayName + } + return "" +} + +func (x *User) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *User) GetEmailAddr() string { + if x != nil { + return x.EmailAddr + } + return "" +} + +func (x *User) GetForwardAddr() string { + if x != nil { + return x.ForwardAddr + } + return "" +} + +func (x *User) GetFullName() string { + if x != nil { + return x.FullName + } + return "" +} + +func (x *User) GetGroups() []*Group { + if x != nil { + return x.Groups + } + return nil +} + +func (x *User) GetHasMfa() bool { + if x != nil { + return x.HasMfa + } + return false +} + +func (x *User) GetLdapPerson() *LdapPerson { + if x != nil { + return x.LdapPerson + } + return nil +} + +func (x *User) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *User) GetOrg() *Organization { + if x != nil { + return x.Org + } + return nil +} + +func (x *User) GetPhoneNumber() string { + if x != nil { + return x.PhoneNumber + } + return "" +} + +func (x *User) GetProgrammaticCredentials() []*ProgrammaticCredential { + if x != nil { + return x.ProgrammaticCredentials + } + return nil +} + +func (x *User) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *User) GetRiskLevelId() User_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return User_RISK_LEVEL_ID_INFO +} + +func (x *User) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *User) GetType() string { + if x != nil { + return x.Type + } + return "" +} + +func (x *User) GetTypeId() User_TypeId { + if x != nil { + return x.TypeId + } + return User_TYPE_ID_UNKNOWN +} + +func (x *User) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *User) GetUidAlt() string { + if x != nil { + return x.UidAlt + } + return "" +} + +type Vulnerability struct { + state protoimpl.MessageState `protogen:"open.v1"` + Advisory *Advisory `protobuf:"bytes,1,opt,name=advisory,proto3" json:"advisory,omitempty"` + AffectedCode []*AffectedCode `protobuf:"bytes,2,rep,name=affected_code,json=affectedCode,proto3" json:"affected_code,omitempty"` + AffectedPackages []*AffectedPackage `protobuf:"bytes,3,rep,name=affected_packages,json=affectedPackages,proto3" json:"affected_packages,omitempty"` + Category string `protobuf:"bytes,4,opt,name=category,proto3" json:"category,omitempty"` + Cve *Cve `protobuf:"bytes,5,opt,name=cve,proto3" json:"cve,omitempty"` + Cwe *Cwe `protobuf:"bytes,6,opt,name=cwe,proto3" json:"cwe,omitempty"` + DependencyChain string `protobuf:"bytes,7,opt,name=dependency_chain,json=dependencyChain,proto3" json:"dependency_chain,omitempty"` + Desc string `protobuf:"bytes,8,opt,name=desc,proto3" json:"desc,omitempty"` + ExploitLastSeenTime int64 `protobuf:"varint,9,opt,name=exploit_last_seen_time,json=exploitLastSeenTime,proto3" json:"exploit_last_seen_time,omitempty"` + ExploitLastSeenTimeDt string `protobuf:"bytes,10,opt,name=exploit_last_seen_time_dt,json=exploitLastSeenTimeDt,proto3" json:"exploit_last_seen_time_dt,omitempty"` + ExploitRefUrl string `protobuf:"bytes,11,opt,name=exploit_ref_url,json=exploitRefUrl,proto3" json:"exploit_ref_url,omitempty"` + ExploitRequirement string `protobuf:"bytes,12,opt,name=exploit_requirement,json=exploitRequirement,proto3" json:"exploit_requirement,omitempty"` + ExploitType string `protobuf:"bytes,13,opt,name=exploit_type,json=exploitType,proto3" json:"exploit_type,omitempty"` + FirstSeenTime int64 `protobuf:"varint,14,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"` + FirstSeenTimeDt string `protobuf:"bytes,15,opt,name=first_seen_time_dt,json=firstSeenTimeDt,proto3" json:"first_seen_time_dt,omitempty"` + FixAvailable bool `protobuf:"varint,16,opt,name=fix_available,json=fixAvailable,proto3" json:"fix_available,omitempty"` + FixCoverage string `protobuf:"bytes,17,opt,name=fix_coverage,json=fixCoverage,proto3" json:"fix_coverage,omitempty"` + FixCoverageId Vulnerability_FixCoverageId `protobuf:"varint,18,opt,name=fix_coverage_id,json=fixCoverageId,proto3,enum=ocsf.v1.Vulnerability_FixCoverageId" json:"fix_coverage_id,omitempty"` + IsExploitAvailable bool `protobuf:"varint,19,opt,name=is_exploit_available,json=isExploitAvailable,proto3" json:"is_exploit_available,omitempty"` + IsFixAvailable bool `protobuf:"varint,20,opt,name=is_fix_available,json=isFixAvailable,proto3" json:"is_fix_available,omitempty"` + KbArticleList []*KbArticle `protobuf:"bytes,21,rep,name=kb_article_list,json=kbArticleList,proto3" json:"kb_article_list,omitempty"` + KbArticles []string `protobuf:"bytes,22,rep,name=kb_articles,json=kbArticles,proto3" json:"kb_articles,omitempty"` + LastSeenTime int64 `protobuf:"varint,23,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"` + LastSeenTimeDt string `protobuf:"bytes,24,opt,name=last_seen_time_dt,json=lastSeenTimeDt,proto3" json:"last_seen_time_dt,omitempty"` + Packages []*Package `protobuf:"bytes,25,rep,name=packages,proto3" json:"packages,omitempty"` + References []string `protobuf:"bytes,26,rep,name=references,proto3" json:"references,omitempty"` + RelatedVulnerabilities []string `protobuf:"bytes,27,rep,name=related_vulnerabilities,json=relatedVulnerabilities,proto3" json:"related_vulnerabilities,omitempty"` + Remediation *Remediation `protobuf:"bytes,28,opt,name=remediation,proto3" json:"remediation,omitempty"` + Severity string `protobuf:"bytes,29,opt,name=severity,proto3" json:"severity,omitempty"` + Title string `protobuf:"bytes,30,opt,name=title,proto3" json:"title,omitempty"` + VendorName string `protobuf:"bytes,31,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Vulnerability) Reset() { + *x = Vulnerability{} + mi := &file_api_entity_proto_msgTypes[113] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Vulnerability) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Vulnerability) ProtoMessage() {} + +func (x *Vulnerability) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[113] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Vulnerability.ProtoReflect.Descriptor instead. +func (*Vulnerability) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{113} +} + +func (x *Vulnerability) GetAdvisory() *Advisory { + if x != nil { + return x.Advisory + } + return nil +} + +func (x *Vulnerability) GetAffectedCode() []*AffectedCode { + if x != nil { + return x.AffectedCode + } + return nil +} + +func (x *Vulnerability) GetAffectedPackages() []*AffectedPackage { + if x != nil { + return x.AffectedPackages + } + return nil +} + +func (x *Vulnerability) GetCategory() string { + if x != nil { + return x.Category + } + return "" +} + +func (x *Vulnerability) GetCve() *Cve { + if x != nil { + return x.Cve + } + return nil +} + +func (x *Vulnerability) GetCwe() *Cwe { + if x != nil { + return x.Cwe + } + return nil +} + +func (x *Vulnerability) GetDependencyChain() string { + if x != nil { + return x.DependencyChain + } + return "" +} + +func (x *Vulnerability) GetDesc() string { + if x != nil { + return x.Desc + } + return "" +} + +func (x *Vulnerability) GetExploitLastSeenTime() int64 { + if x != nil { + return x.ExploitLastSeenTime + } + return 0 +} + +func (x *Vulnerability) GetExploitLastSeenTimeDt() string { + if x != nil { + return x.ExploitLastSeenTimeDt + } + return "" +} + +func (x *Vulnerability) GetExploitRefUrl() string { + if x != nil { + return x.ExploitRefUrl + } + return "" +} + +func (x *Vulnerability) GetExploitRequirement() string { + if x != nil { + return x.ExploitRequirement + } + return "" +} + +func (x *Vulnerability) GetExploitType() string { + if x != nil { + return x.ExploitType + } + return "" +} + +func (x *Vulnerability) GetFirstSeenTime() int64 { + if x != nil { + return x.FirstSeenTime + } + return 0 +} + +func (x *Vulnerability) GetFirstSeenTimeDt() string { + if x != nil { + return x.FirstSeenTimeDt + } + return "" +} + +func (x *Vulnerability) GetFixAvailable() bool { + if x != nil { + return x.FixAvailable + } + return false +} + +func (x *Vulnerability) GetFixCoverage() string { + if x != nil { + return x.FixCoverage + } + return "" +} + +func (x *Vulnerability) GetFixCoverageId() Vulnerability_FixCoverageId { + if x != nil { + return x.FixCoverageId + } + return Vulnerability_FIX_COVERAGE_ID_UNKNOWN +} + +func (x *Vulnerability) GetIsExploitAvailable() bool { + if x != nil { + return x.IsExploitAvailable + } + return false +} + +func (x *Vulnerability) GetIsFixAvailable() bool { + if x != nil { + return x.IsFixAvailable + } + return false +} + +func (x *Vulnerability) GetKbArticleList() []*KbArticle { + if x != nil { + return x.KbArticleList + } + return nil +} + +func (x *Vulnerability) GetKbArticles() []string { + if x != nil { + return x.KbArticles + } + return nil +} + +func (x *Vulnerability) GetLastSeenTime() int64 { + if x != nil { + return x.LastSeenTime + } + return 0 +} + +func (x *Vulnerability) GetLastSeenTimeDt() string { + if x != nil { + return x.LastSeenTimeDt + } + return "" +} + +func (x *Vulnerability) GetPackages() []*Package { + if x != nil { + return x.Packages + } + return nil +} + +func (x *Vulnerability) GetReferences() []string { + if x != nil { + return x.References + } + return nil +} + +func (x *Vulnerability) GetRelatedVulnerabilities() []string { + if x != nil { + return x.RelatedVulnerabilities + } + return nil +} + +func (x *Vulnerability) GetRemediation() *Remediation { + if x != nil { + return x.Remediation + } + return nil +} + +func (x *Vulnerability) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *Vulnerability) GetTitle() string { + if x != nil { + return x.Title + } + return "" +} + +func (x *Vulnerability) GetVendorName() string { + if x != nil { + return x.VendorName + } + return "" +} + +type Whois struct { + state protoimpl.MessageState `protogen:"open.v1"` + AutonomousSystem *AutonomousSystem `protobuf:"bytes,1,opt,name=autonomous_system,json=autonomousSystem,proto3" json:"autonomous_system,omitempty"` + CreatedTime int64 `protobuf:"varint,2,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"` + CreatedTimeDt string `protobuf:"bytes,3,opt,name=created_time_dt,json=createdTimeDt,proto3" json:"created_time_dt,omitempty"` + DnssecStatus string `protobuf:"bytes,4,opt,name=dnssec_status,json=dnssecStatus,proto3" json:"dnssec_status,omitempty"` + DnssecStatusId Whois_DnssecStatusId `protobuf:"varint,5,opt,name=dnssec_status_id,json=dnssecStatusId,proto3,enum=ocsf.v1.Whois_DnssecStatusId" json:"dnssec_status_id,omitempty"` + Domain string `protobuf:"bytes,6,opt,name=domain,proto3" json:"domain,omitempty"` + DomainContacts []*DomainContact `protobuf:"bytes,7,rep,name=domain_contacts,json=domainContacts,proto3" json:"domain_contacts,omitempty"` + EmailAddr string `protobuf:"bytes,8,opt,name=email_addr,json=emailAddr,proto3" json:"email_addr,omitempty"` + Isp string `protobuf:"bytes,9,opt,name=isp,proto3" json:"isp,omitempty"` + IspOrg string `protobuf:"bytes,10,opt,name=isp_org,json=ispOrg,proto3" json:"isp_org,omitempty"` + LastSeenTime int64 `protobuf:"varint,11,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"` + LastSeenTimeDt string `protobuf:"bytes,12,opt,name=last_seen_time_dt,json=lastSeenTimeDt,proto3" json:"last_seen_time_dt,omitempty"` + NameServers []string `protobuf:"bytes,13,rep,name=name_servers,json=nameServers,proto3" json:"name_servers,omitempty"` + PhoneNumber string `protobuf:"bytes,14,opt,name=phone_number,json=phoneNumber,proto3" json:"phone_number,omitempty"` + Registrar string `protobuf:"bytes,15,opt,name=registrar,proto3" json:"registrar,omitempty"` + Status string `protobuf:"bytes,16,opt,name=status,proto3" json:"status,omitempty"` + Subdomains []string `protobuf:"bytes,17,rep,name=subdomains,proto3" json:"subdomains,omitempty"` + Subnet string `protobuf:"bytes,18,opt,name=subnet,proto3" json:"subnet,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Whois) Reset() { + *x = Whois{} + mi := &file_api_entity_proto_msgTypes[114] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Whois) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Whois) ProtoMessage() {} + +func (x *Whois) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[114] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Whois.ProtoReflect.Descriptor instead. +func (*Whois) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{114} +} + +func (x *Whois) GetAutonomousSystem() *AutonomousSystem { + if x != nil { + return x.AutonomousSystem + } + return nil +} + +func (x *Whois) GetCreatedTime() int64 { + if x != nil { + return x.CreatedTime + } + return 0 +} + +func (x *Whois) GetCreatedTimeDt() string { + if x != nil { + return x.CreatedTimeDt + } + return "" +} + +func (x *Whois) GetDnssecStatus() string { + if x != nil { + return x.DnssecStatus + } + return "" +} + +func (x *Whois) GetDnssecStatusId() Whois_DnssecStatusId { + if x != nil { + return x.DnssecStatusId + } + return Whois_DNSSEC_STATUS_ID_UNKNOWN +} + +func (x *Whois) GetDomain() string { + if x != nil { + return x.Domain + } + return "" +} + +func (x *Whois) GetDomainContacts() []*DomainContact { + if x != nil { + return x.DomainContacts + } + return nil +} + +func (x *Whois) GetEmailAddr() string { + if x != nil { + return x.EmailAddr + } + return "" +} + +func (x *Whois) GetIsp() string { + if x != nil { + return x.Isp + } + return "" +} + +func (x *Whois) GetIspOrg() string { + if x != nil { + return x.IspOrg + } + return "" +} + +func (x *Whois) GetLastSeenTime() int64 { + if x != nil { + return x.LastSeenTime + } + return 0 +} + +func (x *Whois) GetLastSeenTimeDt() string { + if x != nil { + return x.LastSeenTimeDt + } + return "" +} + +func (x *Whois) GetNameServers() []string { + if x != nil { + return x.NameServers + } + return nil +} + +func (x *Whois) GetPhoneNumber() string { + if x != nil { + return x.PhoneNumber + } + return "" +} + +func (x *Whois) GetRegistrar() string { + if x != nil { + return x.Registrar + } + return "" +} + +func (x *Whois) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *Whois) GetSubdomains() []string { + if x != nil { + return x.Subdomains + } + return nil +} + +func (x *Whois) GetSubnet() string { + if x != nil { + return x.Subnet + } + return "" +} + +type WinService struct { + state protoimpl.MessageState `protogen:"open.v1"` + CmdLine string `protobuf:"bytes,1,opt,name=cmd_line,json=cmdLine,proto3" json:"cmd_line,omitempty"` + HostingProcess *ProcessEntity `protobuf:"bytes,2,opt,name=hosting_process,json=hostingProcess,proto3" json:"hosting_process,omitempty"` + Labels []string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty"` + LoadOrderGroup string `protobuf:"bytes,4,opt,name=load_order_group,json=loadOrderGroup,proto3" json:"load_order_group,omitempty"` + Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"` + ServiceCategory string `protobuf:"bytes,6,opt,name=service_category,json=serviceCategory,proto3" json:"service_category,omitempty"` + ServiceCategoryId WinService_ServiceCategoryId `protobuf:"varint,7,opt,name=service_category_id,json=serviceCategoryId,proto3,enum=ocsf.v1.WinService_ServiceCategoryId" json:"service_category_id,omitempty"` + ServiceDependencies []string `protobuf:"bytes,8,rep,name=service_dependencies,json=serviceDependencies,proto3" json:"service_dependencies,omitempty"` + ServiceDllFile *File `protobuf:"bytes,9,opt,name=service_dll_file,json=serviceDllFile,proto3" json:"service_dll_file,omitempty"` + ServiceErrorControl string `protobuf:"bytes,10,opt,name=service_error_control,json=serviceErrorControl,proto3" json:"service_error_control,omitempty"` + ServiceErrorControlId WinService_ServiceErrorControlId `protobuf:"varint,11,opt,name=service_error_control_id,json=serviceErrorControlId,proto3,enum=ocsf.v1.WinService_ServiceErrorControlId" json:"service_error_control_id,omitempty"` + ServiceFile *File `protobuf:"bytes,12,opt,name=service_file,json=serviceFile,proto3" json:"service_file,omitempty"` + ServiceStartName string `protobuf:"bytes,13,opt,name=service_start_name,json=serviceStartName,proto3" json:"service_start_name,omitempty"` + ServiceStartType string `protobuf:"bytes,14,opt,name=service_start_type,json=serviceStartType,proto3" json:"service_start_type,omitempty"` + ServiceStartTypeId WinService_ServiceStartTypeId `protobuf:"varint,15,opt,name=service_start_type_id,json=serviceStartTypeId,proto3,enum=ocsf.v1.WinService_ServiceStartTypeId" json:"service_start_type_id,omitempty"` + ServiceType string `protobuf:"bytes,16,opt,name=service_type,json=serviceType,proto3" json:"service_type,omitempty"` + ServiceTypeId WinService_ServiceTypeId `protobuf:"varint,17,opt,name=service_type_id,json=serviceTypeId,proto3,enum=ocsf.v1.WinService_ServiceTypeId" json:"service_type_id,omitempty"` + Tags []*KeyValueObject `protobuf:"bytes,18,rep,name=tags,proto3" json:"tags,omitempty"` + Uid string `protobuf:"bytes,19,opt,name=uid,proto3" json:"uid,omitempty"` + Version string `protobuf:"bytes,20,opt,name=version,proto3" json:"version,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WinService) Reset() { + *x = WinService{} + mi := &file_api_entity_proto_msgTypes[115] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WinService) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WinService) ProtoMessage() {} + +func (x *WinService) ProtoReflect() protoreflect.Message { + mi := &file_api_entity_proto_msgTypes[115] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WinService.ProtoReflect.Descriptor instead. +func (*WinService) Descriptor() ([]byte, []int) { + return file_api_entity_proto_rawDescGZIP(), []int{115} +} + +func (x *WinService) GetCmdLine() string { + if x != nil { + return x.CmdLine + } + return "" +} + +func (x *WinService) GetHostingProcess() *ProcessEntity { + if x != nil { + return x.HostingProcess + } + return nil +} + +func (x *WinService) GetLabels() []string { + if x != nil { + return x.Labels + } + return nil +} + +func (x *WinService) GetLoadOrderGroup() string { + if x != nil { + return x.LoadOrderGroup + } + return "" +} + +func (x *WinService) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *WinService) GetServiceCategory() string { + if x != nil { + return x.ServiceCategory + } + return "" +} + +func (x *WinService) GetServiceCategoryId() WinService_ServiceCategoryId { + if x != nil { + return x.ServiceCategoryId + } + return WinService_SERVICE_CATEGORY_ID_UNKNOWN +} + +func (x *WinService) GetServiceDependencies() []string { + if x != nil { + return x.ServiceDependencies + } + return nil +} + +func (x *WinService) GetServiceDllFile() *File { + if x != nil { + return x.ServiceDllFile + } + return nil +} + +func (x *WinService) GetServiceErrorControl() string { + if x != nil { + return x.ServiceErrorControl + } + return "" +} + +func (x *WinService) GetServiceErrorControlId() WinService_ServiceErrorControlId { + if x != nil { + return x.ServiceErrorControlId + } + return WinService_SERVICE_ERROR_CONTROL_ID_UNKNOWN +} + +func (x *WinService) GetServiceFile() *File { + if x != nil { + return x.ServiceFile + } + return nil +} + +func (x *WinService) GetServiceStartName() string { + if x != nil { + return x.ServiceStartName + } + return "" +} + +func (x *WinService) GetServiceStartType() string { + if x != nil { + return x.ServiceStartType + } + return "" +} + +func (x *WinService) GetServiceStartTypeId() WinService_ServiceStartTypeId { + if x != nil { + return x.ServiceStartTypeId + } + return WinService_SERVICE_START_TYPE_ID_UNKNOWN +} + +func (x *WinService) GetServiceType() string { + if x != nil { + return x.ServiceType + } + return "" +} + +func (x *WinService) GetServiceTypeId() WinService_ServiceTypeId { + if x != nil { + return x.ServiceTypeId + } + return WinService_SERVICE_TYPE_ID_UNKNOWN +} + +func (x *WinService) GetTags() []*KeyValueObject { + if x != nil { + return x.Tags + } + return nil +} + +func (x *WinService) GetUid() string { + if x != nil { + return x.Uid + } + return "" +} + +func (x *WinService) GetVersion() string { + if x != nil { + return x.Version + } + return "" +} + +var File_api_entity_proto protoreflect.FileDescriptor + +const file_api_entity_proto_rawDesc = "" + + "\n" + + "\x10api_entity.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\"\xa5'\n" + + "\vApiActivity\x12\x16\n" + + "\x06action\x18\x01 \x01(\tR\x06action\x12:\n" + + "\taction_id\x18\x02 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ActionIdR\bactionId\x12H\n" + + "\vactivity_id\x18\x03 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "activityId\x12#\n" + + "\ractivity_name\x18\x04 \x01(\tR\factivityName\x12,\n" + + "\x05actor\x18\x05 \x01(\v2\x0e.ocsf.v1.ActorB\x06\xbaH\x03\xc8\x01\x01R\x05actor\x12+\n" + + "\bai_model\x18\x06 \x01(\v2\x10.ocsf.v1.AiModelR\aaiModel\x12&\n" + + "\x03api\x18\a \x01(\v2\f.ocsf.v1.ApiB\x06\xbaH\x03\xc8\x01\x01R\x03api\x12)\n" + + "\aattacks\x18\b \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + + "\x0eauthorizations\x18\t \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + + "\rcategory_name\x18\n" + + " \x01(\tR\fcategoryName\x12K\n" + + "\fcategory_uid\x18\v \x01(\x0e2 .ocsf.v1.ApiActivity.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + + "\n" + + "class_name\x18\f \x01(\tR\tclassName\x12B\n" + + "\tclass_uid\x18\r \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + + "\x05cloud\x18\x0e \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x1e\n" + + "\n" + + "confidence\x18\x0f \x01(\tR\n" + + "confidence\x12F\n" + + "\rconfidence_id\x18\x10 \x01(\x0e2!.ocsf.v1.ApiActivity.ConfidenceIdR\fconfidenceId\x12)\n" + + "\x10confidence_score\x18\x11 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + + "\x05count\x18\x12 \x01(\x05R\x05count\x12'\n" + + "\x06device\x18\x13 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + + "\vdisposition\x18\x14 \x01(\tR\vdisposition\x12I\n" + + "\x0edisposition_id\x18\x15 \x01(\x0e2\".ocsf.v1.ApiActivity.DispositionIdR\rdispositionId\x12;\n" + + "\fdst_endpoint\x18\x16 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vdstEndpoint\x12\x1a\n" + + "\bduration\x18\x17 \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x18 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x19 \x01(\tR\tendTimeDt\x125\n" + + "\venrichments\x18\x1a \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x12:\n" + + "\rfirewall_rule\x18\x1b \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + + "\fhttp_request\x18\x1c \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + + "\rhttp_response\x18\x1d \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + + "\bis_alert\x18\x1e \x01(\bR\aisAlert\x12*\n" + + "\amalware\x18\x1f \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + + "\x11malware_scan_info\x18 \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + + "\amessage\x18! \x01(\tR\amessage\x12@\n" + + "\x0fmessage_context\x18\" \x01(\v2\x17.ocsf.v1.MessageContextR\x0emessageContext\x125\n" + + "\bmetadata\x18# \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + + "\vobservables\x18$ \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + + "\x05osint\x18% \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + + "\x06policy\x18& \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + + "\braw_data\x18' \x01(\tR\arawData\x128\n" + + "\rraw_data_hash\x18( \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + + "\rraw_data_size\x18) \x01(\x03R\vrawDataSize\x126\n" + + "\tresources\x18* \x03(\v2\x18.ocsf.v1.ResourceDetailsR\tresources\x12!\n" + + "\frisk_details\x18+ \x01(\tR\vriskDetails\x12\x1d\n" + + "\n" + + "risk_level\x18, \x01(\tR\triskLevel\x12D\n" + + "\rrisk_level_id\x18- \x01(\x0e2 .ocsf.v1.ApiActivity.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18. \x01(\x05R\triskScore\x12\x1a\n" + + "\bseverity\x18/ \x01(\tR\bseverity\x12H\n" + + "\vseverity_id\x180 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "severityId\x12C\n" + + "\fsrc_endpoint\x181 \x01(\v2\x18.ocsf.v1.NetworkEndpointB\x06\xbaH\x03\xc8\x01\x01R\vsrcEndpoint\x12\x1d\n" + + "\n" + + "start_time\x182 \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x183 \x01(\tR\vstartTimeDt\x12\x16\n" + + "\x06status\x184 \x01(\tR\x06status\x12\x1f\n" + + "\vstatus_code\x185 \x01(\tR\n" + + "statusCode\x12#\n" + + "\rstatus_detail\x186 \x01(\tR\fstatusDetail\x12:\n" + + "\tstatus_id\x187 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.StatusIdR\bstatusId\x12\x1a\n" + + "\x04time\x188 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + + "\atime_dt\x189 \x01(\tR\x06timeDt\x12'\n" + + "\x0ftimezone_offset\x18: \x01(\x05R\x0etimezoneOffset\x12$\n" + + "\x05trace\x18; \x01(\v2\x0e.ocsf.v1.TraceR\x05trace\x12\x1b\n" + + "\ttype_name\x18< \x01(\tR\btypeName\x12?\n" + + "\btype_uid\x18= \x01(\x0e2\x1c.ocsf.v1.ApiActivity.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + + "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + + "\bActionId\x12\x15\n" + + "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + + "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + + "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + + "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + + "\x0fACTION_ID_OTHER\x10c\"\x9a\x01\n" + + "\n" + + "ActivityId\x12\x17\n" + + "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + + "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + + "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + + "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x15\n" + + "\x11ACTIVITY_ID_OTHER\x10c\"N\n" + + "\vCategoryUid\x12\x18\n" + + "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12%\n" + + "!CATEGORY_UID_APPLICATION_ACTIVITY\x10\x06\">\n" + + "\bClassUid\x12\x15\n" + + "\x11CLASS_UID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x16CLASS_UID_API_ACTIVITY\x10\xf3.\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + + "\rDispositionId\x12\x1a\n" + + "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + + "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + + "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + + "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + + "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + + "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + + "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + + "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + + "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + + "\x19DISPOSITION_ID_EXONERATED\x10\n" + + "\x12\x1c\n" + + "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + + "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + + "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + + "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + + "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + + "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + + "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + + "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + + "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + + "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + + "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + + "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + + "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + + "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + + "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + + "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + + "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + + "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"d\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + + "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c\"\xf5\x01\n" + + "\aTypeUid\x12\x14\n" + + "\x10TYPE_UID_UNKNOWN\x10\x00\x12#\n" + + "\x1dTYPE_UID_API_ACTIVITY_UNKNOWN\x10\xec\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_CREATE\x10\xed\xd1$\x12 \n" + + "\x1aTYPE_UID_API_ACTIVITY_READ\x10\xee\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_UPDATE\x10\xef\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_DELETE\x10\xf0\xd1$\x12!\n" + + "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$\"\x8d,\n" + + "\x10EntityManagement\x12\x1f\n" + + "\vaccess_list\x18\x01 \x03(\tR\n" + + "accessList\x12\x1f\n" + + "\vaccess_mask\x18\x02 \x01(\x05R\n" + + "accessMask\x12\x16\n" + + "\x06action\x18\x03 \x01(\tR\x06action\x12?\n" + + "\taction_id\x18\x04 \x01(\x0e2\".ocsf.v1.EntityManagement.ActionIdR\bactionId\x12M\n" + + "\vactivity_id\x18\x05 \x01(\x0e2$.ocsf.v1.EntityManagement.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "activityId\x12#\n" + + "\ractivity_name\x18\x06 \x01(\tR\factivityName\x12$\n" + + "\x05actor\x18\a \x01(\v2\x0e.ocsf.v1.ActorR\x05actor\x12\x1e\n" + + "\x03api\x18\b \x01(\v2\f.ocsf.v1.ApiR\x03api\x12)\n" + + "\aattacks\x18\t \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + + "\x0eauthorizations\x18\n" + + " \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + + "\rcategory_name\x18\v \x01(\tR\fcategoryName\x12P\n" + + "\fcategory_uid\x18\f \x01(\x0e2%.ocsf.v1.EntityManagement.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + + "\n" + + "class_name\x18\r \x01(\tR\tclassName\x12G\n" + + "\tclass_uid\x18\x0e \x01(\x0e2\".ocsf.v1.EntityManagement.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + + "\x05cloud\x18\x0f \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x18\n" + + "\acomment\x18\x10 \x01(\tR\acomment\x12\x1e\n" + + "\n" + + "confidence\x18\x11 \x01(\tR\n" + + "confidence\x12K\n" + + "\rconfidence_id\x18\x12 \x01(\x0e2&.ocsf.v1.EntityManagement.ConfidenceIdR\fconfidenceId\x12)\n" + + "\x10confidence_score\x18\x13 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + + "\x05count\x18\x14 \x01(\x05R\x05count\x12'\n" + + "\x06device\x18\x15 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + + "\vdisposition\x18\x16 \x01(\tR\vdisposition\x12N\n" + + "\x0edisposition_id\x18\x17 \x01(\x0e2'.ocsf.v1.EntityManagement.DispositionIdR\rdispositionId\x12\x1a\n" + + "\bduration\x18\x18 \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x19 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x1a \x01(\tR\tendTimeDt\x125\n" + + "\venrichments\x18\x1b \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x126\n" + + "\x06entity\x18\x1c \x01(\v2\x16.ocsf.v1.ManagedEntityB\x06\xbaH\x03\xc8\x01\x01R\x06entity\x12;\n" + + "\rentity_result\x18\x1d \x01(\v2\x16.ocsf.v1.ManagedEntityR\fentityResult\x12:\n" + + "\rfirewall_rule\x18\x1e \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + + "\fhttp_request\x18\x1f \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + + "\rhttp_response\x18 \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + + "\bis_alert\x18! \x01(\bR\aisAlert\x12*\n" + + "\amalware\x18\" \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + + "\x11malware_scan_info\x18# \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + + "\amessage\x18$ \x01(\tR\amessage\x125\n" + + "\bmetadata\x18% \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + + "\vobservables\x18& \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + + "\x05osint\x18' \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + + "\x06policy\x18( \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + + "\braw_data\x18) \x01(\tR\arawData\x128\n" + + "\rraw_data_hash\x18* \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + + "\rraw_data_size\x18+ \x01(\x03R\vrawDataSize\x12!\n" + + "\frisk_details\x18, \x01(\tR\vriskDetails\x12\x1d\n" + + "\n" + + "risk_level\x18- \x01(\tR\triskLevel\x12I\n" + + "\rrisk_level_id\x18. \x01(\x0e2%.ocsf.v1.EntityManagement.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18/ \x01(\x05R\triskScore\x12\x1a\n" + + "\bseverity\x180 \x01(\tR\bseverity\x12M\n" + + "\vseverity_id\x181 \x01(\x0e2$.ocsf.v1.EntityManagement.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "severityId\x12;\n" + + "\fsrc_endpoint\x182 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vsrcEndpoint\x12\x1d\n" + + "\n" + + "start_time\x183 \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x184 \x01(\tR\vstartTimeDt\x12\x16\n" + + "\x06status\x185 \x01(\tR\x06status\x12\x1f\n" + + "\vstatus_code\x186 \x01(\tR\n" + + "statusCode\x12#\n" + + "\rstatus_detail\x187 \x01(\tR\fstatusDetail\x12?\n" + + "\tstatus_id\x188 \x01(\x0e2\".ocsf.v1.EntityManagement.StatusIdR\bstatusId\x12\x1a\n" + + "\x04time\x189 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + + "\atime_dt\x18: \x01(\tR\x06timeDt\x12'\n" + + "\x0ftimezone_offset\x18; \x01(\x05R\x0etimezoneOffset\x12\x1b\n" + + "\ttype_name\x18< \x01(\tR\btypeName\x12D\n" + + "\btype_uid\x18= \x01(\x0e2!.ocsf.v1.EntityManagement.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + + "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + + "\bActionId\x12\x15\n" + + "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + + "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + + "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + + "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + + "\x0fACTION_ID_OTHER\x10c\"\xfa\x02\n" + + "\n" + + "ActivityId\x12\x17\n" + + "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + + "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + + "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + + "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x14\n" + + "\x10ACTIVITY_ID_MOVE\x10\x05\x12\x16\n" + + "\x12ACTIVITY_ID_ENROLL\x10\x06\x12\x18\n" + + "\x14ACTIVITY_ID_UNENROLL\x10\a\x12\x16\n" + + "\x12ACTIVITY_ID_ENABLE\x10\b\x12\x17\n" + + "\x13ACTIVITY_ID_DISABLE\x10\t\x12\x18\n" + + "\x14ACTIVITY_ID_ACTIVATE\x10\n" + + "\x12\x1a\n" + + "\x16ACTIVITY_ID_DEACTIVATE\x10\v\x12\x17\n" + + "\x13ACTIVITY_ID_SUSPEND\x10\f\x12\x16\n" + + "\x12ACTIVITY_ID_RESUME\x10\r\x12\x15\n" + + "\x11ACTIVITY_ID_OTHER\x10c\"T\n" + + "\vCategoryUid\x12\x18\n" + + "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12+\n" + + "'CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT\x10\x03\"C\n" + + "\bClassUid\x12\x15\n" + + "\x11CLASS_UID_UNKNOWN\x10\x00\x12 \n" + + "\x1bCLASS_UID_ENTITY_MANAGEMENT\x10\xbc\x17\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + + "\rDispositionId\x12\x1a\n" + + "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + + "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + + "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + + "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + + "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + + "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + + "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + + "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + + "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + + "\x19DISPOSITION_ID_EXONERATED\x10\n" + + "\x12\x1c\n" + + "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + + "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + + "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + + "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + + "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + + "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + + "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + + "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + + "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + + "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + + "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + + "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + + "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + + "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + + "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + + "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + + "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + + "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"d\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + + "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c\"\x8c\x05\n" + + "\aTypeUid\x12\x14\n" + + "\x10TYPE_UID_UNKNOWN\x10\x00\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN\x10\xf0\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_CREATE\x10\xf1\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_READ\x10\xf2\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_UPDATE\x10\xf3\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_DELETE\x10\xf4\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_MOVE\x10\xf5\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENROLL\x10\xf6\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_UNENROLL\x10\xf7\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENABLE\x10\xf8\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_DISABLE\x10\xf9\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE\x10\xfa\xaa\x12\x12+\n" + + "%TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE\x10\xfb\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_SUSPEND\x10\xfc\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_RESUME\x10\xfd\xaa\x12\x12&\n" + + " TYPE_UID_ENTITY_MANAGEMENT_OTHER\x10ӫ\x12\"\xeb\a\n" + + "\aAccount\x12\x1f\n" + + "\vis_disabled\x18\x01 \x01(\bR\n" + + "isDisabled\x12\x1b\n" + + "\tis_locked\x18\x02 \x01(\bR\bisLocked\x12<\n" + + "\x1bis_on_premises_sync_enabled\x18\x03 \x01(\bR\x17isOnPremisesSyncEnabled\x12\x16\n" + + "\x06labels\x18\x04 \x03(\tR\x06labels\x12\x12\n" + + "\x04name\x18\x05 \x01(\tR\x04name\x12+\n" + + "\x04tags\x18\x06 \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x12\n" + + "\x04type\x18\a \x01(\tR\x04type\x120\n" + + "\atype_id\x18\b \x01(\x0e2\x17.ocsf.v1.Account.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\t \x01(\tR\x03uid\"\xcb\x04\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14TYPE_ID_LDAP_ACCOUNT\x10\x01\x12\x1b\n" + + "\x17TYPE_ID_WINDOWS_ACCOUNT\x10\x02\x12\x18\n" + + "\x14TYPE_ID_AWS_IAM_USER\x10\x03\x12\x18\n" + + "\x14TYPE_ID_AWS_IAM_ROLE\x10\x04\x12\x17\n" + + "\x13TYPE_ID_GCP_ACCOUNT\x10\x05\x12\x1c\n" + + "\x18TYPE_ID_AZURE_AD_ACCOUNT\x10\x06\x12\x1a\n" + + "\x16TYPE_ID_MAC_OS_ACCOUNT\x10\a\x12\x19\n" + + "\x15TYPE_ID_APPLE_ACCOUNT\x10\b\x12\x19\n" + + "\x15TYPE_ID_LINUX_ACCOUNT\x10\t\x12\x17\n" + + "\x13TYPE_ID_AWS_ACCOUNT\x10\n" + + "\x12\x17\n" + + "\x13TYPE_ID_GCP_PROJECT\x10\v\x12\x1b\n" + + "\x17TYPE_ID_OCI_COMPARTMENT\x10\f\x12\x1e\n" + + "\x1aTYPE_ID_AZURE_SUBSCRIPTION\x10\r\x12\x1e\n" + + "\x1aTYPE_ID_SALESFORCE_ACCOUNT\x10\x0e\x12\x1c\n" + + "\x18TYPE_ID_GOOGLE_WORKSPACE\x10\x0f\x12\x1f\n" + + "\x1bTYPE_ID_SERVICENOW_INSTANCE\x10\x10\x12\x17\n" + + "\x13TYPE_ID_M365_TENANT\x10\x11\x12\x19\n" + + "\x15TYPE_ID_EMAIL_ACCOUNT\x10\x12\x12#\n" + + "\x1fTYPE_ID_ACTIVEDIRECTORY_ACCOUNT\x10\x13\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:e\xbaHb\x1a`\n" + + "\x14Account.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xa5\x04\n" + + "\x05Actor\x12\x19\n" + + "\bapp_name\x18\x01 \x01(\tR\aappName\x12\x17\n" + + "\aapp_uid\x18\x02 \x01(\tR\x06appUid\x12>\n" + + "\x0eauthorizations\x18\x03 \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12\x1e\n" + + "\x03idp\x18\x04 \x01(\v2\f.ocsf.v1.IdpR\x03idp\x12\x1d\n" + + "\n" + + "invoked_by\x18\x05 \x01(\tR\tinvokedBy\x12*\n" + + "\aprocess\x18\x06 \x01(\v2\x10.ocsf.v1.ProcessR\aprocess\x12*\n" + + "\asession\x18\a \x01(\v2\x10.ocsf.v1.SessionR\asession\x12!\n" + + "\x04user\x18\b \x01(\v2\r.ocsf.v1.UserR\x04user:\xed\x01\xbaH\xe9\x01\x1a\xe6\x01\n" + + "\x12Actor.at_least_one\x12Sat least one of [app_name, app_uid, invoked_by, process, session, user] must be set\x1a{has(this.app_name) || has(this.app_uid) || has(this.invoked_by) || has(this.process) || has(this.session) || has(this.user)\"\xb0\a\n" + + "\bAdvisory\x124\n" + + "\favg_timespan\x18\x01 \x01(\v2\x11.ocsf.v1.TimespanR\vavgTimespan\x12\x1a\n" + + "\bbulletin\x18\x02 \x01(\tR\bbulletin\x12&\n" + + "\x0eclassification\x18\x03 \x01(\tR\x0eclassification\x12!\n" + + "\fcreated_time\x18\x04 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x05 \x01(\tR\rcreatedTimeDt\x12\x12\n" + + "\x04desc\x18\x06 \x01(\tR\x04desc\x12#\n" + + "\rinstall_state\x18\a \x01(\tR\finstallState\x12J\n" + + "\x10install_state_id\x18\b \x01(\x0e2 .ocsf.v1.Advisory.InstallStateIdR\x0einstallStateId\x12#\n" + + "\ris_superseded\x18\t \x01(\bR\fisSuperseded\x12#\n" + + "\rmodified_time\x18\n" + + " \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\v \x01(\tR\x0emodifiedTimeDt\x12\x1b\n" + + "\x02os\x18\f \x01(\v2\v.ocsf.v1.OsR\x02os\x12*\n" + + "\aproduct\x18\r \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12\x1e\n" + + "\n" + + "references\x18\x0e \x03(\tR\n" + + "references\x12/\n" + + "\frelated_cves\x18\x0f \x03(\v2\f.ocsf.v1.CveR\vrelatedCves\x12/\n" + + "\frelated_cwes\x18\x10 \x03(\v2\f.ocsf.v1.CweR\vrelatedCwes\x12\x12\n" + + "\x04size\x18\x11 \x01(\x03R\x04size\x12\x17\n" + + "\asrc_url\x18\x12 \x01(\tR\x06srcUrl\x12\x14\n" + + "\x05title\x18\x13 \x01(\tR\x05title\x12\x18\n" + + "\x03uid\x18\x14 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xbd\x01\n" + + "\x0eInstallStateId\x12\x1c\n" + + "\x18INSTALL_STATE_ID_UNKNOWN\x10\x00\x12\x1e\n" + + "\x1aINSTALL_STATE_ID_INSTALLED\x10\x01\x12\"\n" + + "\x1eINSTALL_STATE_ID_NOT_INSTALLED\x10\x02\x12-\n" + + ")INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT\x10\x03\x12\x1a\n" + + "\x16INSTALL_STATE_ID_OTHER\x10c\"\xb5\x02\n" + + "\fAffectedCode\x12\x1d\n" + + "\n" + + "end_column\x18\x01 \x01(\x05R\tendColumn\x12\x19\n" + + "\bend_line\x18\x02 \x01(\x05R\aendLine\x12)\n" + + "\x04file\x18\x03 \x01(\v2\r.ocsf.v1.FileB\x06\xbaH\x03\xc8\x01\x01R\x04file\x12#\n" + + "\x05owner\x18\x04 \x01(\v2\r.ocsf.v1.UserR\x05owner\x126\n" + + "\vremediation\x18\x05 \x01(\v2\x14.ocsf.v1.RemediationR\vremediation\x12!\n" + + "\x04rule\x18\x06 \x01(\v2\r.ocsf.v1.RuleR\x04rule\x12!\n" + + "\fstart_column\x18\a \x01(\x05R\vstartColumn\x12\x1d\n" + + "\n" + + "start_line\x18\b \x01(\x05R\tstartLine\"\x89\x06\n" + + "\x0fAffectedPackage\x12\"\n" + + "\farchitecture\x18\x01 \x01(\tR\farchitecture\x12\x19\n" + + "\bcpe_name\x18\x02 \x01(\tR\acpeName\x12\x14\n" + + "\x05epoch\x18\x03 \x01(\x05R\x05epoch\x12(\n" + + "\x10fixed_in_version\x18\x04 \x01(\tR\x0efixedInVersion\x12(\n" + + "\x04hash\x18\x05 \x01(\v2\x14.ocsf.v1.FingerprintR\x04hash\x12\x18\n" + + "\alicense\x18\x06 \x01(\tR\alicense\x12\x1f\n" + + "\vlicense_url\x18\a \x01(\tR\n" + + "licenseUrl\x12\x1a\n" + + "\x04name\x18\b \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12'\n" + + "\x0fpackage_manager\x18\t \x01(\tR\x0epackageManager\x12.\n" + + "\x13package_manager_url\x18\n" + + " \x01(\tR\x11packageManagerUrl\x12\x12\n" + + "\x04path\x18\v \x01(\tR\x04path\x12\x12\n" + + "\x04purl\x18\f \x01(\tR\x04purl\x12\x18\n" + + "\arelease\x18\r \x01(\tR\arelease\x126\n" + + "\vremediation\x18\x0e \x01(\v2\x14.ocsf.v1.RemediationR\vremediation\x12\x17\n" + + "\asrc_url\x18\x0f \x01(\tR\x06srcUrl\x12\x12\n" + + "\x04type\x18\x10 \x01(\tR\x04type\x128\n" + + "\atype_id\x18\x11 \x01(\x0e2\x1f.ocsf.v1.AffectedPackage.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x12 \x01(\tR\x03uid\x12\x1f\n" + + "\vvendor_name\x18\x13 \x01(\tR\n" + + "vendorName\x12 \n" + + "\aversion\x18\x14 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion\"g\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x17\n" + + "\x13TYPE_ID_APPLICATION\x10\x01\x12\x1c\n" + + "\x18TYPE_ID_OPERATING_SYSTEM\x10\x02\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xd1\x05\n" + + "\x05Agent\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12+\n" + + "\bpolicies\x18\x02 \x03(\v2\x0f.ocsf.v1.PolicyR\bpolicies\x12\x12\n" + + "\x04type\x18\x03 \x01(\tR\x04type\x12.\n" + + "\atype_id\x18\x04 \x01(\x0e2\x15.ocsf.v1.Agent.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x05 \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x06 \x01(\tR\x06uidAlt\x12\x1f\n" + + "\vvendor_name\x18\a \x01(\tR\n" + + "vendorName\x12\x18\n" + + "\aversion\x18\b \x01(\tR\aversion\"\xf7\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12+\n" + + "'TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE\x10\x01\x12 \n" + + "\x1cTYPE_ID_DATA_LOSS_PREVENTION\x10\x02\x12\x1b\n" + + "\x17TYPE_ID_BACKUP_RECOVERY\x10\x03\x120\n" + + ",TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY\x10\x04\x12$\n" + + " TYPE_ID_VULNERABILITY_MANAGEMENT\x10\x05\x12\x1a\n" + + "\x16TYPE_ID_LOG_FORWARDING\x10\x06\x12$\n" + + " TYPE_ID_MOBILE_DEVICE_MANAGEMENT\x10\a\x12$\n" + + " TYPE_ID_CONFIGURATION_MANAGEMENT\x10\b\x12\x19\n" + + "\x15TYPE_ID_REMOTE_ACCESS\x10\t\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:c\xbaH`\x1a^\n" + + "\x12Agent.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xe1\x01\n" + + "\aAiModel\x12'\n" + + "\vai_provider\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\n" + + "aiProvider\x12\x1a\n" + + "\x04name\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\x04 \x01(\tR\aversion:e\xbaHb\x1a`\n" + + "\x14AiModel.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xb6\a\n" + + "\bAnalytic\x12\x1c\n" + + "\talgorithm\x18\x01 \x01(\tR\talgorithm\x12\x1a\n" + + "\bcategory\x18\x02 \x01(\tR\bcategory\x12\x12\n" + + "\x04desc\x18\x03 \x01(\tR\x04desc\x12\x12\n" + + "\x04name\x18\x04 \x01(\tR\x04name\x12>\n" + + "\x11related_analytics\x18\x05 \x03(\v2\x11.ocsf.v1.AnalyticR\x10relatedAnalytics\x12\x14\n" + + "\x05state\x18\x06 \x01(\tR\x05state\x124\n" + + "\bstate_id\x18\a \x01(\x0e2\x19.ocsf.v1.Analytic.StateIdR\astateId\x12\x12\n" + + "\x04type\x18\b \x01(\tR\x04type\x129\n" + + "\atype_id\x18\t \x01(\x0e2\x18.ocsf.v1.Analytic.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18\n" + + " \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\v \x01(\tR\aversion\"|\n" + + "\aStateId\x12\x14\n" + + "\x10STATE_ID_UNKNOWN\x10\x00\x12\x13\n" + + "\x0fSTATE_ID_ACTIVE\x10\x01\x12\x17\n" + + "\x13STATE_ID_SUPPRESSED\x10\x02\x12\x19\n" + + "\x15STATE_ID_EXPERIMENTAL\x10\x03\x12\x12\n" + + "\x0eSTATE_ID_OTHER\x10c\"\xda\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x10\n" + + "\fTYPE_ID_RULE\x10\x01\x12\x16\n" + + "\x12TYPE_ID_BEHAVIORAL\x10\x02\x12\x17\n" + + "\x13TYPE_ID_STATISTICAL\x10\x03\x12\x1a\n" + + "\x16TYPE_ID_LEARNING_ML_DL\x10\x04\x12\x1a\n" + + "\x16TYPE_ID_FINGERPRINTING\x10\x05\x12\x13\n" + + "\x0fTYPE_ID_TAGGING\x10\x06\x12\x19\n" + + "\x15TYPE_ID_KEYWORD_MATCH\x10\a\x12\x1f\n" + + "\x1bTYPE_ID_REGULAR_EXPRESSIONS\x10\b\x12\x1c\n" + + "\x18TYPE_ID_EXACT_DATA_MATCH\x10\t\x12\x1e\n" + + "\x1aTYPE_ID_PARTIAL_DATA_MATCH\x10\n" + + "\x12\x1e\n" + + "\x1aTYPE_ID_INDEXED_DATA_MATCH\x10\v\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:f\xbaHc\x1aa\n" + + "\x15Analytic.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x98\x02\n" + + "\x03Api\x12$\n" + + "\x05group\x18\x01 \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12$\n" + + "\toperation\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\toperation\x12*\n" + + "\arequest\x18\x03 \x01(\v2\x10.ocsf.v1.RequestR\arequest\x12-\n" + + "\bresponse\x18\x04 \x01(\v2\x11.ocsf.v1.ResponseR\bresponse\x12*\n" + + "\aservice\x18\x05 \x01(\v2\x10.ocsf.v1.ServiceR\aservice\x12$\n" + + "\x05token\x18\x06 \x01(\v2\x0e.ocsf.v1.TokenR\x05token\x12\x18\n" + + "\aversion\x18\a \x01(\tR\aversion\"\xbd\a\n" + + "\vApplication\x12 \n" + + "\vcriticality\x18\x01 \x01(\tR\vcriticality\x12*\n" + + "\x04data\x18\x02 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x12\n" + + "\x04desc\x18\x03 \x01(\tR\x04desc\x12$\n" + + "\x05group\x18\x04 \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12\x1a\n" + + "\bhostname\x18\x05 \x01(\tR\bhostname\x12\x16\n" + + "\x06labels\x18\x06 \x03(\tR\x06labels\x12\x12\n" + + "\x04name\x18\a \x01(\tR\x04name\x12#\n" + + "\x05owner\x18\b \x01(\v2\r.ocsf.v1.UserR\x05owner\x12\x16\n" + + "\x06region\x18\t \x01(\tR\x06region\x12C\n" + + "\x15resource_relationship\x18\n" + + " \x01(\v2\x0e.ocsf.v1.GraphR\x14resourceRelationship\x12\x1d\n" + + "\n" + + "risk_level\x18\v \x01(\tR\triskLevel\x12D\n" + + "\rrisk_level_id\x18\f \x01(\x0e2 .ocsf.v1.Application.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18\r \x01(\x05R\triskScore\x12!\n" + + "\x04sbom\x18\x0e \x01(\v2\r.ocsf.v1.SbomR\x04sbom\x12+\n" + + "\x04tags\x18\x0f \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x12\n" + + "\x04type\x18\x10 \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\x11 \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x12 \x01(\tR\x06uidAlt\x12\x1e\n" + + "\x03url\x18\x13 \x01(\v2\f.ocsf.v1.UrlR\x03url\x12\x18\n" + + "\aversion\x18\x14 \x01(\tR\aversion\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c:i\xbaHf\x1ad\n" + + "\x18Application.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xbc\x03\n" + + "\x06Attack\x123\n" + + "\n" + + "mitigation\x18\x01 \x01(\v2\x13.ocsf.v1.MitigationR\n" + + "mitigation\x12:\n" + + "\rsub_technique\x18\x02 \x01(\v2\x15.ocsf.v1.SubTechniqueR\fsubTechnique\x12'\n" + + "\x06tactic\x18\x03 \x01(\v2\x0f.ocsf.v1.TacticR\x06tactic\x12)\n" + + "\atactics\x18\x04 \x03(\v2\x0f.ocsf.v1.TacticR\atactics\x120\n" + + "\ttechnique\x18\x05 \x01(\v2\x12.ocsf.v1.TechniqueR\ttechnique\x12\x18\n" + + "\aversion\x18\x06 \x01(\tR\aversion:\xa0\x01\xbaH\x9c\x01\x1a\x99\x01\n" + + "\x13Attack.at_least_one\x12>at least one of [sub_technique, tactic, technique] must be set\x1aBhas(this.sub_technique) || has(this.tactic) || has(this.technique)\"\xf4\x05\n" + + "\n" + + "AuthFactor\x12'\n" + + "\x06device\x18\x01 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12\x1d\n" + + "\n" + + "email_addr\x18\x02 \x01(\tR\temailAddr\x12\x1f\n" + + "\vfactor_type\x18\x03 \x01(\tR\n" + + "factorType\x12N\n" + + "\x0efactor_type_id\x18\x04 \x01(\x0e2 .ocsf.v1.AuthFactor.FactorTypeIdB\x06\xbaH\x03\xc8\x01\x01R\ffactorTypeId\x12\x17\n" + + "\ais_hotp\x18\x05 \x01(\bR\x06isHotp\x12\x17\n" + + "\ais_totp\x18\x06 \x01(\bR\x06isTotp\x12!\n" + + "\fphone_number\x18\a \x01(\tR\vphoneNumber\x12\x1a\n" + + "\bprovider\x18\b \x01(\tR\bprovider\x12-\n" + + "\x12security_questions\x18\t \x03(\tR\x11securityQuestions\"\x8c\x03\n" + + "\fFactorTypeId\x12\x1a\n" + + "\x16FACTOR_TYPE_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12FACTOR_TYPE_ID_SMS\x10\x01\x12$\n" + + " FACTOR_TYPE_ID_SECURITY_QUESTION\x10\x02\x12\x1d\n" + + "\x19FACTOR_TYPE_ID_PHONE_CALL\x10\x03\x12\x1c\n" + + "\x18FACTOR_TYPE_ID_BIOMETRIC\x10\x04\x12$\n" + + " FACTOR_TYPE_ID_PUSH_NOTIFICATION\x10\x05\x12!\n" + + "\x1dFACTOR_TYPE_ID_HARDWARE_TOKEN\x10\x06\x12\x16\n" + + "\x12FACTOR_TYPE_ID_OTP\x10\a\x12\x18\n" + + "\x14FACTOR_TYPE_ID_EMAIL\x10\b\x12\x16\n" + + "\x12FACTOR_TYPE_ID_U2F\x10\t\x12\x1b\n" + + "\x17FACTOR_TYPE_ID_WEBAUTHN\x10\n" + + "\x12\x1b\n" + + "\x17FACTOR_TYPE_ID_PASSWORD\x10\v\x12\x18\n" + + "\x14FACTOR_TYPE_ID_OTHER\x10c\"T\n" + + "\rAuthorization\x12\x1a\n" + + "\bdecision\x18\x01 \x01(\tR\bdecision\x12'\n" + + "\x06policy\x18\x02 \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\"\xb4\x01\n" + + "\x10AutonomousSystem\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x16\n" + + "\x06number\x18\x02 \x01(\x05R\x06number:t\xbaHq\x1ao\n" + + "\x1dAutonomousSystem.at_least_one\x12*at least one of [name, number] must be set\x1a\"has(this.name) || has(this.number)\"&\n" + + "\bCampaign\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\"\xc4\x03\n" + + "\vCertificate\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x12'\n" + + "\x0fexpiration_time\x18\x03 \x01(\x03R\x0eexpirationTime\x12,\n" + + "\x12expiration_time_dt\x18\x04 \x01(\tR\x10expirationTimeDt\x128\n" + + "\ffingerprints\x18\x05 \x03(\v2\x14.ocsf.v1.FingerprintR\ffingerprints\x12$\n" + + "\x0eis_self_signed\x18\x06 \x01(\bR\fisSelfSigned\x12\x1e\n" + + "\x06issuer\x18\a \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x06issuer\x12 \n" + + "\x04sans\x18\b \x03(\v2\f.ocsf.v1.SanR\x04sans\x12+\n" + + "\rserial_number\x18\t \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\fserialNumber\x12\x18\n" + + "\asubject\x18\n" + + " \x01(\tR\asubject\x12\x10\n" + + "\x03uid\x18\v \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\f \x01(\tR\aversion\"V\n" + + "\n" + + "CisControl\x12\x12\n" + + "\x04desc\x18\x01 \x01(\tR\x04desc\x12\x1a\n" + + "\x04name\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x18\n" + + "\aversion\x18\x03 \x01(\tR\aversion\"U\n" + + "\x11ClassifierDetails\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x1a\n" + + "\x04type\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04type\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid\"\xf6\x01\n" + + "\x05Cloud\x12*\n" + + "\aaccount\x18\x01 \x01(\v2\x10.ocsf.v1.AccountR\aaccount\x12'\n" + + "\x0fcloud_partition\x18\x02 \x01(\tR\x0ecloudPartition\x12'\n" + + "\x03org\x18\x03 \x01(\v2\x15.ocsf.v1.OrganizationR\x03org\x12\x1f\n" + + "\vproject_uid\x18\x04 \x01(\tR\n" + + "projectUid\x12\"\n" + + "\bprovider\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\bprovider\x12\x16\n" + + "\x06region\x18\x06 \x01(\tR\x06region\x12\x12\n" + + "\x04zone\x18\a \x01(\tR\x04zone\"\xd5\x03\n" + + "\tContainer\x12(\n" + + "\x04hash\x18\x01 \x01(\v2\x14.ocsf.v1.FingerprintR\x04hash\x12$\n" + + "\x05image\x18\x02 \x01(\v2\x0e.ocsf.v1.ImageR\x05image\x12\x16\n" + + "\x06labels\x18\x03 \x03(\tR\x06labels\x12\x12\n" + + "\x04name\x18\x04 \x01(\tR\x04name\x12%\n" + + "\x0enetwork_driver\x18\x05 \x01(\tR\rnetworkDriver\x12\"\n" + + "\forchestrator\x18\x06 \x01(\tR\forchestrator\x12\x19\n" + + "\bpod_uuid\x18\a \x01(\tR\apodUuid\x12\x18\n" + + "\aruntime\x18\b \x01(\tR\aruntime\x12\x12\n" + + "\x04size\x18\t \x01(\x03R\x04size\x12\x10\n" + + "\x03tag\x18\n" + + " \x01(\tR\x03tag\x12+\n" + + "\x04tags\x18\v \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x10\n" + + "\x03uid\x18\f \x01(\tR\x03uid:g\xbaHd\x1ab\n" + + "\x16Container.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x8c\x04\n" + + "\x03Cve\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x12!\n" + + "\x04cvss\x18\x03 \x03(\v2\r.ocsf.v1.CvssR\x04cvss\x12\x1e\n" + + "\x03cwe\x18\x04 \x01(\v2\f.ocsf.v1.CweR\x03cwe\x12\x17\n" + + "\acwe_uid\x18\x05 \x01(\tR\x06cweUid\x12\x17\n" + + "\acwe_url\x18\x06 \x01(\tR\x06cweUrl\x12\x12\n" + + "\x04desc\x18\a \x01(\tR\x04desc\x12!\n" + + "\x04epss\x18\b \x01(\v2\r.ocsf.v1.EpssR\x04epss\x12#\n" + + "\rmodified_time\x18\t \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\n" + + " \x01(\tR\x0emodifiedTimeDt\x12*\n" + + "\aproduct\x18\v \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12\x1e\n" + + "\n" + + "references\x18\f \x03(\tR\n" + + "references\x12/\n" + + "\frelated_cwes\x18\r \x03(\v2\f.ocsf.v1.CweR\vrelatedCwes\x12\x14\n" + + "\x05title\x18\x0e \x01(\tR\x05title\x12\x12\n" + + "\x04type\x18\x0f \x01(\tR\x04type\x12\x18\n" + + "\x03uid\x18\x10 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xb0\x02\n" + + "\x04Cvss\x12%\n" + + "\n" + + "base_score\x18\x01 \x01(\x01B\x06\xbaH\x03\xc8\x01\x01R\tbaseScore\x12\x14\n" + + "\x05depth\x18\x02 \x01(\tR\x05depth\x12)\n" + + "\ametrics\x18\x03 \x03(\v2\x0f.ocsf.v1.MetricR\ametrics\x12#\n" + + "\roverall_score\x18\x04 \x01(\x01R\foverallScore\x12\x1a\n" + + "\bseverity\x18\x05 \x01(\tR\bseverity\x12\x17\n" + + "\asrc_url\x18\x06 \x01(\tR\x06srcUrl\x12#\n" + + "\rvector_string\x18\a \x01(\tR\fvectorString\x12\x1f\n" + + "\vvendor_name\x18\b \x01(\tR\n" + + "vendorName\x12 \n" + + "\aversion\x18\t \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion\"R\n" + + "\x03Cwe\x12\x18\n" + + "\acaption\x18\x01 \x01(\tR\acaption\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x18\n" + + "\x03uid\x18\x03 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xb3\x01\n" + + "\tD3fTactic\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid:g\xbaHd\x1ab\n" + + "\x16D3fTactic.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xb9\x01\n" + + "\fD3fTechnique\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid:j\xbaHg\x1ae\n" + + "\x19D3fTechnique.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x99\x02\n" + + "\x06D3fend\x121\n" + + "\n" + + "d3f_tactic\x18\x01 \x01(\v2\x12.ocsf.v1.D3fTacticR\td3fTactic\x12:\n" + + "\rd3f_technique\x18\x02 \x01(\v2\x15.ocsf.v1.D3fTechniqueR\fd3fTechnique\x12\x18\n" + + "\aversion\x18\x03 \x01(\tR\aversion:\x85\x01\xbaH\x81\x01\x1a\x7f\n" + + "\x13D3fend.at_least_one\x127at least one of [d3f_tactic, d3f_technique] must be set\x1a/has(this.d3f_tactic) || has(this.d3f_technique)\"\xcb\v\n" + + "\x12DataClassification\x12\x1a\n" + + "\bcategory\x18\x01 \x01(\tR\bcategory\x12G\n" + + "\vcategory_id\x18\x02 \x01(\x0e2&.ocsf.v1.DataClassification.CategoryIdR\n" + + "categoryId\x12I\n" + + "\x12classifier_details\x18\x03 \x01(\v2\x1a.ocsf.v1.ClassifierDetailsR\x11classifierDetails\x12(\n" + + "\x0fconfidentiality\x18\x04 \x01(\tR\x0fconfidentiality\x12\\\n" + + "\x12confidentiality_id\x18\x05 \x01(\x0e2-.ocsf.v1.DataClassification.ConfidentialityIdR\x11confidentialityId\x12F\n" + + "\x11discovery_details\x18\x06 \x03(\v2\x19.ocsf.v1.DiscoveryDetailsR\x10discoveryDetails\x12'\n" + + "\x06policy\x18\a \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x12\n" + + "\x04size\x18\b \x01(\x03R\x04size\x12\x17\n" + + "\asrc_url\x18\t \x01(\tR\x06srcUrl\x12\x16\n" + + "\x06status\x18\n" + + " \x01(\tR\x06status\x12%\n" + + "\x0estatus_details\x18\v \x03(\tR\rstatusDetails\x12A\n" + + "\tstatus_id\x18\f \x01(\x0e2$.ocsf.v1.DataClassification.StatusIdR\bstatusId\x12\x14\n" + + "\x05total\x18\r \x01(\x05R\x05total\x12\x10\n" + + "\x03uid\x18\x0e \x01(\tR\x03uid\"\xf1\x01\n" + + "\n" + + "CategoryId\x12\x17\n" + + "\x13CATEGORY_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14CATEGORY_ID_PERSONAL\x10\x01\x12\x1c\n" + + "\x18CATEGORY_ID_GOVERNMENTAL\x10\x02\x12\x19\n" + + "\x15CATEGORY_ID_FINANCIAL\x10\x03\x12\x18\n" + + "\x14CATEGORY_ID_BUSINESS\x10\x04\x12,\n" + + "(CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT\x10\x05\x12\x18\n" + + "\x14CATEGORY_ID_SECURITY\x10\x06\x12\x15\n" + + "\x11CATEGORY_ID_OTHER\x10c\"\xa4\x02\n" + + "\x11ConfidentialityId\x12\x1e\n" + + "\x1aCONFIDENTIALITY_ID_UNKNOWN\x10\x00\x12'\n" + + "#CONFIDENTIALITY_ID_NOT_CONFIDENTIAL\x10\x01\x12#\n" + + "\x1fCONFIDENTIALITY_ID_CONFIDENTIAL\x10\x02\x12\x1d\n" + + "\x19CONFIDENTIALITY_ID_SECRET\x10\x03\x12!\n" + + "\x1dCONFIDENTIALITY_ID_TOP_SECRET\x10\x04\x12\x1e\n" + + "\x1aCONFIDENTIALITY_ID_PRIVATE\x10\x05\x12!\n" + + "\x1dCONFIDENTIALITY_ID_RESTRICTED\x10\x06\x12\x1c\n" + + "\x18CONFIDENTIALITY_ID_OTHER\x10c\"y\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12STATUS_ID_COMPLETE\x10\x01\x12\x15\n" + + "\x11STATUS_ID_PARTIAL\x10\x02\x12\x12\n" + + "\x0eSTATUS_ID_FAIL\x10\x03\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c:\x9e\x01\xbaH\x9a\x01\x1a\x97\x01\n" + + "\x1fDataClassification.at_least_one\x12=at least one of [category_id, confidentiality_id] must be set\x1a5has(this.category_id) || has(this.confidentiality_id)\"\xad\x17\n" + + "\x06Device\x12-\n" + + "\n" + + "agent_list\x18\x01 \x03(\v2\x0e.ocsf.v1.AgentR\tagentList\x12#\n" + + "\rautoscale_uid\x18\x02 \x01(\tR\fautoscaleUid\x12\x1b\n" + + "\tboot_time\x18\x03 \x01(\x03R\bbootTime\x12 \n" + + "\fboot_time_dt\x18\x04 \x01(\tR\n" + + "bootTimeDt\x12\x19\n" + + "\bboot_uid\x18\x05 \x01(\tR\abootUid\x120\n" + + "\tcontainer\x18\x06 \x01(\v2\x12.ocsf.v1.ContainerR\tcontainer\x12!\n" + + "\fcreated_time\x18\a \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\b \x01(\tR\rcreatedTimeDt\x12\x12\n" + + "\x04desc\x18\t \x01(\tR\x04desc\x12\x16\n" + + "\x06domain\x18\n" + + " \x01(\tR\x06domain\x12\x10\n" + + "\x03eid\x18\v \x01(\tR\x03eid\x12&\n" + + "\x0ffirst_seen_time\x18\f \x01(\x03R\rfirstSeenTime\x12+\n" + + "\x12first_seen_time_dt\x18\r \x01(\tR\x0ffirstSeenTimeDt\x12&\n" + + "\x06groups\x18\x0e \x03(\v2\x0e.ocsf.v1.GroupR\x06groups\x12\x1a\n" + + "\bhostname\x18\x0f \x01(\tR\bhostname\x12.\n" + + "\ahw_info\x18\x10 \x01(\v2\x15.ocsf.v1.DeviceHwInfoR\x06hwInfo\x12\x1e\n" + + "\n" + + "hypervisor\x18\x11 \x01(\tR\n" + + "hypervisor\x12\x14\n" + + "\x05iccid\x18\x12 \x01(\tR\x05iccid\x12$\n" + + "\x05image\x18\x13 \x01(\v2\x0e.ocsf.v1.ImageR\x05image\x12\x12\n" + + "\x04imei\x18\x14 \x01(\tR\x04imei\x12\x1b\n" + + "\timei_list\x18\x15 \x03(\tR\bimeiList\x12!\n" + + "\finstance_uid\x18\x16 \x01(\tR\vinstanceUid\x12%\n" + + "\x0einterface_name\x18\x17 \x01(\tR\rinterfaceName\x12#\n" + + "\rinterface_uid\x18\x18 \x01(\tR\finterfaceUid\x12\x0e\n" + + "\x02ip\x18\x19 \x01(\tR\x02ip\x12 \n" + + "\fis_backed_up\x18\x1a \x01(\bR\n" + + "isBackedUp\x12!\n" + + "\fis_compliant\x18\x1b \x01(\bR\visCompliant\x12\x1d\n" + + "\n" + + "is_managed\x18\x1c \x01(\bR\tisManaged\x127\n" + + "\x18is_mobile_account_active\x18\x1d \x01(\bR\x15isMobileAccountActive\x12\x1f\n" + + "\vis_personal\x18\x1e \x01(\bR\n" + + "isPersonal\x12\x1b\n" + + "\tis_shared\x18\x1f \x01(\bR\bisShared\x12#\n" + + "\ris_supervised\x18 \x01(\bR\fisSupervised\x12\x1d\n" + + "\n" + + "is_trusted\x18! \x01(\bR\tisTrusted\x12$\n" + + "\x0elast_seen_time\x18\" \x01(\x03R\flastSeenTime\x12)\n" + + "\x11last_seen_time_dt\x18# \x01(\tR\x0elastSeenTimeDt\x12-\n" + + "\blocation\x18$ \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12\x10\n" + + "\x03mac\x18% \x01(\tR\x03mac\x12\x1d\n" + + "\n" + + "mac_vendor\x18& \x01(\tR\tmacVendor\x12\x12\n" + + "\x04meid\x18' \x01(\tR\x04meid\x12\x14\n" + + "\x05model\x18( \x01(\tR\x05model\x12#\n" + + "\rmodified_time\x18) \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18* \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18+ \x01(\tR\x04name\x12#\n" + + "\rnamespace_pid\x18, \x01(\x05R\fnamespacePid\x12H\n" + + "\x12network_interfaces\x18- \x03(\v2\x19.ocsf.v1.NetworkInterfaceR\x11networkInterfaces\x12'\n" + + "\x03org\x18. \x01(\v2\x15.ocsf.v1.OrganizationR\x03org\x12\x1b\n" + + "\x02os\x18/ \x01(\v2\v.ocsf.v1.OsR\x02os\x12&\n" + + "\x0fos_machine_uuid\x180 \x01(\tR\rosMachineUuid\x12#\n" + + "\x05owner\x181 \x01(\v2\r.ocsf.v1.UserR\x05owner\x12\"\n" + + "\x04pool\x182 \x01(\v2\x0e.ocsf.v1.GroupR\x04pool\x12\x16\n" + + "\x06region\x183 \x01(\tR\x06region\x12\x1d\n" + + "\n" + + "risk_level\x184 \x01(\tR\triskLevel\x12?\n" + + "\rrisk_level_id\x185 \x01(\x0e2\x1b.ocsf.v1.Device.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x186 \x01(\x05R\triskScore\x12\x16\n" + + "\x06subnet\x187 \x01(\tR\x06subnet\x12\x1d\n" + + "\n" + + "subnet_uid\x188 \x01(\tR\tsubnetUid\x12\x12\n" + + "\x04type\x189 \x01(\tR\x04type\x127\n" + + "\atype_id\x18: \x01(\x0e2\x16.ocsf.v1.Device.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x12\n" + + "\x04udid\x18; \x01(\tR\x04udid\x12\x10\n" + + "\x03uid\x18< \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18= \x01(\tR\x06uidAlt\x12\x1f\n" + + "\vvendor_name\x18> \x01(\tR\n" + + "vendorName\x12\x19\n" + + "\bvlan_uid\x18? \x01(\tR\avlanUid\x12\x17\n" + + "\avpc_uid\x18@ \x01(\tR\x06vpcUid\x12\x12\n" + + "\x04zone\x18A \x01(\tR\x04zone\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xdc\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eTYPE_ID_SERVER\x10\x01\x12\x13\n" + + "\x0fTYPE_ID_DESKTOP\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_LAPTOP\x10\x03\x12\x12\n" + + "\x0eTYPE_ID_TABLET\x10\x04\x12\x12\n" + + "\x0eTYPE_ID_MOBILE\x10\x05\x12\x13\n" + + "\x0fTYPE_ID_VIRTUAL\x10\x06\x12\x0f\n" + + "\vTYPE_ID_IOT\x10\a\x12\x13\n" + + "\x0fTYPE_ID_BROWSER\x10\b\x12\x14\n" + + "\x10TYPE_ID_FIREWALL\x10\t\x12\x12\n" + + "\x0eTYPE_ID_SWITCH\x10\n" + + "\x12\x0f\n" + + "\vTYPE_ID_HUB\x10\v\x12\x12\n" + + "\x0eTYPE_ID_ROUTER\x10\f\x12\x0f\n" + + "\vTYPE_ID_IDS\x10\r\x12\x0f\n" + + "\vTYPE_ID_IPS\x10\x0e\x12\x19\n" + + "\x15TYPE_ID_LOAD_BALANCER\x10\x0f\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\x99\x02\xbaH\x95\x02\x1a\x92\x02\n" + + "\x13Device.at_least_one\x12bat least one of [hostname, instance_uid, interface_name, interface_uid, ip, name, uid] must be set\x1a\x96\x01has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.uid)\"\x8d\a\n" + + "\fDeviceHwInfo\x12\x1b\n" + + "\tbios_date\x18\x01 \x01(\tR\bbiosDate\x12+\n" + + "\x11bios_manufacturer\x18\x02 \x01(\tR\x10biosManufacturer\x12\x19\n" + + "\bbios_ver\x18\x03 \x01(\tR\abiosVer\x12\x18\n" + + "\achassis\x18\x04 \x01(\tR\achassis\x12)\n" + + "\x10cpu_architecture\x18\x05 \x01(\tR\x0fcpuArchitecture\x12W\n" + + "\x13cpu_architecture_id\x18\x06 \x01(\x0e2'.ocsf.v1.DeviceHwInfo.CpuArchitectureIdR\x11cpuArchitectureId\x12\x19\n" + + "\bcpu_bits\x18\a \x01(\x05R\acpuBits\x12\x1b\n" + + "\tcpu_cores\x18\b \x01(\x05R\bcpuCores\x12\x1b\n" + + "\tcpu_count\x18\t \x01(\x05R\bcpuCount\x12\x1b\n" + + "\tcpu_speed\x18\n" + + " \x01(\x05R\bcpuSpeed\x12\x19\n" + + "\bcpu_type\x18\v \x01(\tR\acpuType\x129\n" + + "\x0fdesktop_display\x18\f \x01(\v2\x10.ocsf.v1.DisplayR\x0edesktopDisplay\x12\x1b\n" + + "\tgpu_count\x18\r \x01(\x05R\bgpuCount\x124\n" + + "\rgpu_info_list\x18\x0e \x03(\v2\x10.ocsf.v1.GpuInfoR\vgpuInfoList\x12:\n" + + "\rkeyboard_info\x18\x0f \x01(\v2\x15.ocsf.v1.KeyboardInfoR\fkeyboardInfo\x12\x19\n" + + "\bram_size\x18\x10 \x01(\x05R\aramSize\x12#\n" + + "\rserial_number\x18\x11 \x01(\tR\fserialNumber\x12\x12\n" + + "\x04uuid\x18\x12 \x01(\tR\x04uuid\x12\x1f\n" + + "\vvendor_name\x18\x13 \x01(\tR\n" + + "vendorName\"\xad\x01\n" + + "\x11CpuArchitectureId\x12\x1f\n" + + "\x1bCPU_ARCHITECTURE_ID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x17CPU_ARCHITECTURE_ID_X86\x10\x01\x12\x1b\n" + + "\x17CPU_ARCHITECTURE_ID_ARM\x10\x02\x12\x1e\n" + + "\x1aCPU_ARCHITECTURE_ID_RISC_V\x10\x03\x12\x1d\n" + + "\x19CPU_ARCHITECTURE_ID_OTHER\x10c\"\xe6\x06\n" + + "\x10DigitalSignature\x12\x1c\n" + + "\talgorithm\x18\x01 \x01(\tR\talgorithm\x12P\n" + + "\falgorithm_id\x18\x02 \x01(\x0e2%.ocsf.v1.DigitalSignature.AlgorithmIdB\x06\xbaH\x03\xc8\x01\x01R\valgorithmId\x126\n" + + "\vcertificate\x18\x03 \x01(\v2\x14.ocsf.v1.CertificateR\vcertificate\x12!\n" + + "\fcreated_time\x18\x04 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x05 \x01(\tR\rcreatedTimeDt\x12#\n" + + "\rdeveloper_uid\x18\x06 \x01(\tR\fdeveloperUid\x12,\n" + + "\x06digest\x18\a \x01(\v2\x14.ocsf.v1.FingerprintR\x06digest\x12\x14\n" + + "\x05state\x18\b \x01(\tR\x05state\x12<\n" + + "\bstate_id\x18\t \x01(\x0e2!.ocsf.v1.DigitalSignature.StateIdR\astateId\"\xa2\x01\n" + + "\vAlgorithmId\x12\x18\n" + + "\x14ALGORITHM_ID_UNKNOWN\x10\x00\x12\x14\n" + + "\x10ALGORITHM_ID_DSA\x10\x01\x12\x14\n" + + "\x10ALGORITHM_ID_RSA\x10\x02\x12\x16\n" + + "\x12ALGORITHM_ID_ECDSA\x10\x03\x12\x1d\n" + + "\x19ALGORITHM_ID_AUTHENTICODE\x10\x04\x12\x16\n" + + "\x12ALGORITHM_ID_OTHER\x10c\"\x92\x02\n" + + "\aStateId\x12\x14\n" + + "\x10STATE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eSTATE_ID_VALID\x10\x01\x12\x14\n" + + "\x10STATE_ID_EXPIRED\x10\x02\x12\x14\n" + + "\x10STATE_ID_REVOKED\x10\x03\x12\x16\n" + + "\x12STATE_ID_SUSPENDED\x10\x04\x12\x14\n" + + "\x10STATE_ID_PENDING\x10\x05\x12\x16\n" + + "\x12STATE_ID_UNTRUSTED\x10\x06\x12\x17\n" + + "\x13STATE_ID_DISTRUSTED\x10\a\x12\x17\n" + + "\x13STATE_ID_WRONGUSAGE\x10\b\x12\x10\n" + + "\fSTATE_ID_BAD\x10\t\x12\x13\n" + + "\x0fSTATE_ID_BROKEN\x10\n" + + "\x12\x12\n" + + "\x0eSTATE_ID_OTHER\x10c\"\xdb\x01\n" + + "\x10DiscoveryDetails\x12\x14\n" + + "\x05count\x18\x01 \x01(\x05R\x05count\x12I\n" + + "\x12occurrence_details\x18\x02 \x01(\v2\x1a.ocsf.v1.OccurrenceDetailsR\x11occurrenceDetails\x12<\n" + + "\voccurrences\x18\x03 \x03(\v2\x1a.ocsf.v1.OccurrenceDetailsR\voccurrences\x12\x12\n" + + "\x04type\x18\x04 \x01(\tR\x04type\x12\x14\n" + + "\x05value\x18\x05 \x01(\tR\x05value\"\xd0\x01\n" + + "\aDisplay\x12\x1f\n" + + "\vcolor_depth\x18\x01 \x01(\x05R\n" + + "colorDepth\x12'\n" + + "\x0fphysical_height\x18\x02 \x01(\x05R\x0ephysicalHeight\x121\n" + + "\x14physical_orientation\x18\x03 \x01(\x05R\x13physicalOrientation\x12%\n" + + "\x0ephysical_width\x18\x04 \x01(\x05R\rphysicalWidth\x12!\n" + + "\fscale_factor\x18\x05 \x01(\x05R\vscaleFactor\"\xca\x03\n" + + "\tDnsAnswer\x12\x14\n" + + "\x05class\x18\x01 \x01(\tR\x05class\x125\n" + + "\bflag_ids\x18\x02 \x03(\x0e2\x1a.ocsf.v1.DnsAnswer.FlagIdsR\aflagIds\x12\x14\n" + + "\x05flags\x18\x03 \x03(\tR\x05flags\x12\x1d\n" + + "\n" + + "packet_uid\x18\x04 \x01(\x05R\tpacketUid\x12\x1c\n" + + "\x05rdata\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05rdata\x12\x10\n" + + "\x03ttl\x18\x06 \x01(\x05R\x03ttl\x12\x12\n" + + "\x04type\x18\a \x01(\tR\x04type\"\xf6\x01\n" + + "\aFlagIds\x12\x14\n" + + "\x10FLAG_IDS_UNKNOWN\x10\x00\x12!\n" + + "\x1dFLAG_IDS_AUTHORITATIVE_ANSWER\x10\x01\x12\x1f\n" + + "\x1bFLAG_IDS_TRUNCATED_RESPONSE\x10\x02\x12\x1e\n" + + "\x1aFLAG_IDS_RECURSION_DESIRED\x10\x03\x12 \n" + + "\x1cFLAG_IDS_RECURSION_AVAILABLE\x10\x04\x12\x1b\n" + + "\x17FLAG_IDS_AUTHENTIC_DATA\x10\x05\x12\x1e\n" + + "\x1aFLAG_IDS_CHECKING_DISABLED\x10\x06\x12\x12\n" + + "\x0eFLAG_IDS_OTHER\x10c\"\xa0\x03\n" + + "\rDomainContact\x12\x1d\n" + + "\n" + + "email_addr\x18\x01 \x01(\tR\temailAddr\x12-\n" + + "\blocation\x18\x02 \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12!\n" + + "\fphone_number\x18\x04 \x01(\tR\vphoneNumber\x12\x12\n" + + "\x04type\x18\x05 \x01(\tR\x04type\x12>\n" + + "\atype_id\x18\x06 \x01(\x0e2\x1d.ocsf.v1.DomainContact.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18\a \x01(\tR\x03uid\"\xa3\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12TYPE_ID_REGISTRANT\x10\x01\x12\x1a\n" + + "\x16TYPE_ID_ADMINISTRATIVE\x10\x02\x12\x15\n" + + "\x11TYPE_ID_TECHNICAL\x10\x03\x12\x13\n" + + "\x0fTYPE_ID_BILLING\x10\x04\x12\x11\n" + + "\rTYPE_ID_ABUSE\x10\x05\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xb9\x02\n" + + "\x04Edge\x12*\n" + + "\x04data\x18\x01 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x1f\n" + + "\vis_directed\x18\x02 \x01(\bR\n" + + "isDirected\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x1a\n" + + "\brelation\x18\x04 \x01(\tR\brelation\x12\x1e\n" + + "\x06source\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x06source\x12\x1e\n" + + "\x06target\x18\x06 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x06target\x12\x10\n" + + "\x03uid\x18\a \x01(\tR\x03uid:b\xbaH_\x1a]\n" + + "\x11Edge.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xfd\b\n" + + "\x05Email\x12\x0e\n" + + "\x02cc\x18\x01 \x03(\tR\x02cc\x12!\n" + + "\fcc_mailboxes\x18\x02 \x03(\tR\vccMailboxes\x12L\n" + + "\x13data_classification\x18\x03 \x01(\v2\x1b.ocsf.v1.DataClassificationR\x12dataClassification\x12N\n" + + "\x14data_classifications\x18\x04 \x03(\v2\x1b.ocsf.v1.DataClassificationR\x13dataClassifications\x12!\n" + + "\fdelivered_to\x18\x05 \x01(\tR\vdeliveredTo\x12*\n" + + "\x11delivered_to_list\x18\x06 \x03(\tR\x0fdeliveredToList\x12#\n" + + "\x05files\x18\a \x03(\v2\r.ocsf.v1.FileR\x05files\x12\x12\n" + + "\x04from\x18\b \x01(\tR\x04from\x12\x1b\n" + + "\tfrom_list\x18\t \x03(\tR\bfromList\x12!\n" + + "\ffrom_mailbox\x18\n" + + " \x01(\tR\vfromMailbox\x12%\n" + + "\x0efrom_mailboxes\x18\v \x03(\tR\rfromMailboxes\x126\n" + + "\fhttp_headers\x18\f \x03(\v2\x13.ocsf.v1.HttpHeaderR\vhttpHeaders\x12\x17\n" + + "\ais_read\x18\r \x01(\bR\x06isRead\x12\x1f\n" + + "\vmessage_uid\x18\x0e \x01(\tR\n" + + "messageUid\x12\x1d\n" + + "\n" + + "raw_header\x18\x0f \x01(\tR\trawHeader\x12\x19\n" + + "\breply_to\x18\x10 \x01(\tR\areplyTo\x12\"\n" + + "\rreply_to_list\x18\x11 \x03(\tR\vreplyToList\x12,\n" + + "\x12reply_to_mailboxes\x18\x12 \x03(\tR\x10replyToMailboxes\x12\x1f\n" + + "\vreturn_path\x18\x13 \x01(\tR\n" + + "returnPath\x12\x16\n" + + "\x06sender\x18\x14 \x01(\tR\x06sender\x12%\n" + + "\x0esender_mailbox\x18\x15 \x01(\tR\rsenderMailbox\x12\x12\n" + + "\x04size\x18\x16 \x01(\x03R\x04size\x12\x1b\n" + + "\tsmtp_from\x18\x17 \x01(\tR\bsmtpFrom\x12\x17\n" + + "\asmtp_to\x18\x18 \x03(\tR\x06smtpTo\x12\x18\n" + + "\asubject\x18\x19 \x01(\tR\asubject\x12\x0e\n" + + "\x02to\x18\x1a \x03(\tR\x02to\x12!\n" + + "\fto_mailboxes\x18\x1b \x03(\tR\vtoMailboxes\x12\x10\n" + + "\x03uid\x18\x1c \x01(\tR\x03uid\x12 \n" + + "\x04urls\x18\x1d \x03(\v2\f.ocsf.v1.UrlR\x04urls\x12(\n" + + "\x10x_originating_ip\x18\x1e \x03(\tR\x0exOriginatingIp:a\xbaH^\x1a\\\n" + + "\x12Email.at_least_one\x12&at least one of [from, to] must be set\x1a\x1ehas(this.from) || has(this.to)\"\xd9\x01\n" + + "\tEmailAuth\x12\x12\n" + + "\x04dkim\x18\x01 \x01(\tR\x04dkim\x12\x1f\n" + + "\vdkim_domain\x18\x02 \x01(\tR\n" + + "dkimDomain\x12%\n" + + "\x0edkim_signature\x18\x03 \x01(\tR\rdkimSignature\x12\x14\n" + + "\x05dmarc\x18\x04 \x01(\tR\x05dmarc\x12%\n" + + "\x0edmarc_override\x18\x05 \x01(\tR\rdmarcOverride\x12!\n" + + "\fdmarc_policy\x18\x06 \x01(\tR\vdmarcPolicy\x12\x10\n" + + "\x03spf\x18\a \x01(\tR\x03spf\"\x94\x03\n" + + "\x11EncryptionDetails\x12\x1c\n" + + "\talgorithm\x18\x01 \x01(\tR\talgorithm\x12I\n" + + "\falgorithm_id\x18\x02 \x01(\x0e2&.ocsf.v1.EncryptionDetails.AlgorithmIdR\valgorithmId\x12\x1d\n" + + "\n" + + "key_length\x18\x03 \x01(\x05R\tkeyLength\x12\x17\n" + + "\akey_uid\x18\x04 \x01(\tR\x06keyUid\x12\x12\n" + + "\x04type\x18\x05 \x01(\tR\x04type\"\xc9\x01\n" + + "\vAlgorithmId\x12\x18\n" + + "\x14ALGORITHM_ID_UNKNOWN\x10\x00\x12\x14\n" + + "\x10ALGORITHM_ID_DES\x10\x01\x12\x1a\n" + + "\x16ALGORITHM_ID_TRIPLEDES\x10\x02\x12\x14\n" + + "\x10ALGORITHM_ID_AES\x10\x03\x12\x14\n" + + "\x10ALGORITHM_ID_RSA\x10\x04\x12\x14\n" + + "\x10ALGORITHM_ID_ECC\x10\x05\x12\x14\n" + + "\x10ALGORITHM_ID_SM2\x10\x06\x12\x16\n" + + "\x12ALGORITHM_ID_OTHER\x10c\"\xf6\x02\n" + + "\n" + + "Enrichment\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x122\n" + + "\x04data\x18\x03 \x01(\v2\x16.google.protobuf.ValueB\x06\xbaH\x03\xc8\x01\x01R\x04data\x12\x12\n" + + "\x04desc\x18\x04 \x01(\tR\x04desc\x12\x1a\n" + + "\x04name\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x1a\n" + + "\bprovider\x18\x06 \x01(\tR\bprovider\x123\n" + + "\n" + + "reputation\x18\a \x01(\v2\x13.ocsf.v1.ReputationR\n" + + "reputation\x12\x1d\n" + + "\n" + + "short_desc\x18\b \x01(\tR\tshortDesc\x12\x17\n" + + "\asrc_url\x18\t \x01(\tR\x06srcUrl\x12\x12\n" + + "\x04type\x18\n" + + " \x01(\tR\x04type\x12\x1c\n" + + "\x05value\x18\v \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"O\n" + + "\x13EnvironmentVariable\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x1c\n" + + "\x05value\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"\xa9\x01\n" + + "\x04Epss\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x12\x1e\n" + + "\n" + + "percentile\x18\x03 \x01(\x01R\n" + + "percentile\x12\x1c\n" + + "\x05score\x18\x04 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05score\x12\x18\n" + + "\aversion\x18\x05 \x01(\tR\aversion\"\xbc\x01\n" + + "\tExtension\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" + + "\x03uid\x18\x02 \x01(\tR\x03uid\x12 \n" + + "\aversion\x18\x03 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion:g\xbaHd\x1ab\n" + + "\x16Extension.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xb0\x01\n" + + "\aFeature\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" + + "\x03uid\x18\x02 \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\x03 \x01(\tR\aversion:e\xbaHb\x1a`\n" + + "\x14Feature.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xf0\x14\n" + + "\x04File\x12#\n" + + "\raccessed_time\x18\x01 \x01(\x03R\faccessedTime\x12(\n" + + "\x10accessed_time_dt\x18\x02 \x01(\tR\x0eaccessedTimeDt\x12)\n" + + "\baccessor\x18\x03 \x01(\v2\r.ocsf.v1.UserR\baccessor\x12\x1e\n" + + "\n" + + "attributes\x18\x04 \x01(\x05R\n" + + "attributes\x12!\n" + + "\fcompany_name\x18\x05 \x01(\tR\vcompanyName\x12(\n" + + "\x0fconfidentiality\x18\x06 \x01(\tR\x0fconfidentiality\x12N\n" + + "\x12confidentiality_id\x18\a \x01(\x0e2\x1f.ocsf.v1.File.ConfidentialityIdR\x11confidentialityId\x12!\n" + + "\fcreated_time\x18\b \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\t \x01(\tR\rcreatedTimeDt\x12'\n" + + "\acreator\x18\n" + + " \x01(\v2\r.ocsf.v1.UserR\acreator\x12L\n" + + "\x13data_classification\x18\v \x01(\v2\x1b.ocsf.v1.DataClassificationR\x12dataClassification\x12N\n" + + "\x14data_classifications\x18\f \x03(\v2\x1b.ocsf.v1.DataClassificationR\x13dataClassifications\x12\x12\n" + + "\x04desc\x18\r \x01(\tR\x04desc\x12\x1d\n" + + "\n" + + "drive_type\x18\x0e \x01(\tR\tdriveType\x12=\n" + + "\rdrive_type_id\x18\x0f \x01(\x0e2\x19.ocsf.v1.File.DriveTypeIdR\vdriveTypeId\x12I\n" + + "\x12encryption_details\x18\x10 \x01(\v2\x1a.ocsf.v1.EncryptionDetailsR\x11encryptionDetails\x12\x10\n" + + "\x03ext\x18\x11 \x01(\tR\x03ext\x12,\n" + + "\x06hashes\x18\x12 \x03(\v2\x14.ocsf.v1.FingerprintR\x06hashes\x12)\n" + + "\x10imported_symbols\x18\x13 \x03(\tR\x0fimportedSymbols\x12#\n" + + "\rinternal_name\x18\x14 \x01(\tR\finternalName\x12\x1d\n" + + "\n" + + "is_deleted\x18\x15 \x01(\bR\tisDeleted\x12!\n" + + "\fis_encrypted\x18\x16 \x01(\bR\visEncrypted\x12\x1b\n" + + "\tis_public\x18\x17 \x01(\bR\bisPublic\x12\x1f\n" + + "\vis_readonly\x18\x18 \x01(\bR\n" + + "isReadonly\x12\x1b\n" + + "\tis_system\x18\x19 \x01(\bR\bisSystem\x12\x1b\n" + + "\tmime_type\x18\x1a \x01(\tR\bmimeType\x12#\n" + + "\rmodified_time\x18\x1b \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\x1c \x01(\tR\x0emodifiedTimeDt\x12)\n" + + "\bmodifier\x18\x1d \x01(\v2\r.ocsf.v1.UserR\bmodifier\x12\x1a\n" + + "\x04name\x18\x1e \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12#\n" + + "\x05owner\x18\x1f \x01(\v2\r.ocsf.v1.UserR\x05owner\x12#\n" + + "\rparent_folder\x18 \x01(\tR\fparentFolder\x12\x12\n" + + "\x04path\x18! \x01(\tR\x04path\x12*\n" + + "\aproduct\x18\" \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12/\n" + + "\x13security_descriptor\x18# \x01(\tR\x12securityDescriptor\x127\n" + + "\tsignature\x18$ \x01(\v2\x19.ocsf.v1.DigitalSignatureR\tsignature\x129\n" + + "\n" + + "signatures\x18% \x03(\v2\x19.ocsf.v1.DigitalSignatureR\n" + + "signatures\x12\x12\n" + + "\x04size\x18& \x01(\x03R\x04size\x12#\n" + + "\rstorage_class\x18' \x01(\tR\fstorageClass\x12+\n" + + "\x04tags\x18( \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x12\n" + + "\x04type\x18) \x01(\tR\x04type\x125\n" + + "\atype_id\x18* \x01(\x0e2\x14.ocsf.v1.File.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18+ \x01(\tR\x03uid\x12\x10\n" + + "\x03uri\x18, \x01(\tR\x03uri\x12\x1e\n" + + "\x03url\x18- \x01(\v2\f.ocsf.v1.UrlR\x03url\x12\x18\n" + + "\aversion\x18. \x01(\tR\aversion\x12\x16\n" + + "\x06volume\x18/ \x01(\tR\x06volume\x128\n" + + "\vxattributes\x180 \x01(\v2\x16.google.protobuf.ValueR\vxattributes\"\xa4\x02\n" + + "\x11ConfidentialityId\x12\x1e\n" + + "\x1aCONFIDENTIALITY_ID_UNKNOWN\x10\x00\x12'\n" + + "#CONFIDENTIALITY_ID_NOT_CONFIDENTIAL\x10\x01\x12#\n" + + "\x1fCONFIDENTIALITY_ID_CONFIDENTIAL\x10\x02\x12\x1d\n" + + "\x19CONFIDENTIALITY_ID_SECRET\x10\x03\x12!\n" + + "\x1dCONFIDENTIALITY_ID_TOP_SECRET\x10\x04\x12\x1e\n" + + "\x1aCONFIDENTIALITY_ID_PRIVATE\x10\x05\x12!\n" + + "\x1dCONFIDENTIALITY_ID_RESTRICTED\x10\x06\x12\x1c\n" + + "\x18CONFIDENTIALITY_ID_OTHER\x10c\"\xc7\x01\n" + + "\vDriveTypeId\x12\x19\n" + + "\x15DRIVE_TYPE_ID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x17DRIVE_TYPE_ID_REMOVABLE\x10\x01\x12\x17\n" + + "\x13DRIVE_TYPE_ID_FIXED\x10\x02\x12\x18\n" + + "\x14DRIVE_TYPE_ID_REMOTE\x10\x03\x12\x18\n" + + "\x14DRIVE_TYPE_ID_CD_ROM\x10\x04\x12\x1a\n" + + "\x16DRIVE_TYPE_ID_RAM_DISK\x10\x05\x12\x17\n" + + "\x13DRIVE_TYPE_ID_OTHER\x10c\"\x80\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14TYPE_ID_REGULAR_FILE\x10\x01\x12\x12\n" + + "\x0eTYPE_ID_FOLDER\x10\x02\x12\x1c\n" + + "\x18TYPE_ID_CHARACTER_DEVICE\x10\x03\x12\x18\n" + + "\x14TYPE_ID_BLOCK_DEVICE\x10\x04\x12\x18\n" + + "\x14TYPE_ID_LOCAL_SOCKET\x10\x05\x12\x16\n" + + "\x12TYPE_ID_NAMED_PIPE\x10\x06\x12\x19\n" + + "\x15TYPE_ID_SYMBOLIC_LINK\x10\a\x12\x1b\n" + + "\x17TYPE_ID_EXECUTABLE_FILE\x10\b\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xf2\x05\n" + + "\vFingerprint\x12\x1c\n" + + "\talgorithm\x18\x01 \x01(\tR\talgorithm\x12K\n" + + "\falgorithm_id\x18\x02 \x01(\x0e2 .ocsf.v1.Fingerprint.AlgorithmIdB\x06\xbaH\x03\xc8\x01\x01R\valgorithmId\x12\x1c\n" + + "\x05value\x18\x03 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"\xd9\x04\n" + + "\vAlgorithmId\x12\x18\n" + + "\x14ALGORITHM_ID_UNKNOWN\x10\x00\x12\x14\n" + + "\x10ALGORITHM_ID_MD5\x10\x01\x12\x16\n" + + "\x12ALGORITHM_ID_SHA_1\x10\x02\x12\x18\n" + + "\x14ALGORITHM_ID_SHA_256\x10\x03\x12\x18\n" + + "\x14ALGORITHM_ID_SHA_512\x10\x04\x12\x15\n" + + "\x11ALGORITHM_ID_CTPH\x10\x05\x12\x15\n" + + "\x11ALGORITHM_ID_TLSH\x10\x06\x12\x1d\n" + + "\x19ALGORITHM_ID_QUICKXORHASH\x10\a\x12\x18\n" + + "\x14ALGORITHM_ID_SHA_224\x10\b\x12\x18\n" + + "\x14ALGORITHM_ID_SHA_384\x10\t\x12\x1c\n" + + "\x18ALGORITHM_ID_SHA_512_224\x10\n" + + "\x12\x1c\n" + + "\x18ALGORITHM_ID_SHA_512_256\x10\v\x12\x19\n" + + "\x15ALGORITHM_ID_SHA3_224\x10\f\x12\x19\n" + + "\x15ALGORITHM_ID_SHA3_256\x10\r\x12\x19\n" + + "\x15ALGORITHM_ID_SHA3_384\x10\x0e\x12\x19\n" + + "\x15ALGORITHM_ID_SHA3_512\x10\x0f\x12!\n" + + "\x1dALGORITHM_ID_XXHASH_H3_64_BIT\x10\x10\x12\"\n" + + "\x1eALGORITHM_ID_XXHASH_H3_128_BIT\x10\x11\x12\x18\n" + + "\x14ALGORITHM_ID_IMPHASH\x10\x12\x12\x14\n" + + "\x10ALGORITHM_ID_NPF\x10\x13\x12\x16\n" + + "\x12ALGORITHM_ID_HASSH\x10\x14\x12\x16\n" + + "\x12ALGORITHM_ID_OTHER\x10c\"\xc5\x03\n" + + "\fFirewallRule\x12\x1a\n" + + "\bcategory\x18\x01 \x01(\tR\bcategory\x12\x1c\n" + + "\tcondition\x18\x02 \x01(\tR\tcondition\x12\x12\n" + + "\x04desc\x18\x03 \x01(\tR\x04desc\x12\x1a\n" + + "\bduration\x18\x04 \x01(\x03R\bduration\x12#\n" + + "\rmatch_details\x18\x05 \x03(\tR\fmatchDetails\x12%\n" + + "\x0ematch_location\x18\x06 \x01(\tR\rmatchLocation\x12\x12\n" + + "\x04name\x18\a \x01(\tR\x04name\x12\x1d\n" + + "\n" + + "rate_limit\x18\b \x01(\x05R\trateLimit\x12 \n" + + "\vsensitivity\x18\t \x01(\tR\vsensitivity\x12\x12\n" + + "\x04type\x18\n" + + " \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\v \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\f \x01(\tR\aversion:j\xbaHg\x1ae\n" + + "\x19FirewallRule.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x87\x05\n" + + "\aGpuInfo\x12\x19\n" + + "\bbus_type\x18\x01 \x01(\tR\abusType\x12:\n" + + "\vbus_type_id\x18\x02 \x01(\x0e2\x1a.ocsf.v1.GpuInfo.BusTypeIdR\tbusTypeId\x12\x14\n" + + "\x05cores\x18\x03 \x01(\x05R\x05cores\x12\x14\n" + + "\x05model\x18\x04 \x01(\tR\x05model\x12\x1f\n" + + "\vvendor_name\x18\x05 \x01(\tR\n" + + "vendorName\x12\x1b\n" + + "\tvram_mode\x18\x06 \x01(\tR\bvramMode\x12=\n" + + "\fvram_mode_id\x18\a \x01(\x0e2\x1b.ocsf.v1.GpuInfo.VramModeIdR\n" + + "vramModeId\x12\x1b\n" + + "\tvram_size\x18\b \x01(\x05R\bvramSize\"\xe9\x01\n" + + "\tBusTypeId\x12\x17\n" + + "\x13BUS_TYPE_ID_UNKNOWN\x10\x00\x12\x17\n" + + "\x13BUS_TYPE_ID_ONBOARD\x10\x01\x12\x18\n" + + "\x14BUS_TYPE_ID_PCIE_X16\x10\x02\x12\x17\n" + + "\x13BUS_TYPE_ID_PCIE_X8\x10\x03\x12\x1a\n" + + "\x16BUS_TYPE_ID_MXM_TYPE_A\x10\x04\x12\x1a\n" + + "\x16BUS_TYPE_ID_MXM_TYPE_B\x10\x05\x12\x13\n" + + "\x0fBUS_TYPE_ID_M_2\x10\x06\x12\x13\n" + + "\x0fBUS_TYPE_ID_CXL\x10\a\x12\x15\n" + + "\x11BUS_TYPE_ID_OTHER\x10c\"s\n" + + "\n" + + "VramModeId\x12\x18\n" + + "\x14VRAM_MODE_ID_UNKNOWN\x10\x00\x12\x17\n" + + "\x13VRAM_MODE_ID_SHARED\x10\x01\x12\x1a\n" + + "\x16VRAM_MODE_ID_DEDICATED\x10\x02\x12\x16\n" + + "\x12VRAM_MODE_ID_OTHER\x10c\"\xb7\x05\n" + + "\x05Graph\x12\x12\n" + + "\x04desc\x18\x01 \x01(\tR\x04desc\x12#\n" + + "\x05edges\x18\x02 \x03(\v2\r.ocsf.v1.EdgeR\x05edges\x12\x1f\n" + + "\vis_directed\x18\x03 \x01(\bR\n" + + "isDirected\x12\x12\n" + + "\x04name\x18\x04 \x01(\tR\x04name\x12#\n" + + "\x05nodes\x18\x05 \x03(\v2\r.ocsf.v1.NodeR\x05nodes\x12%\n" + + "\x0equery_language\x18\x06 \x01(\tR\rqueryLanguage\x12J\n" + + "\x11query_language_id\x18\a \x01(\x0e2\x1e.ocsf.v1.Graph.QueryLanguageIdR\x0fqueryLanguageId\x12\x12\n" + + "\x04type\x18\b \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\t \x01(\tR\x03uid\"\x9c\x02\n" + + "\x0fQueryLanguageId\x12\x1d\n" + + "\x19QUERY_LANGUAGE_ID_UNKNOWN\x10\x00\x12\x1c\n" + + "\x18QUERY_LANGUAGE_ID_CYPHER\x10\x01\x12\x1d\n" + + "\x19QUERY_LANGUAGE_ID_GRAPHQL\x10\x02\x12\x1d\n" + + "\x19QUERY_LANGUAGE_ID_GREMLIN\x10\x03\x12\x19\n" + + "\x15QUERY_LANGUAGE_ID_GQL\x10\x04\x12\x1c\n" + + "\x18QUERY_LANGUAGE_ID_G_CORE\x10\x05\x12\x1a\n" + + "\x16QUERY_LANGUAGE_ID_PGQL\x10\x06\x12\x1c\n" + + "\x18QUERY_LANGUAGE_ID_SPARQL\x10\a\x12\x1b\n" + + "\x17QUERY_LANGUAGE_ID_OTHER\x10c:c\xbaH`\x1a^\n" + + "\x12Graph.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x8b\x02\n" + + "\x05Group\x12\x12\n" + + "\x04desc\x18\x01 \x01(\tR\x04desc\x12\x16\n" + + "\x06domain\x18\x02 \x01(\tR\x06domain\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x1e\n" + + "\n" + + "privileges\x18\x04 \x03(\tR\n" + + "privileges\x12\x12\n" + + "\x04type\x18\x05 \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\x06 \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\a \x01(\tR\x06uidAlt:c\xbaH`\x1a^\n" + + "\x12Group.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"F\n" + + "\n" + + "HttpHeader\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x1c\n" + + "\x05value\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"\xe2\x02\n" + + "\vHttpRequest\x12\x12\n" + + "\x04args\x18\x01 \x01(\tR\x04args\x12\x1f\n" + + "\vbody_length\x18\x02 \x01(\x05R\n" + + "bodyLength\x126\n" + + "\fhttp_headers\x18\x03 \x03(\v2\x13.ocsf.v1.HttpHeaderR\vhttpHeaders\x12\x1f\n" + + "\vhttp_method\x18\x04 \x01(\tR\n" + + "httpMethod\x12\x16\n" + + "\x06length\x18\x05 \x01(\x05R\x06length\x12\x1a\n" + + "\breferrer\x18\x06 \x01(\tR\breferrer\x12\x10\n" + + "\x03uid\x18\a \x01(\tR\x03uid\x12\x1e\n" + + "\x03url\x18\b \x01(\v2\f.ocsf.v1.UrlR\x03url\x12\x1d\n" + + "\n" + + "user_agent\x18\t \x01(\tR\tuserAgent\x12\x18\n" + + "\aversion\x18\n" + + " \x01(\tR\aversion\x12&\n" + + "\x0fx_forwarded_for\x18\v \x03(\tR\rxForwardedFor\"\x8a\x02\n" + + "\fHttpResponse\x12\x1f\n" + + "\vbody_length\x18\x01 \x01(\x05R\n" + + "bodyLength\x12\x1a\n" + + "\x04code\x18\x02 \x01(\x05B\x06\xbaH\x03\xc8\x01\x01R\x04code\x12!\n" + + "\fcontent_type\x18\x03 \x01(\tR\vcontentType\x126\n" + + "\fhttp_headers\x18\x04 \x03(\v2\x13.ocsf.v1.HttpHeaderR\vhttpHeaders\x12\x18\n" + + "\alatency\x18\x05 \x01(\x05R\alatency\x12\x16\n" + + "\x06length\x18\x06 \x01(\x05R\x06length\x12\x18\n" + + "\amessage\x18\a \x01(\tR\amessage\x12\x16\n" + + "\x06status\x18\b \x01(\tR\x06status\"\xc6\x05\n" + + "\x03Idp\x126\n" + + "\fauth_factors\x18\x01 \x03(\v2\x13.ocsf.v1.AuthFactorR\vauthFactors\x12\x16\n" + + "\x06domain\x18\x02 \x01(\tR\x06domain\x126\n" + + "\vfingerprint\x18\x03 \x01(\v2\x14.ocsf.v1.FingerprintR\vfingerprint\x12\x17\n" + + "\ahas_mfa\x18\x04 \x01(\bR\x06hasMfa\x12\x16\n" + + "\x06issuer\x18\x05 \x01(\tR\x06issuer\x12\x12\n" + + "\x04name\x18\x06 \x01(\tR\x04name\x12#\n" + + "\rprotocol_name\x18\a \x01(\tR\fprotocolName\x12!\n" + + "\x04scim\x18\b \x01(\v2\r.ocsf.v1.ScimR\x04scim\x12\x1e\n" + + "\x03sso\x18\t \x01(\v2\f.ocsf.v1.SsoR\x03sso\x12\x14\n" + + "\x05state\x18\n" + + " \x01(\tR\x05state\x12/\n" + + "\bstate_id\x18\v \x01(\x0e2\x14.ocsf.v1.Idp.StateIdR\astateId\x12\x1d\n" + + "\n" + + "tenant_uid\x18\f \x01(\tR\ttenantUid\x12\x10\n" + + "\x03uid\x18\r \x01(\tR\x03uid\x12\x1d\n" + + "\n" + + "url_string\x18\x0e \x01(\tR\turlString\"\x8f\x01\n" + + "\aStateId\x12\x14\n" + + "\x10STATE_ID_UNKNOWN\x10\x00\x12\x13\n" + + "\x0fSTATE_ID_ACTIVE\x10\x01\x12\x16\n" + + "\x12STATE_ID_SUSPENDED\x10\x02\x12\x17\n" + + "\x13STATE_ID_DEPRECATED\x10\x03\x12\x14\n" + + "\x10STATE_ID_DELETED\x10\x04\x12\x12\n" + + "\x0eSTATE_ID_OTHER\x10c:a\xbaH^\x1a\\\n" + + "\x10Idp.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xa0\x01\n" + + "\x05Image\x12\x16\n" + + "\x06labels\x18\x01 \x03(\tR\x06labels\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x12\x12\n" + + "\x04path\x18\x03 \x01(\tR\x04path\x12\x10\n" + + "\x03tag\x18\x04 \x01(\tR\x03tag\x12+\n" + + "\x04tags\x18\x05 \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x18\n" + + "\x03uid\x18\x06 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xd0\x06\n" + + "\tKbArticle\x124\n" + + "\favg_timespan\x18\x01 \x01(\v2\x11.ocsf.v1.TimespanR\vavgTimespan\x12\x1a\n" + + "\bbulletin\x18\x02 \x01(\tR\bbulletin\x12&\n" + + "\x0eclassification\x18\x03 \x01(\tR\x0eclassification\x12!\n" + + "\fcreated_time\x18\x04 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x05 \x01(\tR\rcreatedTimeDt\x12#\n" + + "\rinstall_state\x18\x06 \x01(\tR\finstallState\x12K\n" + + "\x10install_state_id\x18\a \x01(\x0e2!.ocsf.v1.KbArticle.InstallStateIdR\x0einstallStateId\x12#\n" + + "\ris_superseded\x18\b \x01(\bR\fisSuperseded\x12\x1b\n" + + "\x02os\x18\t \x01(\v2\v.ocsf.v1.OsR\x02os\x12*\n" + + "\aproduct\x18\n" + + " \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12\x1a\n" + + "\bseverity\x18\v \x01(\tR\bseverity\x12\x12\n" + + "\x04size\x18\f \x01(\x03R\x04size\x12\x17\n" + + "\asrc_url\x18\r \x01(\tR\x06srcUrl\x12\x14\n" + + "\x05title\x18\x0e \x01(\tR\x05title\x12\x10\n" + + "\x03uid\x18\x0f \x01(\tR\x03uid\"\xbd\x01\n" + + "\x0eInstallStateId\x12\x1c\n" + + "\x18INSTALL_STATE_ID_UNKNOWN\x10\x00\x12\x1e\n" + + "\x1aINSTALL_STATE_ID_INSTALLED\x10\x01\x12\"\n" + + "\x1eINSTALL_STATE_ID_NOT_INSTALLED\x10\x02\x12-\n" + + ")INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT\x10\x03\x12\x1a\n" + + "\x16INSTALL_STATE_ID_OTHER\x10c:m\xbaHj\x1ah\n" + + "\x16KbArticle.at_least_one\x12*at least one of [src_url, uid] must be set\x1a\"has(this.src_url) || has(this.uid)\"\xd0\x01\n" + + "\x0eKeyValueObject\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value\x12\x16\n" + + "\x06values\x18\x03 \x03(\tR\x06values:t\xbaHq\x1ao\n" + + "\x1bKeyValueObject.at_least_one\x12+at least one of [value, values] must be set\x1a#has(this.value) || has(this.values)\"\xbe\x01\n" + + "\fKeyboardInfo\x12#\n" + + "\rfunction_keys\x18\x01 \x01(\x05R\ffunctionKeys\x12\x10\n" + + "\x03ime\x18\x02 \x01(\tR\x03ime\x12'\n" + + "\x0fkeyboard_layout\x18\x03 \x01(\tR\x0ekeyboardLayout\x12)\n" + + "\x10keyboard_subtype\x18\x04 \x01(\x05R\x0fkeyboardSubtype\x12#\n" + + "\rkeyboard_type\x18\x05 \x01(\tR\fkeyboardType\"\xe8\x02\n" + + "\x0eKillChainPhase\x12\x14\n" + + "\x05phase\x18\x01 \x01(\tR\x05phase\x12B\n" + + "\bphase_id\x18\x02 \x01(\x0e2\x1f.ocsf.v1.KillChainPhase.PhaseIdB\x06\xbaH\x03\xc8\x01\x01R\aphaseId\"\xfb\x01\n" + + "\aPhaseId\x12\x14\n" + + "\x10PHASE_ID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x17PHASE_ID_RECONNAISSANCE\x10\x01\x12\x1a\n" + + "\x16PHASE_ID_WEAPONIZATION\x10\x02\x12\x15\n" + + "\x11PHASE_ID_DELIVERY\x10\x03\x12\x19\n" + + "\x15PHASE_ID_EXPLOITATION\x10\x04\x12\x19\n" + + "\x15PHASE_ID_INSTALLATION\x10\x05\x12\x1c\n" + + "\x18PHASE_ID_COMMAND_CONTROL\x10\x06\x12\"\n" + + "\x1ePHASE_ID_ACTIONS_ON_OBJECTIVES\x10\a\x12\x12\n" + + "\x0ePHASE_ID_OTHER\x10c\"\xe1\a\n" + + "\n" + + "LdapPerson\x12\x1f\n" + + "\vcost_center\x18\x01 \x01(\tR\n" + + "costCenter\x12!\n" + + "\fcreated_time\x18\x02 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x03 \x01(\tR\rcreatedTimeDt\x12!\n" + + "\fdeleted_time\x18\x04 \x01(\x03R\vdeletedTime\x12&\n" + + "\x0fdeleted_time_dt\x18\x05 \x01(\tR\rdeletedTimeDt\x12\x1e\n" + + "\n" + + "department\x18\x06 \x01(\tR\n" + + "department\x12!\n" + + "\fdisplay_name\x18\a \x01(\tR\vdisplayName\x12\x1f\n" + + "\vemail_addrs\x18\b \x03(\tR\n" + + "emailAddrs\x12!\n" + + "\femployee_uid\x18\t \x01(\tR\vemployeeUid\x12\x1d\n" + + "\n" + + "given_name\x18\n" + + " \x01(\tR\tgivenName\x12\x1b\n" + + "\thire_time\x18\v \x01(\x03R\bhireTime\x12 \n" + + "\fhire_time_dt\x18\f \x01(\tR\n" + + "hireTimeDt\x12\x1b\n" + + "\tjob_title\x18\r \x01(\tR\bjobTitle\x12\x16\n" + + "\x06labels\x18\x0e \x03(\tR\x06labels\x12&\n" + + "\x0flast_login_time\x18\x0f \x01(\x03R\rlastLoginTime\x12+\n" + + "\x12last_login_time_dt\x18\x10 \x01(\tR\x0flastLoginTimeDt\x12\x17\n" + + "\aldap_cn\x18\x11 \x01(\tR\x06ldapCn\x12\x17\n" + + "\aldap_dn\x18\x12 \x01(\tR\x06ldapDn\x12\x1d\n" + + "\n" + + "leave_time\x18\x13 \x01(\x03R\tleaveTime\x12\"\n" + + "\rleave_time_dt\x18\x14 \x01(\tR\vleaveTimeDt\x12-\n" + + "\blocation\x18\x15 \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12'\n" + + "\amanager\x18\x16 \x01(\v2\r.ocsf.v1.UserR\amanager\x12#\n" + + "\rmodified_time\x18\x17 \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\x18 \x01(\tR\x0emodifiedTimeDt\x12'\n" + + "\x0foffice_location\x18\x19 \x01(\tR\x0eofficeLocation\x12!\n" + + "\fphone_number\x18\x1a \x01(\tR\vphoneNumber\x12\x18\n" + + "\asurname\x18\x1b \x01(\tR\asurname\x12+\n" + + "\x04tags\x18\x1c \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\"\xfc\x05\n" + + "\bLocation\x12#\n" + + "\raerial_height\x18\x01 \x01(\tR\faerialHeight\x12\x12\n" + + "\x04city\x18\x02 \x01(\tR\x04city\x12\x1c\n" + + "\tcontinent\x18\x03 \x01(\tR\tcontinent\x12 \n" + + "\vcoordinates\x18\x04 \x03(\x01R\vcoordinates\x12\x18\n" + + "\acountry\x18\x05 \x01(\tR\acountry\x12\x12\n" + + "\x04desc\x18\x06 \x01(\tR\x04desc\x12+\n" + + "\x11geodetic_altitude\x18\a \x01(\tR\x10geodeticAltitude\x12<\n" + + "\x1ageodetic_vertical_accuracy\x18\b \x01(\tR\x18geodeticVerticalAccuracy\x12\x18\n" + + "\ageohash\x18\t \x01(\tR\ageohash\x12/\n" + + "\x13horizontal_accuracy\x18\n" + + " \x01(\tR\x12horizontalAccuracy\x12$\n" + + "\x0eis_on_premises\x18\v \x01(\bR\fisOnPremises\x12\x10\n" + + "\x03isp\x18\f \x01(\tR\x03isp\x12\x10\n" + + "\x03lat\x18\r \x01(\x01R\x03lat\x12\x12\n" + + "\x04long\x18\x0e \x01(\x01R\x04long\x12\x1f\n" + + "\vpostal_code\x18\x0f \x01(\tR\n" + + "postalCode\x12+\n" + + "\x11pressure_altitude\x18\x10 \x01(\tR\x10pressureAltitude\x12\x1a\n" + + "\bprovider\x18\x11 \x01(\tR\bprovider\x12\x16\n" + + "\x06region\x18\x12 \x01(\tR\x06region:\xb2\x01\xbaH\xae\x01\x1a\xab\x01\n" + + "\x15Location.at_least_one\x12@at least one of [city, country, postal_code, region] must be set\x1aPhas(this.city) || has(this.country) || has(this.postal_code) || has(this.region)\"\x9f\x05\n" + + "\x06Logger\x12'\n" + + "\x06device\x18\x01 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12\x1b\n" + + "\tevent_uid\x18\x02 \x01(\tR\beventUid\x12!\n" + + "\fis_truncated\x18\x03 \x01(\bR\visTruncated\x12\x1d\n" + + "\n" + + "log_format\x18\x04 \x01(\tR\tlogFormat\x12\x1b\n" + + "\tlog_level\x18\x05 \x01(\tR\blogLevel\x12\x19\n" + + "\blog_name\x18\x06 \x01(\tR\alogName\x12!\n" + + "\flog_provider\x18\a \x01(\tR\vlogProvider\x12\x1f\n" + + "\vlog_version\x18\b \x01(\tR\n" + + "logVersion\x12\x1f\n" + + "\vlogged_time\x18\t \x01(\x03R\n" + + "loggedTime\x12$\n" + + "\x0elogged_time_dt\x18\n" + + " \x01(\tR\floggedTimeDt\x12\x12\n" + + "\x04name\x18\v \x01(\tR\x04name\x12*\n" + + "\aproduct\x18\f \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12#\n" + + "\rtransmit_time\x18\r \x01(\x03R\ftransmitTime\x12(\n" + + "\x10transmit_time_dt\x18\x0e \x01(\tR\x0etransmitTimeDt\x12\x10\n" + + "\x03uid\x18\x0f \x01(\tR\x03uid\x12)\n" + + "\x10untruncated_size\x18\x10 \x01(\x05R\x0funtruncatedSize\x12\x18\n" + + "\aversion\x18\x11 \x01(\tR\aversion:d\xbaHa\x1a_\n" + + "\x13Logger.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"x\n" + + "\n" + + "LongString\x12!\n" + + "\fis_truncated\x18\x01 \x01(\bR\visTruncated\x12)\n" + + "\x10untruncated_size\x18\x02 \x01(\x05R\x0funtruncatedSize\x12\x1c\n" + + "\x05value\x18\x03 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"\xfd\v\n" + + "\aMalware\x12Q\n" + + "\x12classification_ids\x18\x01 \x03(\x0e2\".ocsf.v1.Malware.ClassificationIdsR\x11classificationIds\x12(\n" + + "\x0fclassifications\x18\x02 \x03(\tR\x0fclassifications\x12 \n" + + "\x04cves\x18\x03 \x03(\v2\f.ocsf.v1.CveR\x04cves\x12#\n" + + "\x05files\x18\x04 \x03(\v2\r.ocsf.v1.FileR\x05files\x12\x12\n" + + "\x04name\x18\x05 \x01(\tR\x04name\x12!\n" + + "\fnum_infected\x18\x06 \x01(\x05R\vnumInfected\x12\x12\n" + + "\x04path\x18\a \x01(\tR\x04path\x12\x1a\n" + + "\bprovider\x18\b \x01(\tR\bprovider\x12\x1a\n" + + "\bseverity\x18\t \x01(\tR\bseverity\x12<\n" + + "\vseverity_id\x18\n" + + " \x01(\x0e2\x1b.ocsf.v1.Malware.SeverityIdR\n" + + "severityId\x12\x10\n" + + "\x03uid\x18\v \x01(\tR\x03uid\"\xa1\x06\n" + + "\x11ClassificationIds\x12\x1e\n" + + "\x1aCLASSIFICATION_IDS_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19CLASSIFICATION_IDS_ADWARE\x10\x01\x12\x1f\n" + + "\x1bCLASSIFICATION_IDS_BACKDOOR\x10\x02\x12\x1a\n" + + "\x16CLASSIFICATION_IDS_BOT\x10\x03\x12\x1e\n" + + "\x1aCLASSIFICATION_IDS_BOOTKIT\x10\x04\x12\x1b\n" + + "\x17CLASSIFICATION_IDS_DDOS\x10\x05\x12!\n" + + "\x1dCLASSIFICATION_IDS_DOWNLOADER\x10\x06\x12\x1e\n" + + "\x1aCLASSIFICATION_IDS_DROPPER\x10\a\x12\"\n" + + "\x1eCLASSIFICATION_IDS_EXPLOIT_KIT\x10\b\x12 \n" + + "\x1cCLASSIFICATION_IDS_KEYLOGGER\x10\t\x12!\n" + + "\x1dCLASSIFICATION_IDS_RANSOMWARE\x10\n" + + "\x12+\n" + + "'CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN\x10\v\x12,\n" + + "(CLASSIFICATION_IDS_RESOURCE_EXPLOITATION\x10\r\x12.\n" + + "*CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE\x10\x0e\x12\x1e\n" + + "\x1aCLASSIFICATION_IDS_ROOTKIT\x10\x0f\x12%\n" + + "!CLASSIFICATION_IDS_SCREEN_CAPTURE\x10\x10\x12\x1e\n" + + "\x1aCLASSIFICATION_IDS_SPYWARE\x10\x11\x12\x1d\n" + + "\x19CLASSIFICATION_IDS_TROJAN\x10\x12\x12\x1c\n" + + "\x18CLASSIFICATION_IDS_VIRUS\x10\x13\x12\x1f\n" + + "\x1bCLASSIFICATION_IDS_WEBSHELL\x10\x14\x12\x1c\n" + + "\x18CLASSIFICATION_IDS_WIPER\x10\x15\x12\x1b\n" + + "\x17CLASSIFICATION_IDS_WORM\x10\x16\x12\x1c\n" + + "\x18CLASSIFICATION_IDS_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c:e\xbaHb\x1a`\n" + + "\x14Malware.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x81\x06\n" + + "\x0fMalwareScanInfo\x12\x19\n" + + "\bend_time\x18\x01 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x02 \x01(\tR\tendTimeDt\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x1b\n" + + "\tnum_files\x18\x04 \x01(\x05R\bnumFiles\x12!\n" + + "\fnum_infected\x18\x05 \x01(\x05R\vnumInfected\x12\x1f\n" + + "\vnum_volumes\x18\x06 \x01(\x05R\n" + + "numVolumes\x12\x12\n" + + "\x04size\x18\a \x01(\x03R\x04size\x12\x1d\n" + + "\n" + + "start_time\x18\b \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x18\t \x01(\tR\vstartTimeDt\x12\x12\n" + + "\x04type\x18\n" + + " \x01(\tR\x04type\x12@\n" + + "\atype_id\x18\v \x01(\x0e2\x1f.ocsf.v1.MalwareScanInfo.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18\f \x01(\tR\x03uid\x120\n" + + "\x14unique_malware_count\x18\r \x01(\x05R\x12uniqueMalwareCount\"\xdd\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eTYPE_ID_MANUAL\x10\x01\x12\x15\n" + + "\x11TYPE_ID_SCHEDULED\x10\x02\x12\x1b\n" + + "\x17TYPE_ID_UPDATED_CONTENT\x10\x03\x12\x1d\n" + + "\x19TYPE_ID_QUARANTINED_ITEMS\x10\x04\x12\x1a\n" + + "\x16TYPE_ID_ATTACHED_MEDIA\x10\x05\x12\x16\n" + + "\x12TYPE_ID_USER_LOGON\x10\x06\x12\x10\n" + + "\fTYPE_ID_ELAM\x10\a\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:m\xbaHj\x1ah\n" + + "\x1cMalwareScanInfo.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x97\a\n" + + "\rManagedEntity\x12*\n" + + "\x04data\x18\x01 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12'\n" + + "\x06device\x18\x02 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12$\n" + + "\x05email\x18\x03 \x01(\v2\x0e.ocsf.v1.EmailR\x05email\x12$\n" + + "\x05group\x18\x04 \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12-\n" + + "\blocation\x18\x05 \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12\x12\n" + + "\x04name\x18\x06 \x01(\tR\x04name\x12'\n" + + "\x03org\x18\a \x01(\v2\x15.ocsf.v1.OrganizationR\x03org\x12'\n" + + "\x06policy\x18\b \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x12\n" + + "\x04type\x18\t \x01(\tR\x04type\x126\n" + + "\atype_id\x18\n" + + " \x01(\x0e2\x1d.ocsf.v1.ManagedEntity.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\v \x01(\tR\x03uid\x12!\n" + + "\x04user\x18\f \x01(\v2\r.ocsf.v1.UserR\x04user\x12\x18\n" + + "\aversion\x18\r \x01(\tR\aversion\"\xc4\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eTYPE_ID_DEVICE\x10\x01\x12\x10\n" + + "\fTYPE_ID_USER\x10\x02\x12\x11\n" + + "\rTYPE_ID_GROUP\x10\x03\x12\x18\n" + + "\x14TYPE_ID_ORGANIZATION\x10\x04\x12\x12\n" + + "\x0eTYPE_ID_POLICY\x10\x05\x12\x11\n" + + "\rTYPE_ID_EMAIL\x10\x06\x12\x18\n" + + "\x14TYPE_ID_NETWORK_ZONE\x10\a\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\xed\x01\xbaH\xe9\x01\x1a\xe6\x01\n" + + "\x1aManagedEntity.at_least_one\x12Iat least one of [device, group, name, org, policy, uid, user] must be set\x1a}has(this.device) || has(this.group) || has(this.name) || has(this.org) || has(this.policy) || has(this.uid) || has(this.user)\"\xb9\x05\n" + + "\x0eMessageContext\x12\x17\n" + + "\aai_role\x18\x01 \x01(\tR\x06aiRole\x12>\n" + + "\n" + + "ai_role_id\x18\x02 \x01(\x0e2 .ocsf.v1.MessageContext.AiRoleIdR\baiRoleId\x126\n" + + "\vapplication\x18\x03 \x01(\v2\x14.ocsf.v1.ApplicationR\vapplication\x12+\n" + + "\x11completion_tokens\x18\x04 \x01(\x05R\x10completionTokens\x12\x12\n" + + "\x04name\x18\x05 \x01(\tR\x04name\x12#\n" + + "\rprompt_tokens\x18\x06 \x01(\x05R\fpromptTokens\x12*\n" + + "\aservice\x18\a \x01(\v2\x10.ocsf.v1.ServiceR\aservice\x12!\n" + + "\ftotal_tokens\x18\b \x01(\x05R\vtotalTokens\x12\x10\n" + + "\x03uid\x18\t \x01(\tR\x03uid\"\xc9\x01\n" + + "\bAiRoleId\x12\x16\n" + + "\x12AI_ROLE_ID_UNKNOWN\x10\x00\x12\x13\n" + + "\x0fAI_ROLE_ID_USER\x10\x01\x12\x18\n" + + "\x14AI_ROLE_ID_ASSISTANT\x10\x02\x12\x13\n" + + "\x0fAI_ROLE_ID_TOOL\x10\x03\x12\x14\n" + + "\x10AI_ROLE_ID_AGENT\x10\x04\x12\x1b\n" + + "\x17AI_ROLE_ID_ORCHESTRATOR\x10\x05\x12\x18\n" + + "\x14AI_ROLE_ID_RETRIEVER\x10\x06\x12\x14\n" + + "\x10AI_ROLE_ID_OTHER\x10c:\x82\x01\xbaH\x7f\x1a}\n" + + "\x1bMessageContext.at_least_one\x122at least one of [application, service] must be set\x1a*has(this.application) || has(this.service)\"\xa7\f\n" + + "\bMetadata\x12'\n" + + "\x0fcorrelation_uid\x18\x01 \x01(\tR\x0ecorrelationUid\x12L\n" + + "\x13data_classification\x18\x02 \x01(\v2\x1b.ocsf.v1.DataClassificationR\x12dataClassification\x12N\n" + + "\x14data_classifications\x18\x03 \x03(\v2\x1b.ocsf.v1.DataClassificationR\x13dataClassifications\x12\x14\n" + + "\x05debug\x18\x04 \x03(\tR\x05debug\x12\x1d\n" + + "\n" + + "event_code\x18\x05 \x01(\tR\teventCode\x120\n" + + "\textension\x18\x06 \x01(\v2\x12.ocsf.v1.ExtensionR\textension\x122\n" + + "\n" + + "extensions\x18\a \x03(\v2\x12.ocsf.v1.ExtensionR\n" + + "extensions\x12!\n" + + "\fis_truncated\x18\b \x01(\bR\visTruncated\x12\x16\n" + + "\x06labels\x18\t \x03(\tR\x06labels\x12\x1d\n" + + "\n" + + "log_format\x18\n" + + " \x01(\tR\tlogFormat\x12\x1b\n" + + "\tlog_level\x18\v \x01(\tR\blogLevel\x12\x19\n" + + "\blog_name\x18\f \x01(\tR\alogName\x12!\n" + + "\flog_provider\x18\r \x01(\tR\vlogProvider\x12\x1d\n" + + "\n" + + "log_source\x18\x0e \x01(\tR\tlogSource\x12\x1f\n" + + "\vlog_version\x18\x0f \x01(\tR\n" + + "logVersion\x12\x1f\n" + + "\vlogged_time\x18\x10 \x01(\x03R\n" + + "loggedTime\x12$\n" + + "\x0elogged_time_dt\x18\x11 \x01(\tR\floggedTimeDt\x12)\n" + + "\aloggers\x18\x12 \x03(\v2\x0f.ocsf.v1.LoggerR\aloggers\x12#\n" + + "\rmodified_time\x18\x13 \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\x14 \x01(\tR\x0emodifiedTimeDt\x12,\n" + + "\x12original_event_uid\x18\x15 \x01(\tR\x10originalEventUid\x12#\n" + + "\roriginal_time\x18\x16 \x01(\tR\foriginalTime\x12%\n" + + "\x0eprocessed_time\x18\x17 \x01(\x03R\rprocessedTime\x12*\n" + + "\x11processed_time_dt\x18\x18 \x01(\tR\x0fprocessedTimeDt\x122\n" + + "\aproduct\x18\x19 \x01(\v2\x10.ocsf.v1.ProductB\x06\xbaH\x03\xc8\x01\x01R\aproduct\x12\x1a\n" + + "\bprofiles\x18\x1a \x03(\tR\bprofiles\x12-\n" + + "\breporter\x18\x1b \x01(\v2\x11.ocsf.v1.ReporterR\breporter\x12\x1a\n" + + "\bsequence\x18\x1c \x01(\x05R\bsequence\x12\x16\n" + + "\x06source\x18\x1d \x01(\tR\x06source\x12+\n" + + "\x04tags\x18\x1e \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x1d\n" + + "\n" + + "tenant_uid\x18\x1f \x01(\tR\ttenantUid\x12E\n" + + "\x15total_queued_duration\x18 \x01(\v2\x11.ocsf.v1.TimespanR\x13totalQueuedDuration\x12U\n" + + "\x18transformation_info_list\x18! \x03(\v2\x1b.ocsf.v1.TransformationInfoR\x16transformationInfoList\x12#\n" + + "\rtransmit_time\x18\" \x01(\x03R\ftransmitTime\x12(\n" + + "\x10transmit_time_dt\x18# \x01(\tR\x0etransmitTimeDt\x12\x12\n" + + "\x04type\x18$ \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18% \x01(\tR\x03uid\x12)\n" + + "\x10untruncated_size\x18& \x01(\x05R\x0funtruncatedSize\x12 \n" + + "\aversion\x18' \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion\"B\n" + + "\x06Metric\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x1c\n" + + "\x05value\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\"\xf0\x01\n" + + "\n" + + "Mitigation\x129\n" + + "\x0fcountermeasures\x18\x01 \x03(\v2\x0f.ocsf.v1.D3fendR\x0fcountermeasures\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x03 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x04 \x01(\tR\x03uid:h\xbaHe\x1ac\n" + + "\x17Mitigation.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xa3\x10\n" + + "\x0fNetworkEndpoint\x12-\n" + + "\n" + + "agent_list\x18\x01 \x03(\v2\x0e.ocsf.v1.AgentR\tagentList\x12F\n" + + "\x11autonomous_system\x18\x02 \x01(\v2\x19.ocsf.v1.AutonomousSystemR\x10autonomousSystem\x120\n" + + "\tcontainer\x18\x03 \x01(\v2\x12.ocsf.v1.ContainerR\tcontainer\x12\x16\n" + + "\x06domain\x18\x04 \x01(\tR\x06domain\x128\n" + + "\ffingerprints\x18\x05 \x03(\v2\x14.ocsf.v1.FingerprintR\ffingerprints\x12\x1a\n" + + "\bhostname\x18\x06 \x01(\tR\bhostname\x12.\n" + + "\ahw_info\x18\a \x01(\v2\x15.ocsf.v1.DeviceHwInfoR\x06hwInfo\x12!\n" + + "\finstance_uid\x18\b \x01(\tR\vinstanceUid\x12%\n" + + "\x0einterface_name\x18\t \x01(\tR\rinterfaceName\x12#\n" + + "\rinterface_uid\x18\n" + + " \x01(\tR\finterfaceUid\x12)\n" + + "\x10intermediate_ips\x18\v \x03(\tR\x0fintermediateIps\x12\x0e\n" + + "\x02ip\x18\f \x01(\tR\x02ip\x12\x10\n" + + "\x03isp\x18\r \x01(\tR\x03isp\x12\x17\n" + + "\aisp_org\x18\x0e \x01(\tR\x06ispOrg\x12-\n" + + "\blocation\x18\x0f \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12\x10\n" + + "\x03mac\x18\x10 \x01(\tR\x03mac\x12\x1d\n" + + "\n" + + "mac_vendor\x18\x11 \x01(\tR\tmacVendor\x12\x12\n" + + "\x04name\x18\x12 \x01(\tR\x04name\x12#\n" + + "\rnamespace_pid\x18\x13 \x01(\x05R\fnamespacePid\x12#\n" + + "\rnetwork_scope\x18\x14 \x01(\tR\fnetworkScope\x12Q\n" + + "\x10network_scope_id\x18\x15 \x01(\x0e2'.ocsf.v1.NetworkEndpoint.NetworkScopeIdR\x0enetworkScopeId\x12\x1b\n" + + "\x02os\x18\x16 \x01(\v2\v.ocsf.v1.OsR\x02os\x12#\n" + + "\x05owner\x18\x17 \x01(\v2\r.ocsf.v1.UserR\x05owner\x12\"\n" + + "\x04pool\x18\x18 \x01(\v2\x0e.ocsf.v1.GroupR\x04pool\x12\x12\n" + + "\x04port\x18\x19 \x01(\x05R\x04port\x12<\n" + + "\x0eproxy_endpoint\x18\x1a \x01(\v2\x15.ocsf.v1.NetworkProxyR\rproxyEndpoint\x12\x1d\n" + + "\n" + + "subnet_uid\x18\x1b \x01(\tR\tsubnetUid\x12\x19\n" + + "\bsvc_name\x18\x1c \x01(\tR\asvcName\x12\x12\n" + + "\x04type\x18\x1d \x01(\tR\x04type\x128\n" + + "\atype_id\x18\x1e \x01(\x0e2\x1f.ocsf.v1.NetworkEndpoint.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x1f \x01(\tR\x03uid\x12\x19\n" + + "\bvlan_uid\x18 \x01(\tR\avlanUid\x12\x17\n" + + "\avpc_uid\x18! \x01(\tR\x06vpcUid\x12\x12\n" + + "\x04zone\x18\" \x01(\tR\x04zone\"\x88\x01\n" + + "\x0eNetworkScopeId\x12\x1c\n" + + "\x18NETWORK_SCOPE_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19NETWORK_SCOPE_ID_INTERNAL\x10\x01\x12\x1d\n" + + "\x19NETWORK_SCOPE_ID_EXTERNAL\x10\x02\x12\x1a\n" + + "\x16NETWORK_SCOPE_ID_OTHER\x10c\"\xdc\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eTYPE_ID_SERVER\x10\x01\x12\x13\n" + + "\x0fTYPE_ID_DESKTOP\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_LAPTOP\x10\x03\x12\x12\n" + + "\x0eTYPE_ID_TABLET\x10\x04\x12\x12\n" + + "\x0eTYPE_ID_MOBILE\x10\x05\x12\x13\n" + + "\x0fTYPE_ID_VIRTUAL\x10\x06\x12\x0f\n" + + "\vTYPE_ID_IOT\x10\a\x12\x13\n" + + "\x0fTYPE_ID_BROWSER\x10\b\x12\x14\n" + + "\x10TYPE_ID_FIREWALL\x10\t\x12\x12\n" + + "\x0eTYPE_ID_SWITCH\x10\n" + + "\x12\x0f\n" + + "\vTYPE_ID_HUB\x10\v\x12\x12\n" + + "\x0eTYPE_ID_ROUTER\x10\f\x12\x0f\n" + + "\vTYPE_ID_IDS\x10\r\x12\x0f\n" + + "\vTYPE_ID_IPS\x10\x0e\x12\x19\n" + + "\x15TYPE_ID_LOAD_BALANCER\x10\x0f\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\xde\x02\xbaH\xda\x02\x1a\xd7\x02\n" + + "\x1cNetworkEndpoint.at_least_one\x12tat least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set\x1a\xc0\x01has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)\"\xfb\x04\n" + + "\x10NetworkInterface\x12\x1a\n" + + "\bhostname\x18\x01 \x01(\tR\bhostname\x12\x0e\n" + + "\x02ip\x18\x02 \x01(\tR\x02ip\x12\x10\n" + + "\x03mac\x18\x03 \x01(\tR\x03mac\x12\x12\n" + + "\x04name\x18\x04 \x01(\tR\x04name\x12\x1c\n" + + "\tnamespace\x18\x05 \x01(\tR\tnamespace\x120\n" + + "\n" + + "open_ports\x18\x06 \x03(\v2\x11.ocsf.v1.PortInfoR\topenPorts\x12#\n" + + "\rsubnet_prefix\x18\a \x01(\x05R\fsubnetPrefix\x12\x12\n" + + "\x04type\x18\b \x01(\tR\x04type\x129\n" + + "\atype_id\x18\t \x01(\x0e2 .ocsf.v1.NetworkInterface.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\n" + + " \x01(\tR\x03uid\"\x81\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x11\n" + + "\rTYPE_ID_WIRED\x10\x01\x12\x14\n" + + "\x10TYPE_ID_WIRELESS\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_MOBILE\x10\x03\x12\x12\n" + + "\x0eTYPE_ID_TUNNEL\x10\x04\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\xba\x01\xbaH\xb6\x01\x1a\xb3\x01\n" + + "\x1dNetworkInterface.at_least_one\x12:at least one of [hostname, ip, mac, name, uid] must be set\x1aVhas(this.hostname) || has(this.ip) || has(this.mac) || has(this.name) || has(this.uid)\"\x97\x10\n" + + "\fNetworkProxy\x12-\n" + + "\n" + + "agent_list\x18\x01 \x03(\v2\x0e.ocsf.v1.AgentR\tagentList\x12F\n" + + "\x11autonomous_system\x18\x02 \x01(\v2\x19.ocsf.v1.AutonomousSystemR\x10autonomousSystem\x120\n" + + "\tcontainer\x18\x03 \x01(\v2\x12.ocsf.v1.ContainerR\tcontainer\x12\x16\n" + + "\x06domain\x18\x04 \x01(\tR\x06domain\x128\n" + + "\ffingerprints\x18\x05 \x03(\v2\x14.ocsf.v1.FingerprintR\ffingerprints\x12\x1a\n" + + "\bhostname\x18\x06 \x01(\tR\bhostname\x12.\n" + + "\ahw_info\x18\a \x01(\v2\x15.ocsf.v1.DeviceHwInfoR\x06hwInfo\x12!\n" + + "\finstance_uid\x18\b \x01(\tR\vinstanceUid\x12%\n" + + "\x0einterface_name\x18\t \x01(\tR\rinterfaceName\x12#\n" + + "\rinterface_uid\x18\n" + + " \x01(\tR\finterfaceUid\x12)\n" + + "\x10intermediate_ips\x18\v \x03(\tR\x0fintermediateIps\x12\x0e\n" + + "\x02ip\x18\f \x01(\tR\x02ip\x12\x10\n" + + "\x03isp\x18\r \x01(\tR\x03isp\x12\x17\n" + + "\aisp_org\x18\x0e \x01(\tR\x06ispOrg\x12-\n" + + "\blocation\x18\x0f \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12\x10\n" + + "\x03mac\x18\x10 \x01(\tR\x03mac\x12\x1d\n" + + "\n" + + "mac_vendor\x18\x11 \x01(\tR\tmacVendor\x12\x12\n" + + "\x04name\x18\x12 \x01(\tR\x04name\x12#\n" + + "\rnamespace_pid\x18\x13 \x01(\x05R\fnamespacePid\x12#\n" + + "\rnetwork_scope\x18\x14 \x01(\tR\fnetworkScope\x12N\n" + + "\x10network_scope_id\x18\x15 \x01(\x0e2$.ocsf.v1.NetworkProxy.NetworkScopeIdR\x0enetworkScopeId\x12\x1b\n" + + "\x02os\x18\x16 \x01(\v2\v.ocsf.v1.OsR\x02os\x12#\n" + + "\x05owner\x18\x17 \x01(\v2\r.ocsf.v1.UserR\x05owner\x12\"\n" + + "\x04pool\x18\x18 \x01(\v2\x0e.ocsf.v1.GroupR\x04pool\x12\x12\n" + + "\x04port\x18\x19 \x01(\x05R\x04port\x12<\n" + + "\x0eproxy_endpoint\x18\x1a \x01(\v2\x15.ocsf.v1.NetworkProxyR\rproxyEndpoint\x12\x1d\n" + + "\n" + + "subnet_uid\x18\x1b \x01(\tR\tsubnetUid\x12\x19\n" + + "\bsvc_name\x18\x1c \x01(\tR\asvcName\x12\x12\n" + + "\x04type\x18\x1d \x01(\tR\x04type\x125\n" + + "\atype_id\x18\x1e \x01(\x0e2\x1c.ocsf.v1.NetworkProxy.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x1f \x01(\tR\x03uid\x12\x19\n" + + "\bvlan_uid\x18 \x01(\tR\avlanUid\x12\x17\n" + + "\avpc_uid\x18! \x01(\tR\x06vpcUid\x12\x12\n" + + "\x04zone\x18\" \x01(\tR\x04zone\"\x88\x01\n" + + "\x0eNetworkScopeId\x12\x1c\n" + + "\x18NETWORK_SCOPE_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19NETWORK_SCOPE_ID_INTERNAL\x10\x01\x12\x1d\n" + + "\x19NETWORK_SCOPE_ID_EXTERNAL\x10\x02\x12\x1a\n" + + "\x16NETWORK_SCOPE_ID_OTHER\x10c\"\xdc\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eTYPE_ID_SERVER\x10\x01\x12\x13\n" + + "\x0fTYPE_ID_DESKTOP\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_LAPTOP\x10\x03\x12\x12\n" + + "\x0eTYPE_ID_TABLET\x10\x04\x12\x12\n" + + "\x0eTYPE_ID_MOBILE\x10\x05\x12\x13\n" + + "\x0fTYPE_ID_VIRTUAL\x10\x06\x12\x0f\n" + + "\vTYPE_ID_IOT\x10\a\x12\x13\n" + + "\x0fTYPE_ID_BROWSER\x10\b\x12\x14\n" + + "\x10TYPE_ID_FIREWALL\x10\t\x12\x12\n" + + "\x0eTYPE_ID_SWITCH\x10\n" + + "\x12\x0f\n" + + "\vTYPE_ID_HUB\x10\v\x12\x12\n" + + "\x0eTYPE_ID_ROUTER\x10\f\x12\x0f\n" + + "\vTYPE_ID_IDS\x10\r\x12\x0f\n" + + "\vTYPE_ID_IPS\x10\x0e\x12\x19\n" + + "\x15TYPE_ID_LOAD_BALANCER\x10\x0f\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\xdb\x02\xbaH\xd7\x02\x1a\xd4\x02\n" + + "\x19NetworkProxy.at_least_one\x12tat least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set\x1a\xc0\x01has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)\"\x88\x01\n" + + "\x04Node\x12*\n" + + "\x04data\x18\x01 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x12\n" + + "\x04desc\x18\x02 \x01(\tR\x04desc\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x12\n" + + "\x04type\x18\x04 \x01(\tR\x04type\x12\x18\n" + + "\x03uid\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xc2\f\n" + + "\n" + + "Observable\x12\x1b\n" + + "\tevent_uid\x18\x01 \x01(\tR\beventUid\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x123\n" + + "\n" + + "reputation\x18\x03 \x01(\v2\x13.ocsf.v1.ReputationR\n" + + "reputation\x12\x12\n" + + "\x04type\x18\x04 \x01(\tR\x04type\x12;\n" + + "\atype_id\x18\x05 \x01(\x0e2\x1a.ocsf.v1.Observable.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x19\n" + + "\btype_uid\x18\x06 \x01(\x03R\atypeUid\x12\x14\n" + + "\x05value\x18\a \x01(\tR\x05value\"\xcb\n" + + "\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x14\n" + + "\x10TYPE_ID_HOSTNAME\x10\x01\x12\x16\n" + + "\x12TYPE_ID_IP_ADDRESS\x10\x02\x12\x17\n" + + "\x13TYPE_ID_MAC_ADDRESS\x10\x03\x12\x15\n" + + "\x11TYPE_ID_USER_NAME\x10\x04\x12\x19\n" + + "\x15TYPE_ID_EMAIL_ADDRESS\x10\x05\x12\x16\n" + + "\x12TYPE_ID_URL_STRING\x10\x06\x12\x15\n" + + "\x11TYPE_ID_FILE_NAME\x10\a\x12\x10\n" + + "\fTYPE_ID_HASH\x10\b\x12\x18\n" + + "\x14TYPE_ID_PROCESS_NAME\x10\t\x12\x18\n" + + "\x14TYPE_ID_RESOURCE_UID\x10\n" + + "\x12\x10\n" + + "\fTYPE_ID_PORT\x10\v\x12\x12\n" + + "\x0eTYPE_ID_SUBNET\x10\f\x12\x18\n" + + "\x14TYPE_ID_COMMAND_LINE\x10\r\x12\x13\n" + + "\x0fTYPE_ID_COUNTRY\x10\x0e\x12\x16\n" + + "\x12TYPE_ID_PROCESS_ID\x10\x0f\x12\x1b\n" + + "\x17TYPE_ID_HTTP_USER_AGENT\x10\x10\x12\x1a\n" + + "\x16TYPE_ID_CWE_OBJECT_UID\x10\x11\x12\x1a\n" + + "\x16TYPE_ID_CVE_OBJECT_UID\x10\x12\x12\x1e\n" + + "\x1aTYPE_ID_USER_CREDENTIAL_ID\x10\x13\x12\x14\n" + + "\x10TYPE_ID_ENDPOINT\x10\x14\x12\x10\n" + + "\fTYPE_ID_USER\x10\x15\x12\x11\n" + + "\rTYPE_ID_EMAIL\x10\x16\x12$\n" + + " TYPE_ID_UNIFORM_RESOURCE_LOCATOR\x10\x17\x12\x10\n" + + "\fTYPE_ID_FILE\x10\x18\x12\x13\n" + + "\x0fTYPE_ID_PROCESS\x10\x19\x12\x18\n" + + "\x14TYPE_ID_GEO_LOCATION\x10\x1a\x12\x15\n" + + "\x11TYPE_ID_CONTAINER\x10\x1b\x12\x18\n" + + "\x14TYPE_ID_REGISTRY_KEY\x10\x1c\x12\x1a\n" + + "\x16TYPE_ID_REGISTRY_VALUE\x10\x1d\x12\x17\n" + + "\x13TYPE_ID_FINGERPRINT\x10\x1e\x12\x1b\n" + + "\x17TYPE_ID_USER_OBJECT_UID\x10\x1f\x12\x1d\n" + + "\x19TYPE_ID_GROUP_OBJECT_NAME\x10 \x12\x1c\n" + + "\x18TYPE_ID_GROUP_OBJECT_UID\x10!\x12\x1f\n" + + "\x1bTYPE_ID_ACCOUNT_OBJECT_NAME\x10\"\x12\x1e\n" + + "\x1aTYPE_ID_ACCOUNT_OBJECT_UID\x10#\x12\x1a\n" + + "\x16TYPE_ID_SCRIPT_CONTENT\x10$\x12\x19\n" + + "\x15TYPE_ID_SERIAL_NUMBER\x10%\x12(\n" + + "$TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME\x10&\x12%\n" + + "!TYPE_ID_PROCESS_ENTITY_OBJECT_UID\x10'\x12 \n" + + "\x1cTYPE_ID_EMAIL_OBJECT_SUBJECT\x10(\x12\x1c\n" + + "\x18TYPE_ID_EMAIL_OBJECT_UID\x10)\x12\x17\n" + + "\x13TYPE_ID_MESSAGE_UID\x10*\x12&\n" + + "\"TYPE_ID_REGISTRY_VALUE_OBJECT_NAME\x10+\x12\x1f\n" + + "\x1bTYPE_ID_ADVISORY_OBJECT_UID\x10,\x12\x15\n" + + "\x11TYPE_ID_FILE_PATH\x10-\x12\x1d\n" + + "\x19TYPE_ID_REGISTRY_KEY_PATH\x10.\x12\x1d\n" + + "\x19TYPE_ID_DEVICE_OBJECT_UID\x10/\x12'\n" + + "#TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID\x100\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xe4\x05\n" + + "\x11OccurrenceDetails\x12\x1b\n" + + "\tcell_name\x18\x01 \x01(\tR\bcellName\x12\x1f\n" + + "\vcolumn_name\x18\x02 \x01(\tR\n" + + "columnName\x12#\n" + + "\rcolumn_number\x18\x03 \x01(\x05R\fcolumnNumber\x12\x19\n" + + "\bend_line\x18\x04 \x01(\x05R\aendLine\x12\x1b\n" + + "\tjson_path\x18\x05 \x01(\tR\bjsonPath\x12\x1f\n" + + "\vpage_number\x18\x06 \x01(\x05R\n" + + "pageNumber\x121\n" + + "\x15record_index_in_array\x18\a \x01(\x05R\x12recordIndexInArray\x12\x1d\n" + + "\n" + + "row_number\x18\b \x01(\x05R\trowNumber\x12\x1d\n" + + "\n" + + "start_line\x18\t \x01(\x05R\tstartLine:\xa1\x03\xbaH\x9d\x03\x1a\x9a\x03\n" + + "\x1eOccurrenceDetails.at_least_one\x12\x94\x01at least one of [cell_name, column_name, column_number, end_line, json_path, page_number, record_index_in_array, row_number, start_line] must be set\x1a\xe0\x01has(this.cell_name) || has(this.column_name) || has(this.column_number) || has(this.end_line) || has(this.json_path) || has(this.page_number) || has(this.record_index_in_array) || has(this.row_number) || has(this.start_line)\"\xd0\x01\n" + + "\fOrganization\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\aou_name\x18\x02 \x01(\tR\x06ouName\x12\x15\n" + + "\x06ou_uid\x18\x03 \x01(\tR\x05ouUid\x12\x10\n" + + "\x03uid\x18\x04 \x01(\tR\x03uid:j\xbaHg\x1ae\n" + + "\x19Organization.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xf3\x04\n" + + "\x02Os\x12\x14\n" + + "\x05build\x18\x01 \x01(\tR\x05build\x12\x18\n" + + "\acountry\x18\x02 \x01(\tR\acountry\x12\x19\n" + + "\bcpe_name\x18\x03 \x01(\tR\acpeName\x12\x19\n" + + "\bcpu_bits\x18\x04 \x01(\x05R\acpuBits\x12\x18\n" + + "\aedition\x18\x05 \x01(\tR\aedition\x12%\n" + + "\x0ekernel_release\x18\x06 \x01(\tR\rkernelRelease\x12\x12\n" + + "\x04lang\x18\a \x01(\tR\x04lang\x12\x1a\n" + + "\x04name\x18\b \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x17\n" + + "\asp_name\x18\t \x01(\tR\x06spName\x12\x15\n" + + "\x06sp_ver\x18\n" + + " \x01(\x05R\x05spVer\x12\x12\n" + + "\x04type\x18\v \x01(\tR\x04type\x123\n" + + "\atype_id\x18\f \x01(\x0e2\x12.ocsf.v1.Os.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x18\n" + + "\aversion\x18\r \x01(\tR\aversion\"\x82\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\x12\x13\n" + + "\x0fTYPE_ID_WINDOWS\x10d\x12\x1a\n" + + "\x16TYPE_ID_WINDOWS_MOBILE\x10e\x12\x12\n" + + "\rTYPE_ID_LINUX\x10\xc8\x01\x12\x14\n" + + "\x0fTYPE_ID_ANDROID\x10\xc9\x01\x12\x12\n" + + "\rTYPE_ID_MACOS\x10\xac\x02\x12\x10\n" + + "\vTYPE_ID_IOS\x10\xad\x02\x12\x13\n" + + "\x0eTYPE_ID_IPADOS\x10\xae\x02\x12\x14\n" + + "\x0fTYPE_ID_SOLARIS\x10\x90\x03\x12\x10\n" + + "\vTYPE_ID_AIX\x10\x91\x03\x12\x12\n" + + "\rTYPE_ID_HP_UX\x10\x92\x03\"\xe8\x18\n" + + "\x05Osint\x12,\n" + + "\aanswers\x18\x01 \x03(\v2\x12.ocsf.v1.DnsAnswerR\aanswers\x12)\n" + + "\aattacks\x18\x02 \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12F\n" + + "\x11autonomous_system\x18\x03 \x01(\v2\x19.ocsf.v1.AutonomousSystemR\x10autonomousSystem\x12-\n" + + "\bcampaign\x18\x04 \x01(\v2\x11.ocsf.v1.CampaignR\bcampaign\x12\x1a\n" + + "\bcategory\x18\x05 \x01(\tR\bcategory\x12\x18\n" + + "\acomment\x18\x06 \x01(\tR\acomment\x12\x1e\n" + + "\n" + + "confidence\x18\a \x01(\tR\n" + + "confidence\x12@\n" + + "\rconfidence_id\x18\b \x01(\x0e2\x1b.ocsf.v1.Osint.ConfidenceIdR\fconfidenceId\x12!\n" + + "\fcreated_time\x18\t \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\n" + + " \x01(\tR\rcreatedTimeDt\x12'\n" + + "\acreator\x18\v \x01(\v2\r.ocsf.v1.UserR\acreator\x12\x12\n" + + "\x04desc\x18\f \x01(\tR\x04desc\x12+\n" + + "\x11detection_pattern\x18\r \x01(\tR\x10detectionPattern\x124\n" + + "\x16detection_pattern_type\x18\x0e \x01(\tR\x14detectionPatternType\x12`\n" + + "\x19detection_pattern_type_id\x18\x0f \x01(\x0e2%.ocsf.v1.Osint.DetectionPatternTypeIdR\x16detectionPatternTypeId\x12$\n" + + "\x05email\x18\x10 \x01(\v2\x0e.ocsf.v1.EmailR\x05email\x121\n" + + "\n" + + "email_auth\x18\x11 \x01(\v2\x12.ocsf.v1.EmailAuthR\temailAuth\x12'\n" + + "\x0fexpiration_time\x18\x12 \x01(\x03R\x0eexpirationTime\x12,\n" + + "\x12expiration_time_dt\x18\x13 \x01(\tR\x10expirationTimeDt\x12!\n" + + "\fexternal_uid\x18\x14 \x01(\tR\vexternalUid\x12!\n" + + "\x04file\x18\x15 \x01(\v2\r.ocsf.v1.FileR\x04file\x12%\n" + + "\x0eintrusion_sets\x18\x16 \x03(\tR\rintrusionSets\x126\n" + + "\n" + + "kill_chain\x18\x17 \x03(\v2\x17.ocsf.v1.KillChainPhaseR\tkillChain\x12\x16\n" + + "\x06labels\x18\x18 \x03(\tR\x06labels\x12-\n" + + "\blocation\x18\x19 \x01(\v2\x11.ocsf.v1.LocationR\blocation\x12*\n" + + "\amalware\x18\x1a \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12#\n" + + "\rmodified_time\x18\x1b \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\x1c \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18\x1d \x01(\tR\x04name\x12\x1e\n" + + "\n" + + "references\x18\x1e \x03(\tR\n" + + "references\x12>\n" + + "\x11related_analytics\x18\x1f \x03(\v2\x11.ocsf.v1.AnalyticR\x10relatedAnalytics\x123\n" + + "\n" + + "reputation\x18 \x01(\v2\x13.ocsf.v1.ReputationR\n" + + "reputation\x12\x1d\n" + + "\n" + + "risk_score\x18! \x01(\x05R\triskScore\x12'\n" + + "\x06script\x18\" \x01(\v2\x0f.ocsf.v1.ScriptR\x06script\x12\x1a\n" + + "\bseverity\x18# \x01(\tR\bseverity\x12:\n" + + "\vseverity_id\x18$ \x01(\x0e2\x19.ocsf.v1.Osint.SeverityIdR\n" + + "severityId\x129\n" + + "\n" + + "signatures\x18% \x03(\v2\x19.ocsf.v1.DigitalSignatureR\n" + + "signatures\x12\x17\n" + + "\asrc_url\x18& \x01(\tR\x06srcUrl\x12\x1e\n" + + "\n" + + "subdomains\x18' \x03(\tR\n" + + "subdomains\x12\x16\n" + + "\x06subnet\x18( \x01(\tR\x06subnet\x127\n" + + "\fthreat_actor\x18) \x01(\v2\x14.ocsf.v1.ThreatActorR\vthreatActor\x12\x10\n" + + "\x03tlp\x18* \x01(\tR\x03tlp\x12\x12\n" + + "\x04type\x18+ \x01(\tR\x04type\x126\n" + + "\atype_id\x18, \x01(\x0e2\x15.ocsf.v1.Osint.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18- \x01(\tR\x03uid\x12#\n" + + "\ruploaded_time\x18. \x01(\x03R\fuploadedTime\x12(\n" + + "\x10uploaded_time_dt\x18/ \x01(\tR\x0euploadedTimeDt\x12\x1c\n" + + "\x05value\x180 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x05value\x12\x1f\n" + + "\vvendor_name\x181 \x01(\tR\n" + + "vendorName\x12@\n" + + "\x0fvulnerabilities\x182 \x03(\v2\x16.ocsf.v1.VulnerabilityR\x0fvulnerabilities\x12$\n" + + "\x05whois\x183 \x01(\v2\x0e.ocsf.v1.WhoisR\x05whois\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xc2\x02\n" + + "\x16DetectionPatternTypeId\x12%\n" + + "!DETECTION_PATTERN_TYPE_ID_UNKNOWN\x10\x00\x12\"\n" + + "\x1eDETECTION_PATTERN_TYPE_ID_STIX\x10\x01\x12\"\n" + + "\x1eDETECTION_PATTERN_TYPE_ID_PCRE\x10\x02\x12#\n" + + "\x1fDETECTION_PATTERN_TYPE_ID_SIGMA\x10\x03\x12#\n" + + "\x1fDETECTION_PATTERN_TYPE_ID_SNORT\x10\x04\x12&\n" + + "\"DETECTION_PATTERN_TYPE_ID_SURICATA\x10\x05\x12\"\n" + + "\x1eDETECTION_PATTERN_TYPE_ID_YARA\x10\x06\x12#\n" + + "\x1fDETECTION_PATTERN_TYPE_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"\xf9\x02\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12TYPE_ID_IP_ADDRESS\x10\x01\x12\x12\n" + + "\x0eTYPE_ID_DOMAIN\x10\x02\x12\x14\n" + + "\x10TYPE_ID_HOSTNAME\x10\x03\x12\x10\n" + + "\fTYPE_ID_HASH\x10\x04\x12\x0f\n" + + "\vTYPE_ID_URL\x10\x05\x12\x16\n" + + "\x12TYPE_ID_USER_AGENT\x10\x06\x12\x1f\n" + + "\x1bTYPE_ID_DIGITAL_CERTIFICATE\x10\a\x12\x11\n" + + "\rTYPE_ID_EMAIL\x10\b\x12\x19\n" + + "\x15TYPE_ID_EMAIL_ADDRESS\x10\t\x12\x19\n" + + "\x15TYPE_ID_VULNERABILITY\x10\n" + + "\x12\x10\n" + + "\fTYPE_ID_FILE\x10\v\x12\x18\n" + + "\x14TYPE_ID_REGISTRY_KEY\x10\f\x12\x1a\n" + + "\x16TYPE_ID_REGISTRY_VALUE\x10\r\x12\x18\n" + + "\x14TYPE_ID_COMMAND_LINE\x10\x0e\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\x83\x05\n" + + "\aPackage\x12\"\n" + + "\farchitecture\x18\x01 \x01(\tR\farchitecture\x12\x19\n" + + "\bcpe_name\x18\x02 \x01(\tR\acpeName\x12\x14\n" + + "\x05epoch\x18\x03 \x01(\x05R\x05epoch\x12(\n" + + "\x04hash\x18\x04 \x01(\v2\x14.ocsf.v1.FingerprintR\x04hash\x12\x18\n" + + "\alicense\x18\x05 \x01(\tR\alicense\x12\x1f\n" + + "\vlicense_url\x18\x06 \x01(\tR\n" + + "licenseUrl\x12\x1a\n" + + "\x04name\x18\a \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12'\n" + + "\x0fpackage_manager\x18\b \x01(\tR\x0epackageManager\x12.\n" + + "\x13package_manager_url\x18\t \x01(\tR\x11packageManagerUrl\x12\x12\n" + + "\x04purl\x18\n" + + " \x01(\tR\x04purl\x12\x18\n" + + "\arelease\x18\v \x01(\tR\arelease\x12\x17\n" + + "\asrc_url\x18\f \x01(\tR\x06srcUrl\x12\x12\n" + + "\x04type\x18\r \x01(\tR\x04type\x120\n" + + "\atype_id\x18\x0e \x01(\x0e2\x17.ocsf.v1.Package.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x0f \x01(\tR\x03uid\x12\x1f\n" + + "\vvendor_name\x18\x10 \x01(\tR\n" + + "vendorName\x12 \n" + + "\aversion\x18\x11 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion\"g\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x17\n" + + "\x13TYPE_ID_APPLICATION\x10\x01\x12\x1c\n" + + "\x18TYPE_ID_OPERATING_SYSTEM\x10\x02\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xdf\x02\n" + + "\x06Policy\x12*\n" + + "\x04data\x18\x01 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x12\n" + + "\x04desc\x18\x02 \x01(\tR\x04desc\x12$\n" + + "\x05group\x18\x03 \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12\x1d\n" + + "\n" + + "is_applied\x18\x04 \x01(\bR\tisApplied\x12\x12\n" + + "\x04name\x18\x05 \x01(\tR\x04name\x12\x12\n" + + "\x04type\x18\x06 \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\a \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\b \x01(\tR\aversion:|\xbaHy\x1aw\n" + + "\x13Policy.at_least_one\x12-at least one of [name, type, uid] must be set\x1a1has(this.name) || has(this.type) || has(this.uid)\"n\n" + + "\bPortInfo\x12\x1a\n" + + "\x04port\x18\x01 \x01(\x05B\x06\xbaH\x03\xc8\x01\x01R\x04port\x12#\n" + + "\rprotocol_name\x18\x02 \x01(\tR\fprotocolName\x12!\n" + + "\fprotocol_num\x18\x03 \x01(\x05R\vprotocolNum\"\xec\v\n" + + "\aProcess\x122\n" + + "\bancestry\x18\x01 \x03(\v2\x16.ocsf.v1.ProcessEntityR\bancestry\x12\x12\n" + + "\x04auid\x18\x02 \x01(\x05R\x04auid\x12\x19\n" + + "\bcmd_line\x18\x03 \x01(\tR\acmdLine\x120\n" + + "\tcontainer\x18\x04 \x01(\v2\x12.ocsf.v1.ContainerR\tcontainer\x12\x12\n" + + "\x04cpid\x18\x05 \x01(\tR\x04cpid\x12!\n" + + "\fcreated_time\x18\x06 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\a \x01(\tR\rcreatedTimeDt\x12\x12\n" + + "\x04egid\x18\b \x01(\x05R\x04egid\x12Q\n" + + "\x15environment_variables\x18\t \x03(\v2\x1c.ocsf.v1.EnvironmentVariableR\x14environmentVariables\x12\x12\n" + + "\x04euid\x18\n" + + " \x01(\x05R\x04euid\x12!\n" + + "\x04file\x18\v \x01(\v2\r.ocsf.v1.FileR\x04file\x12$\n" + + "\x05group\x18\f \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12<\n" + + "\x0fhosted_services\x18\r \x03(\v2\x13.ocsf.v1.WinServiceR\x0ehostedServices\x12\x1c\n" + + "\tintegrity\x18\x0e \x01(\tR\tintegrity\x12?\n" + + "\fintegrity_id\x18\x0f \x01(\x0e2\x1c.ocsf.v1.Process.IntegrityIdR\vintegrityId\x12\x18\n" + + "\alineage\x18\x10 \x03(\tR\alineage\x12%\n" + + "\x0eloaded_modules\x18\x11 \x03(\tR\rloadedModules\x12\x12\n" + + "\x04name\x18\x12 \x01(\tR\x04name\x12#\n" + + "\rnamespace_pid\x18\x13 \x01(\x05R\fnamespacePid\x127\n" + + "\x0eparent_process\x18\x14 \x01(\v2\x10.ocsf.v1.ProcessR\rparentProcess\x12\x12\n" + + "\x04path\x18\x15 \x01(\tR\x04path\x12\x10\n" + + "\x03pid\x18\x16 \x01(\x05R\x03pid\x12\x12\n" + + "\x04ptid\x18\x17 \x01(\x03R\x04ptid\x12\x18\n" + + "\asandbox\x18\x18 \x01(\tR\asandbox\x12*\n" + + "\asession\x18\x19 \x01(\v2\x10.ocsf.v1.SessionR\asession\x12'\n" + + "\x0fterminated_time\x18\x1a \x01(\x03R\x0eterminatedTime\x12,\n" + + "\x12terminated_time_dt\x18\x1b \x01(\tR\x10terminatedTimeDt\x12\x10\n" + + "\x03tid\x18\x1c \x01(\x05R\x03tid\x12\x10\n" + + "\x03uid\x18\x1d \x01(\tR\x03uid\x12!\n" + + "\x04user\x18\x1e \x01(\v2\r.ocsf.v1.UserR\x04user\x12+\n" + + "\x11working_directory\x18\x1f \x01(\tR\x10workingDirectory\x128\n" + + "\vxattributes\x18 \x01(\v2\x16.google.protobuf.ValueR\vxattributes\"\xd6\x01\n" + + "\vIntegrityId\x12\x18\n" + + "\x14INTEGRITY_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16INTEGRITY_ID_UNTRUSTED\x10\x01\x12\x14\n" + + "\x10INTEGRITY_ID_LOW\x10\x02\x12\x17\n" + + "\x13INTEGRITY_ID_MEDIUM\x10\x03\x12\x15\n" + + "\x11INTEGRITY_ID_HIGH\x10\x04\x12\x17\n" + + "\x13INTEGRITY_ID_SYSTEM\x10\x05\x12\x1a\n" + + "\x16INTEGRITY_ID_PROTECTED\x10\x06\x12\x16\n" + + "\x12INTEGRITY_ID_OTHER\x10c:{\xbaHx\x1av\n" + + "\x14Process.at_least_one\x12,at least one of [cpid, pid, uid] must be set\x1a0has(this.cpid) || has(this.pid) || has(this.uid)\"\xab\x03\n" + + "\rProcessEntity\x12\x19\n" + + "\bcmd_line\x18\x01 \x01(\tR\acmdLine\x12\x12\n" + + "\x04cpid\x18\x02 \x01(\tR\x04cpid\x12!\n" + + "\fcreated_time\x18\x03 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x04 \x01(\tR\rcreatedTimeDt\x12\x12\n" + + "\x04name\x18\x05 \x01(\tR\x04name\x12\x12\n" + + "\x04path\x18\x06 \x01(\tR\x04path\x12\x10\n" + + "\x03pid\x18\a \x01(\x05R\x03pid\x12\x10\n" + + "\x03uid\x18\b \x01(\tR\x03uid:\xd3\x01\xbaH\xcf\x01\x1a\xcc\x01\n" + + "\x1aProcessEntity.at_least_one\x12Bat least one of [cmd_line, cpid, name, path, pid, uid] must be set\x1ajhas(this.cmd_line) || has(this.cpid) || has(this.name) || has(this.path) || has(this.pid) || has(this.uid)\"\xfd\x03\n" + + "\aProduct\x12\x19\n" + + "\bcpe_name\x18\x01 \x01(\tR\acpeName\x12L\n" + + "\x13data_classification\x18\x02 \x01(\v2\x1b.ocsf.v1.DataClassificationR\x12dataClassification\x12N\n" + + "\x14data_classifications\x18\x03 \x03(\v2\x1b.ocsf.v1.DataClassificationR\x13dataClassifications\x12*\n" + + "\afeature\x18\x04 \x01(\v2\x10.ocsf.v1.FeatureR\afeature\x12\x12\n" + + "\x04lang\x18\x05 \x01(\tR\x04lang\x12\x12\n" + + "\x04name\x18\x06 \x01(\tR\x04name\x12\x12\n" + + "\x04path\x18\a \x01(\tR\x04path\x12\x10\n" + + "\x03uid\x18\b \x01(\tR\x03uid\x12\x1d\n" + + "\n" + + "url_string\x18\t \x01(\tR\turlString\x12\x1f\n" + + "\vvendor_name\x18\n" + + " \x01(\tR\n" + + "vendorName\x12\x18\n" + + "\aversion\x18\v \x01(\tR\aversion:e\xbaHb\x1a`\n" + + "\x14Product.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x97\x01\n" + + "\x16ProgrammaticCredential\x12$\n" + + "\x0elast_used_time\x18\x01 \x01(\x03R\flastUsedTime\x12)\n" + + "\x11last_used_time_dt\x18\x02 \x01(\tR\x0elastUsedTimeDt\x12\x12\n" + + "\x04type\x18\x03 \x01(\tR\x04type\x12\x18\n" + + "\x03uid\x18\x04 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xde\x01\n" + + "\vRemediation\x126\n" + + "\fcis_controls\x18\x01 \x03(\v2\x13.ocsf.v1.CisControlR\vcisControls\x12\x1a\n" + + "\x04desc\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04desc\x12:\n" + + "\x0fkb_article_list\x18\x03 \x03(\v2\x12.ocsf.v1.KbArticleR\rkbArticleList\x12\x1f\n" + + "\vkb_articles\x18\x04 \x03(\tR\n" + + "kbArticles\x12\x1e\n" + + "\n" + + "references\x18\x05 \x03(\tR\n" + + "references\"\xa4\x02\n" + + "\bReporter\x12\x1a\n" + + "\bhostname\x18\x01 \x01(\tR\bhostname\x12\x0e\n" + + "\x02ip\x18\x02 \x01(\tR\x02ip\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12'\n" + + "\x03org\x18\x04 \x01(\v2\x15.ocsf.v1.OrganizationR\x03org\x12\x10\n" + + "\x03uid\x18\x05 \x01(\tR\x03uid:\x9c\x01\xbaH\x98\x01\x1a\x95\x01\n" + + "\x15Reporter.at_least_one\x125at least one of [hostname, ip, name, uid] must be set\x1aEhas(this.hostname) || has(this.ip) || has(this.name) || has(this.uid)\"\xf1\x03\n" + + "\n" + + "Reputation\x12%\n" + + "\n" + + "base_score\x18\x01 \x01(\x01B\x06\xbaH\x03\xc8\x01\x01R\tbaseScore\x12\x1a\n" + + "\bprovider\x18\x02 \x01(\tR\bprovider\x12\x14\n" + + "\x05score\x18\x03 \x01(\tR\x05score\x12>\n" + + "\bscore_id\x18\x04 \x01(\x0e2\x1b.ocsf.v1.Reputation.ScoreIdB\x06\xbaH\x03\xc8\x01\x01R\ascoreId\"\xc9\x02\n" + + "\aScoreId\x12\x14\n" + + "\x10SCORE_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12SCORE_ID_VERY_SAFE\x10\x01\x12\x11\n" + + "\rSCORE_ID_SAFE\x10\x02\x12\x1a\n" + + "\x16SCORE_ID_PROBABLY_SAFE\x10\x03\x12\x17\n" + + "\x13SCORE_ID_LEANS_SAFE\x10\x04\x12\x1c\n" + + "\x18SCORE_ID_MAY_NOT_BE_SAFE\x10\x05\x12\x1d\n" + + "\x19SCORE_ID_EXERCISE_CAUTION\x10\x06\x12\x1d\n" + + "\x19SCORE_ID_SUSPICIOUS_RISKY\x10\a\x12\x1f\n" + + "\x1bSCORE_ID_POSSIBLY_MALICIOUS\x10\b\x12\x1f\n" + + "\x1bSCORE_ID_PROBABLY_MALICIOUS\x10\t\x12\x16\n" + + "\x12SCORE_ID_MALICIOUS\x10\n" + + "\x12\x12\n" + + "\x0eSCORE_ID_OTHER\x10c\"\x99\x01\n" + + "\aRequest\x122\n" + + "\n" + + "containers\x18\x01 \x03(\v2\x12.ocsf.v1.ContainerR\n" + + "containers\x12*\n" + + "\x04data\x18\x02 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x14\n" + + "\x05flags\x18\x03 \x03(\tR\x05flags\x12\x18\n" + + "\x03uid\x18\x04 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xa7\n" + + "\n" + + "\x0fResourceDetails\x12-\n" + + "\n" + + "agent_list\x18\x01 \x03(\v2\x0e.ocsf.v1.AgentR\tagentList\x12'\n" + + "\x0fcloud_partition\x18\x02 \x01(\tR\x0ecloudPartition\x12!\n" + + "\fcreated_time\x18\x03 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x04 \x01(\tR\rcreatedTimeDt\x12 \n" + + "\vcriticality\x18\x05 \x01(\tR\vcriticality\x12*\n" + + "\x04data\x18\x06 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12L\n" + + "\x13data_classification\x18\a \x01(\v2\x1b.ocsf.v1.DataClassificationR\x12dataClassification\x12N\n" + + "\x14data_classifications\x18\b \x03(\v2\x1b.ocsf.v1.DataClassificationR\x13dataClassifications\x12$\n" + + "\x05group\x18\t \x01(\v2\x0e.ocsf.v1.GroupR\x05group\x12\x1a\n" + + "\bhostname\x18\n" + + " \x01(\tR\bhostname\x12\x0e\n" + + "\x02ip\x18\v \x01(\tR\x02ip\x12 \n" + + "\fis_backed_up\x18\f \x01(\bR\n" + + "isBackedUp\x12\x16\n" + + "\x06labels\x18\r \x03(\tR\x06labels\x12#\n" + + "\rmodified_time\x18\x0e \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\x0f \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18\x10 \x01(\tR\x04name\x12\x1c\n" + + "\tnamespace\x18\x11 \x01(\tR\tnamespace\x12#\n" + + "\x05owner\x18\x12 \x01(\v2\r.ocsf.v1.UserR\x05owner\x12\x1a\n" + + "\bprovider\x18\x13 \x01(\tR\bprovider\x12\x16\n" + + "\x06region\x18\x14 \x01(\tR\x06region\x12C\n" + + "\x15resource_relationship\x18\x15 \x01(\v2\x0e.ocsf.v1.GraphR\x14resourceRelationship\x12\x12\n" + + "\x04role\x18\x16 \x01(\tR\x04role\x128\n" + + "\arole_id\x18\x17 \x01(\x0e2\x1f.ocsf.v1.ResourceDetails.RoleIdR\x06roleId\x12+\n" + + "\x04tags\x18\x18 \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x12\n" + + "\x04type\x18\x19 \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\x1a \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x1b \x01(\tR\x06uidAlt\x12\x18\n" + + "\aversion\x18\x1c \x01(\tR\aversion\x12\x12\n" + + "\x04zone\x18\x1d \x01(\tR\x04zone\"\x82\x01\n" + + "\x06RoleId\x12\x13\n" + + "\x0fROLE_ID_UNKNOWN\x10\x00\x12\x12\n" + + "\x0eROLE_ID_TARGET\x10\x01\x12\x11\n" + + "\rROLE_ID_ACTOR\x10\x02\x12\x14\n" + + "\x10ROLE_ID_AFFECTED\x10\x03\x12\x13\n" + + "\x0fROLE_ID_RELATED\x10\x04\x12\x11\n" + + "\rROLE_ID_OTHER\x10c:m\xbaHj\x1ah\n" + + "\x1cResourceDetails.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xe9\x01\n" + + "\bResponse\x12\x12\n" + + "\x04code\x18\x01 \x01(\x05R\x04code\x122\n" + + "\n" + + "containers\x18\x02 \x03(\v2\x12.ocsf.v1.ContainerR\n" + + "containers\x12*\n" + + "\x04data\x18\x03 \x01(\v2\x16.google.protobuf.ValueR\x04data\x12\x14\n" + + "\x05error\x18\x04 \x01(\tR\x05error\x12#\n" + + "\rerror_message\x18\x05 \x01(\tR\ferrorMessage\x12\x14\n" + + "\x05flags\x18\x06 \x03(\tR\x05flags\x12\x18\n" + + "\amessage\x18\a \x01(\tR\amessage\"\xee\x01\n" + + "\x04Rule\x12\x1a\n" + + "\bcategory\x18\x01 \x01(\tR\bcategory\x12\x12\n" + + "\x04desc\x18\x02 \x01(\tR\x04desc\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x12\n" + + "\x04type\x18\x04 \x01(\tR\x04type\x12\x10\n" + + "\x03uid\x18\x05 \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\x06 \x01(\tR\aversion:b\xbaH_\x1a]\n" + + "\x11Rule.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"=\n" + + "\x03San\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x1a\n" + + "\x04type\x18\x02 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04type\"\xda\x03\n" + + "\x04Sbom\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x122\n" + + "\apackage\x18\x03 \x01(\v2\x10.ocsf.v1.PackageB\x06\xbaH\x03\xc8\x01\x01R\apackage\x12*\n" + + "\aproduct\x18\x04 \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12K\n" + + "\x13software_components\x18\x05 \x03(\v2\x1a.ocsf.v1.SoftwareComponentR\x12softwareComponents\x12\x12\n" + + "\x04type\x18\x06 \x01(\tR\x04type\x12-\n" + + "\atype_id\x18\a \x01(\x0e2\x14.ocsf.v1.Sbom.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\b \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\t \x01(\tR\aversion\"k\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x10\n" + + "\fTYPE_ID_SPDX\x10\x01\x12\x15\n" + + "\x11TYPE_ID_CYCLONEDX\x10\x02\x12\x10\n" + + "\fTYPE_ID_SWID\x10\x03\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xe8\v\n" + + "\x04Scim\x12#\n" + + "\rauth_protocol\x18\x01 \x01(\tR\fauthProtocol\x12F\n" + + "\x10auth_protocol_id\x18\x02 \x01(\x0e2\x1c.ocsf.v1.Scim.AuthProtocolIdR\x0eauthProtocolId\x12!\n" + + "\fcreated_time\x18\x03 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x04 \x01(\tR\rcreatedTimeDt\x12#\n" + + "\rerror_message\x18\x05 \x01(\tR\ferrorMessage\x12A\n" + + "\x1dis_group_provisioning_enabled\x18\x06 \x01(\bR\x1aisGroupProvisioningEnabled\x12?\n" + + "\x1cis_user_provisioning_enabled\x18\a \x01(\bR\x19isUserProvisioningEnabled\x12\"\n" + + "\rlast_run_time\x18\b \x01(\x03R\vlastRunTime\x12'\n" + + "\x10last_run_time_dt\x18\t \x01(\tR\rlastRunTimeDt\x12#\n" + + "\rmodified_time\x18\n" + + " \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\v \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18\f \x01(\tR\x04name\x12#\n" + + "\rprotocol_name\x18\r \x01(\tR\fprotocolName\x12\x1d\n" + + "\n" + + "rate_limit\x18\x0e \x01(\x05R\trateLimit\x12B\n" + + "\x11scim_group_schema\x18\x0f \x01(\v2\x16.google.protobuf.ValueR\x0fscimGroupSchema\x12@\n" + + "\x10scim_user_schema\x18\x10 \x01(\v2\x16.google.protobuf.ValueR\x0escimUserSchema\x12\x14\n" + + "\x05state\x18\x11 \x01(\tR\x05state\x120\n" + + "\bstate_id\x18\x12 \x01(\x0e2\x15.ocsf.v1.Scim.StateIdR\astateId\x12\x10\n" + + "\x03uid\x18\x13 \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x14 \x01(\tR\x06uidAlt\x12\x1d\n" + + "\n" + + "url_string\x18\x15 \x01(\tR\turlString\x12\x1f\n" + + "\vvendor_name\x18\x16 \x01(\tR\n" + + "vendorName\x12\x18\n" + + "\aversion\x18\x17 \x01(\tR\aversion\"\xab\x03\n" + + "\x0eAuthProtocolId\x12\x1c\n" + + "\x18AUTH_PROTOCOL_ID_UNKNOWN\x10\x00\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_NTLM\x10\x01\x12\x1d\n" + + "\x19AUTH_PROTOCOL_ID_KERBEROS\x10\x02\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_DIGEST\x10\x03\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_OPENID\x10\x04\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_SAML\x10\x05\x12\x1e\n" + + "\x1aAUTH_PROTOCOL_ID_OAUTH_2_0\x10\x06\x12\x18\n" + + "\x14AUTH_PROTOCOL_ID_PAP\x10\a\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_CHAP\x10\b\x12\x18\n" + + "\x14AUTH_PROTOCOL_ID_EAP\x10\t\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_RADIUS\x10\n" + + "\x12)\n" + + "%AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION\x10\v\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_LDAP\x10\f\x12\x1a\n" + + "\x16AUTH_PROTOCOL_ID_OTHER\x10c\"\x89\x01\n" + + "\aStateId\x12\x14\n" + + "\x10STATE_ID_UNKNOWN\x10\x00\x12\x14\n" + + "\x10STATE_ID_PENDING\x10\x01\x12\x13\n" + + "\x0fSTATE_ID_ACTIVE\x10\x02\x12\x13\n" + + "\x0fSTATE_ID_FAILED\x10\x03\x12\x14\n" + + "\x10STATE_ID_DELETED\x10\x04\x12\x12\n" + + "\x0eSTATE_ID_OTHER\x10c\"\x89\x04\n" + + "\x06Script\x12!\n" + + "\x04file\x18\x01 \x01(\v2\r.ocsf.v1.FileR\x04file\x12,\n" + + "\x06hashes\x18\x02 \x03(\v2\x14.ocsf.v1.FingerprintR\x06hashes\x12\x12\n" + + "\x04name\x18\x03 \x01(\tR\x04name\x12\x1d\n" + + "\n" + + "parent_uid\x18\x04 \x01(\tR\tparentUid\x12B\n" + + "\x0escript_content\x18\x05 \x01(\v2\x13.ocsf.v1.LongStringB\x06\xbaH\x03\xc8\x01\x01R\rscriptContent\x12\x12\n" + + "\x04type\x18\x06 \x01(\tR\x04type\x127\n" + + "\atype_id\x18\a \x01(\x0e2\x16.ocsf.v1.Script.TypeIdB\x06\xbaH\x03\xc8\x01\x01R\x06typeId\x12\x10\n" + + "\x03uid\x18\b \x01(\tR\x03uid\"\xd7\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\"\n" + + "\x1eTYPE_ID_WINDOWS_COMMAND_PROMPT\x10\x01\x12\x16\n" + + "\x12TYPE_ID_POWERSHELL\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_PYTHON\x10\x03\x12\x16\n" + + "\x12TYPE_ID_JAVASCRIPT\x10\x04\x12\x14\n" + + "\x10TYPE_ID_VBSCRIPT\x10\x05\x12\x16\n" + + "\x12TYPE_ID_UNIX_SHELL\x10\x06\x12\x0f\n" + + "\vTYPE_ID_VBA\x10\a\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xf5\x01\n" + + "\aService\x12\x16\n" + + "\x06labels\x18\x01 \x03(\tR\x06labels\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x12+\n" + + "\x04tags\x18\x03 \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x10\n" + + "\x03uid\x18\x04 \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\x05 \x01(\tR\aversion:e\xbaHb\x1a`\n" + + "\x14Service.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xd3\x03\n" + + "\aSession\x12\x14\n" + + "\x05count\x18\x01 \x01(\x05R\x05count\x12!\n" + + "\fcreated_time\x18\x02 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x03 \x01(\tR\rcreatedTimeDt\x12%\n" + + "\x0ecredential_uid\x18\x04 \x01(\tR\rcredentialUid\x12+\n" + + "\x11expiration_reason\x18\x05 \x01(\tR\x10expirationReason\x12'\n" + + "\x0fexpiration_time\x18\x06 \x01(\x03R\x0eexpirationTime\x12,\n" + + "\x12expiration_time_dt\x18\a \x01(\tR\x10expirationTimeDt\x12\x15\n" + + "\x06is_mfa\x18\b \x01(\bR\x05isMfa\x12\x1b\n" + + "\tis_remote\x18\t \x01(\bR\bisRemote\x12\x15\n" + + "\x06is_vpn\x18\n" + + " \x01(\bR\x05isVpn\x12\x16\n" + + "\x06issuer\x18\v \x01(\tR\x06issuer\x12\x1a\n" + + "\bterminal\x18\f \x01(\tR\bterminal\x12\x10\n" + + "\x03uid\x18\r \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x0e \x01(\tR\x06uidAlt\x12\x12\n" + + "\x04uuid\x18\x0f \x01(\tR\x04uuid\"\x9c\x05\n" + + "\x11SoftwareComponent\x12\x16\n" + + "\x06author\x18\x01 \x01(\tR\x06author\x12(\n" + + "\x04hash\x18\x02 \x01(\v2\x14.ocsf.v1.FingerprintR\x04hash\x12\x18\n" + + "\alicense\x18\x03 \x01(\tR\alicense\x12\x1a\n" + + "\x04name\x18\x04 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x12\n" + + "\x04purl\x18\x05 \x01(\tR\x04purl\x12+\n" + + "\x11related_component\x18\x06 \x01(\tR\x10relatedComponent\x12\"\n" + + "\frelationship\x18\a \x01(\tR\frelationship\x12R\n" + + "\x0frelationship_id\x18\b \x01(\x0e2).ocsf.v1.SoftwareComponent.RelationshipIdR\x0erelationshipId\x12\x12\n" + + "\x04type\x18\t \x01(\tR\x04type\x12:\n" + + "\atype_id\x18\n" + + " \x01(\x0e2!.ocsf.v1.SoftwareComponent.TypeIdR\x06typeId\x12 \n" + + "\aversion\x18\v \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\aversion\"h\n" + + "\x0eRelationshipId\x12\x1b\n" + + "\x17RELATIONSHIP_ID_UNKNOWN\x10\x00\x12\x1e\n" + + "\x1aRELATIONSHIP_ID_DEPENDS_ON\x10\x01\x12\x19\n" + + "\x15RELATIONSHIP_ID_OTHER\x10c\"z\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11TYPE_ID_FRAMEWORK\x10\x01\x12\x13\n" + + "\x0fTYPE_ID_LIBRARY\x10\x02\x12\x1c\n" + + "\x18TYPE_ID_OPERATING_SYSTEM\x10\x03\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xee\x02\n" + + "\x04Span\x12\x1a\n" + + "\bduration\x18\x01 \x01(\x03R\bduration\x12!\n" + + "\bend_time\x18\x02 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x03 \x01(\tR\tendTimeDt\x12\x18\n" + + "\amessage\x18\x04 \x01(\tR\amessage\x12\x1c\n" + + "\toperation\x18\x05 \x01(\tR\toperation\x12\x1d\n" + + "\n" + + "parent_uid\x18\x06 \x01(\tR\tparentUid\x12*\n" + + "\aservice\x18\a \x01(\v2\x10.ocsf.v1.ServiceR\aservice\x12%\n" + + "\n" + + "start_time\x18\b \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\tstartTime\x12\"\n" + + "\rstart_time_dt\x18\t \x01(\tR\vstartTimeDt\x12\x1f\n" + + "\vstatus_code\x18\n" + + " \x01(\tR\n" + + "statusCode\x12\x18\n" + + "\x03uid\x18\v \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xba\b\n" + + "\x03Sso\x12#\n" + + "\rauth_protocol\x18\x01 \x01(\tR\fauthProtocol\x12E\n" + + "\x10auth_protocol_id\x18\x02 \x01(\x0e2\x1b.ocsf.v1.Sso.AuthProtocolIdR\x0eauthProtocolId\x126\n" + + "\vcertificate\x18\x03 \x01(\v2\x14.ocsf.v1.CertificateR\vcertificate\x12!\n" + + "\fcreated_time\x18\x04 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x05 \x01(\tR\rcreatedTimeDt\x12#\n" + + "\rduration_mins\x18\x06 \x01(\x05R\fdurationMins\x12!\n" + + "\fidle_timeout\x18\a \x01(\x05R\vidleTimeout\x12%\n" + + "\x0elogin_endpoint\x18\b \x01(\tR\rloginEndpoint\x12'\n" + + "\x0flogout_endpoint\x18\t \x01(\tR\x0elogoutEndpoint\x12+\n" + + "\x11metadata_endpoint\x18\n" + + " \x01(\tR\x10metadataEndpoint\x12#\n" + + "\rmodified_time\x18\v \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\f \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18\r \x01(\tR\x04name\x12#\n" + + "\rprotocol_name\x18\x0e \x01(\tR\fprotocolName\x12\x16\n" + + "\x06scopes\x18\x0f \x03(\tR\x06scopes\x12\x10\n" + + "\x03uid\x18\x10 \x01(\tR\x03uid\x12\x1f\n" + + "\vvendor_name\x18\x11 \x01(\tR\n" + + "vendorName\"\xab\x03\n" + + "\x0eAuthProtocolId\x12\x1c\n" + + "\x18AUTH_PROTOCOL_ID_UNKNOWN\x10\x00\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_NTLM\x10\x01\x12\x1d\n" + + "\x19AUTH_PROTOCOL_ID_KERBEROS\x10\x02\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_DIGEST\x10\x03\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_OPENID\x10\x04\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_SAML\x10\x05\x12\x1e\n" + + "\x1aAUTH_PROTOCOL_ID_OAUTH_2_0\x10\x06\x12\x18\n" + + "\x14AUTH_PROTOCOL_ID_PAP\x10\a\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_CHAP\x10\b\x12\x18\n" + + "\x14AUTH_PROTOCOL_ID_EAP\x10\t\x12\x1b\n" + + "\x17AUTH_PROTOCOL_ID_RADIUS\x10\n" + + "\x12)\n" + + "%AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION\x10\v\x12\x19\n" + + "\x15AUTH_PROTOCOL_ID_LDAP\x10\f\x12\x1a\n" + + "\x16AUTH_PROTOCOL_ID_OTHER\x10c\"\xb9\x01\n" + + "\fSubTechnique\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid:j\xbaHg\x1ae\n" + + "\x19SubTechnique.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xad\x01\n" + + "\x06Tactic\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid:d\xbaHa\x1a_\n" + + "\x13Tactic.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xb3\x01\n" + + "\tTechnique\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" + + "\asrc_url\x18\x02 \x01(\tR\x06srcUrl\x12\x10\n" + + "\x03uid\x18\x03 \x01(\tR\x03uid:g\xbaHd\x1ab\n" + + "\x16Technique.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\x89\x02\n" + + "\vThreatActor\x12\x1a\n" + + "\x04name\x18\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12\x12\n" + + "\x04type\x18\x02 \x01(\tR\x04type\x124\n" + + "\atype_id\x18\x03 \x01(\x0e2\x1b.ocsf.v1.ThreatActor.TypeIdR\x06typeId\"\x93\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14TYPE_ID_NATION_STATE\x10\x01\x12\x19\n" + + "\x15TYPE_ID_CYBERCRIMINAL\x10\x02\x12\x17\n" + + "\x13TYPE_ID_HACKTIVISTS\x10\x03\x12\x13\n" + + "\x0fTYPE_ID_INSIDER\x10\x04\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xbc\t\n" + + "\bTimespan\x12\x1a\n" + + "\bduration\x18\x01 \x01(\x03R\bduration\x12#\n" + + "\rduration_days\x18\x02 \x01(\x05R\fdurationDays\x12%\n" + + "\x0eduration_hours\x18\x03 \x01(\x05R\rdurationHours\x12#\n" + + "\rduration_mins\x18\x04 \x01(\x05R\fdurationMins\x12'\n" + + "\x0fduration_months\x18\x05 \x01(\x05R\x0edurationMonths\x12#\n" + + "\rduration_secs\x18\x06 \x01(\x05R\fdurationSecs\x12%\n" + + "\x0eduration_weeks\x18\a \x01(\x05R\rdurationWeeks\x12%\n" + + "\x0eduration_years\x18\b \x01(\x05R\rdurationYears\x12\x19\n" + + "\bend_time\x18\t \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\n" + + " \x01(\tR\tendTimeDt\x12\x1d\n" + + "\n" + + "start_time\x18\v \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x18\f \x01(\tR\vstartTimeDt\x12\x12\n" + + "\x04type\x18\r \x01(\tR\x04type\x121\n" + + "\atype_id\x18\x0e \x01(\x0e2\x18.ocsf.v1.Timespan.TypeIdR\x06typeId\"\xee\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x18\n" + + "\x14TYPE_ID_MILLISECONDS\x10\x01\x12\x13\n" + + "\x0fTYPE_ID_SECONDS\x10\x02\x12\x13\n" + + "\x0fTYPE_ID_MINUTES\x10\x03\x12\x11\n" + + "\rTYPE_ID_HOURS\x10\x04\x12\x10\n" + + "\fTYPE_ID_DAYS\x10\x05\x12\x11\n" + + "\rTYPE_ID_WEEKS\x10\x06\x12\x12\n" + + "\x0eTYPE_ID_MONTHS\x10\a\x12\x11\n" + + "\rTYPE_ID_YEARS\x10\b\x12\x19\n" + + "\x15TYPE_ID_TIME_INTERVAL\x10\t\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\xd0\x03\xbaH\xcc\x03\x1a\xc9\x03\n" + + "\x15Timespan.at_least_one\x12\xaa\x01at least one of [duration, duration_days, duration_hours, duration_mins, duration_months, duration_secs, duration_weeks, duration_years, end_time, start_time] must be set\x1a\x82\x02has(this.duration) || has(this.duration_days) || has(this.duration_hours) || has(this.duration_mins) || has(this.duration_months) || has(this.duration_secs) || has(this.duration_weeks) || has(this.duration_years) || has(this.end_time) || has(this.start_time)\"\xaf\x05\n" + + "\x05Token\x12!\n" + + "\fcreated_time\x18\x01 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x02 \x01(\tR\rcreatedTimeDt\x12'\n" + + "\x0fexpiration_time\x18\x03 \x01(\x03R\x0eexpirationTime\x12,\n" + + "\x12expiration_time_dt\x18\x04 \x01(\tR\x10expirationTimeDt\x12!\n" + + "\fis_renewable\x18\x05 \x01(\bR\visRenewable\x12#\n" + + "\rmodified_time\x18\x06 \x01(\x03R\fmodifiedTime\x12(\n" + + "\x10modified_time_dt\x18\a \x01(\tR\x0emodifiedTimeDt\x12\x12\n" + + "\x04name\x18\b \x01(\tR\x04name\x12\x1d\n" + + "\n" + + "tenant_uid\x18\t \x01(\tR\ttenantUid\x12\x12\n" + + "\x04type\x18\n" + + " \x01(\tR\x04type\x12.\n" + + "\atype_id\x18\v \x01(\x0e2\x15.ocsf.v1.Token.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\f \x01(\tR\x03uid\x12\x12\n" + + "\x04zone\x18\r \x01(\tR\x04zone\"\xf4\x01\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\"\n" + + "\x1eTYPE_ID_TICKET_GRANTING_TICKET\x10\x01\x12\x1a\n" + + "\x16TYPE_ID_SERVICE_TICKET\x10\x02\x12\x1a\n" + + "\x16TYPE_ID_IDENTITY_TOKEN\x10\x03\x12\x19\n" + + "\x15TYPE_ID_REFRESH_TOKEN\x10\x04\x12\x1a\n" + + "\x16TYPE_ID_SAML_ASSERTION\x10\x05\x12\x18\n" + + "\x14TYPE_ID_CLIENT_TOKEN\x10\x06\x12\x15\n" + + "\x11TYPE_ID_API_TOKEN\x10\a\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c\"\xa0\x02\n" + + "\x05Trace\x12\x1a\n" + + "\bduration\x18\x01 \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x02 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x03 \x01(\tR\tendTimeDt\x12\x14\n" + + "\x05flags\x18\x04 \x03(\tR\x05flags\x12*\n" + + "\aservice\x18\x05 \x01(\v2\x10.ocsf.v1.ServiceR\aservice\x12!\n" + + "\x04span\x18\x06 \x01(\v2\r.ocsf.v1.SpanR\x04span\x12\x1d\n" + + "\n" + + "start_time\x18\a \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x18\b \x01(\tR\vstartTimeDt\x12\x18\n" + + "\x03uid\x18\t \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x03uid\"\xb8\x02\n" + + "\x12TransformationInfo\x12\x12\n" + + "\x04lang\x18\x01 \x01(\tR\x04lang\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x12*\n" + + "\aproduct\x18\x03 \x01(\v2\x10.ocsf.v1.ProductR\aproduct\x12\x12\n" + + "\x04time\x18\x04 \x01(\x03R\x04time\x12\x17\n" + + "\atime_dt\x18\x05 \x01(\tR\x06timeDt\x12\x10\n" + + "\x03uid\x18\x06 \x01(\tR\x03uid\x12\x1d\n" + + "\n" + + "url_string\x18\a \x01(\tR\turlString:p\xbaHm\x1ak\n" + + "\x1fTransformationInfo.at_least_one\x12'at least one of [name, uid] must be set\x1a\x1fhas(this.name) || has(this.uid)\"\xf6\x1a\n" + + "\x03Url\x12\x1e\n" + + "\n" + + "categories\x18\x01 \x03(\tR\n" + + "categories\x12;\n" + + "\fcategory_ids\x18\x02 \x03(\x0e2\x18.ocsf.v1.Url.CategoryIdsR\vcategoryIds\x12\x16\n" + + "\x06domain\x18\x03 \x01(\tR\x06domain\x12\x1a\n" + + "\bhostname\x18\x04 \x01(\tR\bhostname\x12\x12\n" + + "\x04path\x18\x05 \x01(\tR\x04path\x12\x12\n" + + "\x04port\x18\x06 \x01(\x05R\x04port\x12!\n" + + "\fquery_string\x18\a \x01(\tR\vqueryString\x12#\n" + + "\rresource_type\x18\b \x01(\tR\fresourceType\x12\x16\n" + + "\x06scheme\x18\t \x01(\tR\x06scheme\x12\x1c\n" + + "\tsubdomain\x18\n" + + " \x01(\tR\tsubdomain\x12\x1d\n" + + "\n" + + "url_string\x18\v \x01(\tR\turlString\"\xa7\x17\n" + + "\vCategoryIds\x12\x18\n" + + "\x14CATEGORY_IDS_UNKNOWN\x10\x00\x12%\n" + + "!CATEGORY_IDS_ADULT_MATURE_CONTENT\x10\x01\x12\x1c\n" + + "\x18CATEGORY_IDS_PORNOGRAPHY\x10\x03\x12\x1e\n" + + "\x1aCATEGORY_IDS_SEX_EDUCATION\x10\x04\x12*\n" + + "&CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT\x10\x05\x12\x17\n" + + "\x13CATEGORY_IDS_NUDITY\x10\x06\x12\x18\n" + + "\x14CATEGORY_IDS_EXTREME\x10\a\x12*\n" + + "&CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL\x10\t\x12\x19\n" + + "\x15CATEGORY_IDS_GAMBLING\x10\v\x12%\n" + + "!CATEGORY_IDS_VIOLENCE_HATE_RACISM\x10\x0e\x12\x18\n" + + "\x14CATEGORY_IDS_WEAPONS\x10\x0f\x12\x19\n" + + "\x15CATEGORY_IDS_ABORTION\x10\x10\x12\x18\n" + + "\x14CATEGORY_IDS_HACKING\x10\x11\x12\x19\n" + + "\x15CATEGORY_IDS_PHISHING\x10\x12\x12\x1e\n" + + "\x1aCATEGORY_IDS_ENTERTAINMENT\x10\x14\x12!\n" + + "\x1dCATEGORY_IDS_BUSINESS_ECONOMY\x10\x15\x120\n" + + ",CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF\x10\x16\x12\x18\n" + + "\x14CATEGORY_IDS_ALCOHOL\x10\x17\x12\x18\n" + + "\x14CATEGORY_IDS_TOBACCO\x10\x18\x12&\n" + + "\"CATEGORY_IDS_CONTROLLED_SUBSTANCES\x10\x19\x12\"\n" + + "\x1eCATEGORY_IDS_CHILD_PORNOGRAPHY\x10\x1a\x12\x1a\n" + + "\x16CATEGORY_IDS_EDUCATION\x10\x1b\x12)\n" + + "%CATEGORY_IDS_CHARITABLE_ORGANIZATIONS\x10\x1d\x12\x1c\n" + + "\x18CATEGORY_IDS_ART_CULTURE\x10\x1e\x12#\n" + + "\x1fCATEGORY_IDS_FINANCIAL_SERVICES\x10\x1f\x12\"\n" + + "\x1eCATEGORY_IDS_BROKERAGE_TRADING\x10 \x12\x16\n" + + "\x12CATEGORY_IDS_GAMES\x10!\x12!\n" + + "\x1dCATEGORY_IDS_GOVERNMENT_LEGAL\x10\"\x12\x19\n" + + "\x15CATEGORY_IDS_MILITARY\x10#\x12*\n" + + "&CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY\x10$\x12\x17\n" + + "\x13CATEGORY_IDS_HEALTH\x10%\x12$\n" + + " CATEGORY_IDS_TECHNOLOGY_INTERNET\x10&\x12'\n" + + "#CATEGORY_IDS_SEARCH_ENGINES_PORTALS\x10(\x12*\n" + + "&CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS\x10+\x120\n" + + ",CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS\x10,\x12#\n" + + "\x1fCATEGORY_IDS_JOB_SEARCH_CAREERS\x10-\x12\x1b\n" + + "\x17CATEGORY_IDS_NEWS_MEDIA\x10.\x12!\n" + + "\x1dCATEGORY_IDS_PERSONALS_DATING\x10/\x12\x1a\n" + + "\x16CATEGORY_IDS_REFERENCE\x101\x120\n" + + ",CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT\x102\x12\x1c\n" + + "\x18CATEGORY_IDS_CHAT_IM_SMS\x103\x12\x16\n" + + "\x12CATEGORY_IDS_EMAIL\x104\x12\"\n" + + "\x1eCATEGORY_IDS_NEWSGROUPS_FORUMS\x105\x12\x19\n" + + "\x15CATEGORY_IDS_RELIGION\x106\x12\"\n" + + "\x1eCATEGORY_IDS_SOCIAL_NETWORKING\x107\x12%\n" + + "!CATEGORY_IDS_FILE_STORAGE_SHARING\x108\x12$\n" + + " CATEGORY_IDS_REMOTE_ACCESS_TOOLS\x109\x12\x19\n" + + "\x15CATEGORY_IDS_SHOPPING\x10:\x12\x19\n" + + "\x15CATEGORY_IDS_AUCTIONS\x10;\x12\x1c\n" + + "\x18CATEGORY_IDS_REAL_ESTATE\x10<\x12%\n" + + "!CATEGORY_IDS_SOCIETY_DAILY_LIVING\x10=\x12\x1f\n" + + "\x1bCATEGORY_IDS_PERSONAL_SITES\x10?\x12(\n" + + "$CATEGORY_IDS_RESTAURANTS_DINING_FOOD\x10@\x12\"\n" + + "\x1eCATEGORY_IDS_SPORTS_RECREATION\x10A\x12\x17\n" + + "\x13CATEGORY_IDS_TRAVEL\x10B\x12\x19\n" + + "\x15CATEGORY_IDS_VEHICLES\x10C\x12\x1c\n" + + "\x18CATEGORY_IDS_HUMOR_JOKES\x10D\x12#\n" + + "\x1fCATEGORY_IDS_SOFTWARE_DOWNLOADS\x10G\x12!\n" + + "\x1dCATEGORY_IDS_PEER_TO_PEER_P2P\x10S\x12\"\n" + + "\x1eCATEGORY_IDS_AUDIO_VIDEO_CLIPS\x10T\x12-\n" + + ")CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS\x10U\x12 \n" + + "\x1cCATEGORY_IDS_PROXY_AVOIDANCE\x10V\x12\x19\n" + + "\x15CATEGORY_IDS_FOR_KIDS\x10W\x12\"\n" + + "\x1eCATEGORY_IDS_WEB_ADS_ANALYTICS\x10X\x12\x1c\n" + + "\x18CATEGORY_IDS_WEB_HOSTING\x10Y\x12\x1e\n" + + "\x1aCATEGORY_IDS_UNCATEGORIZED\x10Z\x12\x1b\n" + + "\x17CATEGORY_IDS_SUSPICIOUS\x10\\\x12\"\n" + + "\x1eCATEGORY_IDS_SEXUAL_EXPRESSION\x10]\x12\x1c\n" + + "\x18CATEGORY_IDS_TRANSLATION\x10_\x12,\n" + + "(CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE\x10`\x12 \n" + + "\x1cCATEGORY_IDS_CONTENT_SERVERS\x10a\x12\x1d\n" + + "\x19CATEGORY_IDS_PLACEHOLDERS\x10b\x12\x16\n" + + "\x12CATEGORY_IDS_OTHER\x10c\x12\x15\n" + + "\x11CATEGORY_IDS_SPAM\x10e\x12.\n" + + "*CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE\x10f\x12!\n" + + "\x1dCATEGORY_IDS_DYNAMIC_DNS_HOST\x10g\x12#\n" + + "\x1fCATEGORY_IDS_E_CARD_INVITATIONS\x10j\x12\x1e\n" + + "\x1aCATEGORY_IDS_INFORMATIONAL\x10k\x12.\n" + + "*CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY\x10l\x12+\n" + + "'CATEGORY_IDS_INTERNET_CONNECTED_DEVICES\x10m\x12#\n" + + "\x1fCATEGORY_IDS_INTERNET_TELEPHONY\x10n\x12 \n" + + "\x1cCATEGORY_IDS_ONLINE_MEETINGS\x10o\x12\x1e\n" + + "\x1aCATEGORY_IDS_MEDIA_SHARING\x10p\x12$\n" + + " CATEGORY_IDS_RADIO_AUDIO_STREAMS\x10q\x12!\n" + + "\x1dCATEGORY_IDS_TV_VIDEO_STREAMS\x10r\x12*\n" + + "&CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS\x10v\x12\x1a\n" + + "\x16CATEGORY_IDS_MARIJUANA\x10y:o\xbaHl\x1aj\n" + + "\x10Url.at_least_one\x12.at least one of [path, url_string] must be set\x1a&has(this.path) || has(this.url_string)\"\xba\t\n" + + "\x04User\x12*\n" + + "\aaccount\x18\x01 \x01(\v2\x10.ocsf.v1.AccountR\aaccount\x12%\n" + + "\x0ecredential_uid\x18\x02 \x01(\tR\rcredentialUid\x12!\n" + + "\fdisplay_name\x18\x03 \x01(\tR\vdisplayName\x12\x16\n" + + "\x06domain\x18\x04 \x01(\tR\x06domain\x12\x1d\n" + + "\n" + + "email_addr\x18\x05 \x01(\tR\temailAddr\x12!\n" + + "\fforward_addr\x18\x06 \x01(\tR\vforwardAddr\x12\x1b\n" + + "\tfull_name\x18\a \x01(\tR\bfullName\x12&\n" + + "\x06groups\x18\b \x03(\v2\x0e.ocsf.v1.GroupR\x06groups\x12\x17\n" + + "\ahas_mfa\x18\t \x01(\bR\x06hasMfa\x124\n" + + "\vldap_person\x18\n" + + " \x01(\v2\x13.ocsf.v1.LdapPersonR\n" + + "ldapPerson\x12\x12\n" + + "\x04name\x18\v \x01(\tR\x04name\x12'\n" + + "\x03org\x18\f \x01(\v2\x15.ocsf.v1.OrganizationR\x03org\x12!\n" + + "\fphone_number\x18\r \x01(\tR\vphoneNumber\x12Z\n" + + "\x18programmatic_credentials\x18\x0e \x03(\v2\x1f.ocsf.v1.ProgrammaticCredentialR\x17programmaticCredentials\x12\x1d\n" + + "\n" + + "risk_level\x18\x0f \x01(\tR\triskLevel\x12=\n" + + "\rrisk_level_id\x18\x10 \x01(\x0e2\x19.ocsf.v1.User.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18\x11 \x01(\x05R\triskScore\x12\x12\n" + + "\x04type\x18\x12 \x01(\tR\x04type\x12-\n" + + "\atype_id\x18\x13 \x01(\x0e2\x14.ocsf.v1.User.TypeIdR\x06typeId\x12\x10\n" + + "\x03uid\x18\x14 \x01(\tR\x03uid\x12\x17\n" + + "\auid_alt\x18\x15 \x01(\tR\x06uidAlt\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"~\n" + + "\x06TypeId\x12\x13\n" + + "\x0fTYPE_ID_UNKNOWN\x10\x00\x12\x10\n" + + "\fTYPE_ID_USER\x10\x01\x12\x11\n" + + "\rTYPE_ID_ADMIN\x10\x02\x12\x12\n" + + "\x0eTYPE_ID_SYSTEM\x10\x03\x12\x13\n" + + "\x0fTYPE_ID_SERVICE\x10\x04\x12\x11\n" + + "\rTYPE_ID_OTHER\x10c:\x80\x01\xbaH}\x1a{\n" + + "\x11User.at_least_one\x120at least one of [account, name, uid] must be set\x1a4has(this.account) || has(this.name) || has(this.uid)\"\x97\r\n" + + "\rVulnerability\x12-\n" + + "\badvisory\x18\x01 \x01(\v2\x11.ocsf.v1.AdvisoryR\badvisory\x12:\n" + + "\raffected_code\x18\x02 \x03(\v2\x15.ocsf.v1.AffectedCodeR\faffectedCode\x12E\n" + + "\x11affected_packages\x18\x03 \x03(\v2\x18.ocsf.v1.AffectedPackageR\x10affectedPackages\x12\x1a\n" + + "\bcategory\x18\x04 \x01(\tR\bcategory\x12\x1e\n" + + "\x03cve\x18\x05 \x01(\v2\f.ocsf.v1.CveR\x03cve\x12\x1e\n" + + "\x03cwe\x18\x06 \x01(\v2\f.ocsf.v1.CweR\x03cwe\x12)\n" + + "\x10dependency_chain\x18\a \x01(\tR\x0fdependencyChain\x12\x12\n" + + "\x04desc\x18\b \x01(\tR\x04desc\x123\n" + + "\x16exploit_last_seen_time\x18\t \x01(\x03R\x13exploitLastSeenTime\x128\n" + + "\x19exploit_last_seen_time_dt\x18\n" + + " \x01(\tR\x15exploitLastSeenTimeDt\x12&\n" + + "\x0fexploit_ref_url\x18\v \x01(\tR\rexploitRefUrl\x12/\n" + + "\x13exploit_requirement\x18\f \x01(\tR\x12exploitRequirement\x12!\n" + + "\fexploit_type\x18\r \x01(\tR\vexploitType\x12&\n" + + "\x0ffirst_seen_time\x18\x0e \x01(\x03R\rfirstSeenTime\x12+\n" + + "\x12first_seen_time_dt\x18\x0f \x01(\tR\x0ffirstSeenTimeDt\x12#\n" + + "\rfix_available\x18\x10 \x01(\bR\ffixAvailable\x12!\n" + + "\ffix_coverage\x18\x11 \x01(\tR\vfixCoverage\x12L\n" + + "\x0ffix_coverage_id\x18\x12 \x01(\x0e2$.ocsf.v1.Vulnerability.FixCoverageIdR\rfixCoverageId\x120\n" + + "\x14is_exploit_available\x18\x13 \x01(\bR\x12isExploitAvailable\x12(\n" + + "\x10is_fix_available\x18\x14 \x01(\bR\x0eisFixAvailable\x12:\n" + + "\x0fkb_article_list\x18\x15 \x03(\v2\x12.ocsf.v1.KbArticleR\rkbArticleList\x12\x1f\n" + + "\vkb_articles\x18\x16 \x03(\tR\n" + + "kbArticles\x12$\n" + + "\x0elast_seen_time\x18\x17 \x01(\x03R\flastSeenTime\x12)\n" + + "\x11last_seen_time_dt\x18\x18 \x01(\tR\x0elastSeenTimeDt\x12,\n" + + "\bpackages\x18\x19 \x03(\v2\x10.ocsf.v1.PackageR\bpackages\x12\x1e\n" + + "\n" + + "references\x18\x1a \x03(\tR\n" + + "references\x127\n" + + "\x17related_vulnerabilities\x18\x1b \x03(\tR\x16relatedVulnerabilities\x126\n" + + "\vremediation\x18\x1c \x01(\v2\x14.ocsf.v1.RemediationR\vremediation\x12\x1a\n" + + "\bseverity\x18\x1d \x01(\tR\bseverity\x12\x14\n" + + "\x05title\x18\x1e \x01(\tR\x05title\x12\x1f\n" + + "\vvendor_name\x18\x1f \x01(\tR\n" + + "vendorName\"\x9c\x01\n" + + "\rFixCoverageId\x12\x1b\n" + + "\x17FIX_COVERAGE_ID_UNKNOWN\x10\x00\x12\x1c\n" + + "\x18FIX_COVERAGE_ID_COMPLETE\x10\x01\x12\x1b\n" + + "\x17FIX_COVERAGE_ID_PARTIAL\x10\x02\x12\x18\n" + + "\x14FIX_COVERAGE_ID_NONE\x10\x03\x12\x19\n" + + "\x15FIX_COVERAGE_ID_OTHER\x10c:\xa7\x01\xbaH\xa3\x01\x1a\xa0\x01\n" + + "\x16Vulnerability.just_one\x12/exactly one of [advisory, cve, cwe] must be set\x1aU(has(this.advisory) ? 1 : 0) + (has(this.cve) ? 1 : 0) + (has(this.cwe) ? 1 : 0) == 1\"\xb9\x06\n" + + "\x05Whois\x12F\n" + + "\x11autonomous_system\x18\x01 \x01(\v2\x19.ocsf.v1.AutonomousSystemR\x10autonomousSystem\x12!\n" + + "\fcreated_time\x18\x02 \x01(\x03R\vcreatedTime\x12&\n" + + "\x0fcreated_time_dt\x18\x03 \x01(\tR\rcreatedTimeDt\x12#\n" + + "\rdnssec_status\x18\x04 \x01(\tR\fdnssecStatus\x12G\n" + + "\x10dnssec_status_id\x18\x05 \x01(\x0e2\x1d.ocsf.v1.Whois.DnssecStatusIdR\x0ednssecStatusId\x12\x16\n" + + "\x06domain\x18\x06 \x01(\tR\x06domain\x12?\n" + + "\x0fdomain_contacts\x18\a \x03(\v2\x16.ocsf.v1.DomainContactR\x0edomainContacts\x12\x1d\n" + + "\n" + + "email_addr\x18\b \x01(\tR\temailAddr\x12\x10\n" + + "\x03isp\x18\t \x01(\tR\x03isp\x12\x17\n" + + "\aisp_org\x18\n" + + " \x01(\tR\x06ispOrg\x12$\n" + + "\x0elast_seen_time\x18\v \x01(\x03R\flastSeenTime\x12)\n" + + "\x11last_seen_time_dt\x18\f \x01(\tR\x0elastSeenTimeDt\x12!\n" + + "\fname_servers\x18\r \x03(\tR\vnameServers\x12!\n" + + "\fphone_number\x18\x0e \x01(\tR\vphoneNumber\x12\x1c\n" + + "\tregistrar\x18\x0f \x01(\tR\tregistrar\x12\x16\n" + + "\x06status\x18\x10 \x01(\tR\x06status\x12\x1e\n" + + "\n" + + "subdomains\x18\x11 \x03(\tR\n" + + "subdomains\x12\x16\n" + + "\x06subnet\x18\x12 \x01(\tR\x06subnet\"\x86\x01\n" + + "\x0eDnssecStatusId\x12\x1c\n" + + "\x18DNSSEC_STATUS_ID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x17DNSSEC_STATUS_ID_SIGNED\x10\x01\x12\x1d\n" + + "\x19DNSSEC_STATUS_ID_UNSIGNED\x10\x02\x12\x1a\n" + + "\x16DNSSEC_STATUS_ID_OTHER\x10c\"\x9b\x12\n" + + "\n" + + "WinService\x12\x19\n" + + "\bcmd_line\x18\x01 \x01(\tR\acmdLine\x12?\n" + + "\x0fhosting_process\x18\x02 \x01(\v2\x16.ocsf.v1.ProcessEntityR\x0ehostingProcess\x12\x16\n" + + "\x06labels\x18\x03 \x03(\tR\x06labels\x12(\n" + + "\x10load_order_group\x18\x04 \x01(\tR\x0eloadOrderGroup\x12\x1a\n" + + "\x04name\x18\x05 \x01(\tB\x06\xbaH\x03\xc8\x01\x01R\x04name\x12)\n" + + "\x10service_category\x18\x06 \x01(\tR\x0fserviceCategory\x12U\n" + + "\x13service_category_id\x18\a \x01(\x0e2%.ocsf.v1.WinService.ServiceCategoryIdR\x11serviceCategoryId\x121\n" + + "\x14service_dependencies\x18\b \x03(\tR\x13serviceDependencies\x127\n" + + "\x10service_dll_file\x18\t \x01(\v2\r.ocsf.v1.FileR\x0eserviceDllFile\x122\n" + + "\x15service_error_control\x18\n" + + " \x01(\tR\x13serviceErrorControl\x12b\n" + + "\x18service_error_control_id\x18\v \x01(\x0e2).ocsf.v1.WinService.ServiceErrorControlIdR\x15serviceErrorControlId\x120\n" + + "\fservice_file\x18\f \x01(\v2\r.ocsf.v1.FileR\vserviceFile\x12,\n" + + "\x12service_start_name\x18\r \x01(\tR\x10serviceStartName\x12,\n" + + "\x12service_start_type\x18\x0e \x01(\tR\x10serviceStartType\x12Y\n" + + "\x15service_start_type_id\x18\x0f \x01(\x0e2&.ocsf.v1.WinService.ServiceStartTypeIdR\x12serviceStartTypeId\x12!\n" + + "\fservice_type\x18\x10 \x01(\tR\vserviceType\x12I\n" + + "\x0fservice_type_id\x18\x11 \x01(\x0e2!.ocsf.v1.WinService.ServiceTypeIdR\rserviceTypeId\x12+\n" + + "\x04tags\x18\x12 \x03(\v2\x17.ocsf.v1.KeyValueObjectR\x04tags\x12\x10\n" + + "\x03uid\x18\x13 \x01(\tR\x03uid\x12\x18\n" + + "\aversion\x18\x14 \x01(\tR\aversion\"\x9b\x01\n" + + "\x11ServiceCategoryId\x12\x1f\n" + + "\x1bSERVICE_CATEGORY_ID_UNKNOWN\x10\x00\x12#\n" + + "\x1fSERVICE_CATEGORY_ID_KERNEL_MODE\x10\x01\x12!\n" + + "\x1dSERVICE_CATEGORY_ID_USER_MODE\x10\x02\x12\x1d\n" + + "\x19SERVICE_CATEGORY_ID_OTHER\x10c\"\xf7\x01\n" + + "\x15ServiceErrorControlId\x12$\n" + + " SERVICE_ERROR_CONTROL_ID_UNKNOWN\x10\x00\x12#\n" + + "\x1fSERVICE_ERROR_CONTROL_ID_IGNORE\x10\x01\x12#\n" + + "\x1fSERVICE_ERROR_CONTROL_ID_NORMAL\x10\x02\x12#\n" + + "\x1fSERVICE_ERROR_CONTROL_ID_SEVERE\x10\x03\x12%\n" + + "!SERVICE_ERROR_CONTROL_ID_CRITICAL\x10\x04\x12\"\n" + + "\x1eSERVICE_ERROR_CONTROL_ID_OTHER\x10c\"\x80\x02\n" + + "\x12ServiceStartTypeId\x12!\n" + + "\x1dSERVICE_START_TYPE_ID_UNKNOWN\x10\x00\x12\x1e\n" + + "\x1aSERVICE_START_TYPE_ID_BOOT\x10\x01\x12 \n" + + "\x1cSERVICE_START_TYPE_ID_SYSTEM\x10\x02\x12\x1e\n" + + "\x1aSERVICE_START_TYPE_ID_AUTO\x10\x03\x12 \n" + + "\x1cSERVICE_START_TYPE_ID_DEMAND\x10\x04\x12\"\n" + + "\x1eSERVICE_START_TYPE_ID_DISABLED\x10\x05\x12\x1f\n" + + "\x1bSERVICE_START_TYPE_ID_OTHER\x10c\"\xd6\x01\n" + + "\rServiceTypeId\x12\x1b\n" + + "\x17SERVICE_TYPE_ID_UNKNOWN\x10\x00\x12!\n" + + "\x1dSERVICE_TYPE_ID_KERNEL_DRIVER\x10\x01\x12&\n" + + "\"SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER\x10\x02\x12\x1f\n" + + "\x1bSERVICE_TYPE_ID_OWN_PROCESS\x10\x03\x12!\n" + + "\x1dSERVICE_TYPE_ID_SHARE_PROCESS\x10\x04\x12\x19\n" + + "\x15SERVICE_TYPE_ID_OTHER\x10c:\xa8\x03\xbaH\xa4\x03\x1a\xa1\x03\n" + + "\x17WinService.at_least_one\x12\xa7\x01at least one of [cmd_line, service_category_id, service_dependencies, service_error_control_id, service_start_name, service_start_type_id, service_type_id] must be set\x1a\xdb\x01has(this.cmd_line) || has(this.service_category_id) || has(this.service_dependencies) || has(this.service_error_control_id) || has(this.service_start_name) || has(this.service_start_type_id) || has(this.service_type_id)b\x06proto3" + +var ( + file_api_entity_proto_rawDescOnce sync.Once + file_api_entity_proto_rawDescData []byte +) + +func file_api_entity_proto_rawDescGZIP() []byte { + file_api_entity_proto_rawDescOnce.Do(func() { + file_api_entity_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_entity_proto_rawDesc), len(file_api_entity_proto_rawDesc))) + }) + return file_api_entity_proto_rawDescData +} + +var file_api_entity_proto_enumTypes = make([]protoimpl.EnumInfo, 88) +var file_api_entity_proto_msgTypes = make([]protoimpl.MessageInfo, 116) +var file_api_entity_proto_goTypes = []any{ + (ApiActivity_ActionId)(0), // 0: ocsf.v1.ApiActivity.ActionId + (ApiActivity_ActivityId)(0), // 1: ocsf.v1.ApiActivity.ActivityId + (ApiActivity_CategoryUid)(0), // 2: ocsf.v1.ApiActivity.CategoryUid + (ApiActivity_ClassUid)(0), // 3: ocsf.v1.ApiActivity.ClassUid + (ApiActivity_ConfidenceId)(0), // 4: ocsf.v1.ApiActivity.ConfidenceId + (ApiActivity_DispositionId)(0), // 5: ocsf.v1.ApiActivity.DispositionId + (ApiActivity_RiskLevelId)(0), // 6: ocsf.v1.ApiActivity.RiskLevelId + (ApiActivity_SeverityId)(0), // 7: ocsf.v1.ApiActivity.SeverityId + (ApiActivity_StatusId)(0), // 8: ocsf.v1.ApiActivity.StatusId + (ApiActivity_TypeUid)(0), // 9: ocsf.v1.ApiActivity.TypeUid + (EntityManagement_ActionId)(0), // 10: ocsf.v1.EntityManagement.ActionId + (EntityManagement_ActivityId)(0), // 11: ocsf.v1.EntityManagement.ActivityId + (EntityManagement_CategoryUid)(0), // 12: ocsf.v1.EntityManagement.CategoryUid + (EntityManagement_ClassUid)(0), // 13: ocsf.v1.EntityManagement.ClassUid + (EntityManagement_ConfidenceId)(0), // 14: ocsf.v1.EntityManagement.ConfidenceId + (EntityManagement_DispositionId)(0), // 15: ocsf.v1.EntityManagement.DispositionId + (EntityManagement_RiskLevelId)(0), // 16: ocsf.v1.EntityManagement.RiskLevelId + (EntityManagement_SeverityId)(0), // 17: ocsf.v1.EntityManagement.SeverityId + (EntityManagement_StatusId)(0), // 18: ocsf.v1.EntityManagement.StatusId + (EntityManagement_TypeUid)(0), // 19: ocsf.v1.EntityManagement.TypeUid + (Account_TypeId)(0), // 20: ocsf.v1.Account.TypeId + (Advisory_InstallStateId)(0), // 21: ocsf.v1.Advisory.InstallStateId + (AffectedPackage_TypeId)(0), // 22: ocsf.v1.AffectedPackage.TypeId + (Agent_TypeId)(0), // 23: ocsf.v1.Agent.TypeId + (Analytic_StateId)(0), // 24: ocsf.v1.Analytic.StateId + (Analytic_TypeId)(0), // 25: ocsf.v1.Analytic.TypeId + (Application_RiskLevelId)(0), // 26: ocsf.v1.Application.RiskLevelId + (AuthFactor_FactorTypeId)(0), // 27: ocsf.v1.AuthFactor.FactorTypeId + (DataClassification_CategoryId)(0), // 28: ocsf.v1.DataClassification.CategoryId + (DataClassification_ConfidentialityId)(0), // 29: ocsf.v1.DataClassification.ConfidentialityId + (DataClassification_StatusId)(0), // 30: ocsf.v1.DataClassification.StatusId + (Device_RiskLevelId)(0), // 31: ocsf.v1.Device.RiskLevelId + (Device_TypeId)(0), // 32: ocsf.v1.Device.TypeId + (DeviceHwInfo_CpuArchitectureId)(0), // 33: ocsf.v1.DeviceHwInfo.CpuArchitectureId + (DigitalSignature_AlgorithmId)(0), // 34: ocsf.v1.DigitalSignature.AlgorithmId + (DigitalSignature_StateId)(0), // 35: ocsf.v1.DigitalSignature.StateId + (DnsAnswer_FlagIds)(0), // 36: ocsf.v1.DnsAnswer.FlagIds + (DomainContact_TypeId)(0), // 37: ocsf.v1.DomainContact.TypeId + (EncryptionDetails_AlgorithmId)(0), // 38: ocsf.v1.EncryptionDetails.AlgorithmId + (File_ConfidentialityId)(0), // 39: ocsf.v1.File.ConfidentialityId + (File_DriveTypeId)(0), // 40: ocsf.v1.File.DriveTypeId + (File_TypeId)(0), // 41: ocsf.v1.File.TypeId + (Fingerprint_AlgorithmId)(0), // 42: ocsf.v1.Fingerprint.AlgorithmId + (GpuInfo_BusTypeId)(0), // 43: ocsf.v1.GpuInfo.BusTypeId + (GpuInfo_VramModeId)(0), // 44: ocsf.v1.GpuInfo.VramModeId + (Graph_QueryLanguageId)(0), // 45: ocsf.v1.Graph.QueryLanguageId + (Idp_StateId)(0), // 46: ocsf.v1.Idp.StateId + (KbArticle_InstallStateId)(0), // 47: ocsf.v1.KbArticle.InstallStateId + (KillChainPhase_PhaseId)(0), // 48: ocsf.v1.KillChainPhase.PhaseId + (Malware_ClassificationIds)(0), // 49: ocsf.v1.Malware.ClassificationIds + (Malware_SeverityId)(0), // 50: ocsf.v1.Malware.SeverityId + (MalwareScanInfo_TypeId)(0), // 51: ocsf.v1.MalwareScanInfo.TypeId + (ManagedEntity_TypeId)(0), // 52: ocsf.v1.ManagedEntity.TypeId + (MessageContext_AiRoleId)(0), // 53: ocsf.v1.MessageContext.AiRoleId + (NetworkEndpoint_NetworkScopeId)(0), // 54: ocsf.v1.NetworkEndpoint.NetworkScopeId + (NetworkEndpoint_TypeId)(0), // 55: ocsf.v1.NetworkEndpoint.TypeId + (NetworkInterface_TypeId)(0), // 56: ocsf.v1.NetworkInterface.TypeId + (NetworkProxy_NetworkScopeId)(0), // 57: ocsf.v1.NetworkProxy.NetworkScopeId + (NetworkProxy_TypeId)(0), // 58: ocsf.v1.NetworkProxy.TypeId + (Observable_TypeId)(0), // 59: ocsf.v1.Observable.TypeId + (Os_TypeId)(0), // 60: ocsf.v1.Os.TypeId + (Osint_ConfidenceId)(0), // 61: ocsf.v1.Osint.ConfidenceId + (Osint_DetectionPatternTypeId)(0), // 62: ocsf.v1.Osint.DetectionPatternTypeId + (Osint_SeverityId)(0), // 63: ocsf.v1.Osint.SeverityId + (Osint_TypeId)(0), // 64: ocsf.v1.Osint.TypeId + (Package_TypeId)(0), // 65: ocsf.v1.Package.TypeId + (Process_IntegrityId)(0), // 66: ocsf.v1.Process.IntegrityId + (Reputation_ScoreId)(0), // 67: ocsf.v1.Reputation.ScoreId + (ResourceDetails_RoleId)(0), // 68: ocsf.v1.ResourceDetails.RoleId + (Sbom_TypeId)(0), // 69: ocsf.v1.Sbom.TypeId + (Scim_AuthProtocolId)(0), // 70: ocsf.v1.Scim.AuthProtocolId + (Scim_StateId)(0), // 71: ocsf.v1.Scim.StateId + (Script_TypeId)(0), // 72: ocsf.v1.Script.TypeId + (SoftwareComponent_RelationshipId)(0), // 73: ocsf.v1.SoftwareComponent.RelationshipId + (SoftwareComponent_TypeId)(0), // 74: ocsf.v1.SoftwareComponent.TypeId + (Sso_AuthProtocolId)(0), // 75: ocsf.v1.Sso.AuthProtocolId + (ThreatActor_TypeId)(0), // 76: ocsf.v1.ThreatActor.TypeId + (Timespan_TypeId)(0), // 77: ocsf.v1.Timespan.TypeId + (Token_TypeId)(0), // 78: ocsf.v1.Token.TypeId + (Url_CategoryIds)(0), // 79: ocsf.v1.Url.CategoryIds + (User_RiskLevelId)(0), // 80: ocsf.v1.User.RiskLevelId + (User_TypeId)(0), // 81: ocsf.v1.User.TypeId + (Vulnerability_FixCoverageId)(0), // 82: ocsf.v1.Vulnerability.FixCoverageId + (Whois_DnssecStatusId)(0), // 83: ocsf.v1.Whois.DnssecStatusId + (WinService_ServiceCategoryId)(0), // 84: ocsf.v1.WinService.ServiceCategoryId + (WinService_ServiceErrorControlId)(0), // 85: ocsf.v1.WinService.ServiceErrorControlId + (WinService_ServiceStartTypeId)(0), // 86: ocsf.v1.WinService.ServiceStartTypeId + (WinService_ServiceTypeId)(0), // 87: ocsf.v1.WinService.ServiceTypeId + (*ApiActivity)(nil), // 88: ocsf.v1.ApiActivity + (*EntityManagement)(nil), // 89: ocsf.v1.EntityManagement + (*Account)(nil), // 90: ocsf.v1.Account + (*Actor)(nil), // 91: ocsf.v1.Actor + (*Advisory)(nil), // 92: ocsf.v1.Advisory + (*AffectedCode)(nil), // 93: ocsf.v1.AffectedCode + (*AffectedPackage)(nil), // 94: ocsf.v1.AffectedPackage + (*Agent)(nil), // 95: ocsf.v1.Agent + (*AiModel)(nil), // 96: ocsf.v1.AiModel + (*Analytic)(nil), // 97: ocsf.v1.Analytic + (*Api)(nil), // 98: ocsf.v1.Api + (*Application)(nil), // 99: ocsf.v1.Application + (*Attack)(nil), // 100: ocsf.v1.Attack + (*AuthFactor)(nil), // 101: ocsf.v1.AuthFactor + (*Authorization)(nil), // 102: ocsf.v1.Authorization + (*AutonomousSystem)(nil), // 103: ocsf.v1.AutonomousSystem + (*Campaign)(nil), // 104: ocsf.v1.Campaign + (*Certificate)(nil), // 105: ocsf.v1.Certificate + (*CisControl)(nil), // 106: ocsf.v1.CisControl + (*ClassifierDetails)(nil), // 107: ocsf.v1.ClassifierDetails + (*Cloud)(nil), // 108: ocsf.v1.Cloud + (*Container)(nil), // 109: ocsf.v1.Container + (*Cve)(nil), // 110: ocsf.v1.Cve + (*Cvss)(nil), // 111: ocsf.v1.Cvss + (*Cwe)(nil), // 112: ocsf.v1.Cwe + (*D3FTactic)(nil), // 113: ocsf.v1.D3fTactic + (*D3FTechnique)(nil), // 114: ocsf.v1.D3fTechnique + (*D3Fend)(nil), // 115: ocsf.v1.D3fend + (*DataClassification)(nil), // 116: ocsf.v1.DataClassification + (*Device)(nil), // 117: ocsf.v1.Device + (*DeviceHwInfo)(nil), // 118: ocsf.v1.DeviceHwInfo + (*DigitalSignature)(nil), // 119: ocsf.v1.DigitalSignature + (*DiscoveryDetails)(nil), // 120: ocsf.v1.DiscoveryDetails + (*Display)(nil), // 121: ocsf.v1.Display + (*DnsAnswer)(nil), // 122: ocsf.v1.DnsAnswer + (*DomainContact)(nil), // 123: ocsf.v1.DomainContact + (*Edge)(nil), // 124: ocsf.v1.Edge + (*Email)(nil), // 125: ocsf.v1.Email + (*EmailAuth)(nil), // 126: ocsf.v1.EmailAuth + (*EncryptionDetails)(nil), // 127: ocsf.v1.EncryptionDetails + (*Enrichment)(nil), // 128: ocsf.v1.Enrichment + (*EnvironmentVariable)(nil), // 129: ocsf.v1.EnvironmentVariable + (*Epss)(nil), // 130: ocsf.v1.Epss + (*Extension)(nil), // 131: ocsf.v1.Extension + (*Feature)(nil), // 132: ocsf.v1.Feature + (*File)(nil), // 133: ocsf.v1.File + (*Fingerprint)(nil), // 134: ocsf.v1.Fingerprint + (*FirewallRule)(nil), // 135: ocsf.v1.FirewallRule + (*GpuInfo)(nil), // 136: ocsf.v1.GpuInfo + (*Graph)(nil), // 137: ocsf.v1.Graph + (*Group)(nil), // 138: ocsf.v1.Group + (*HttpHeader)(nil), // 139: ocsf.v1.HttpHeader + (*HttpRequest)(nil), // 140: ocsf.v1.HttpRequest + (*HttpResponse)(nil), // 141: ocsf.v1.HttpResponse + (*Idp)(nil), // 142: ocsf.v1.Idp + (*Image)(nil), // 143: ocsf.v1.Image + (*KbArticle)(nil), // 144: ocsf.v1.KbArticle + (*KeyValueObject)(nil), // 145: ocsf.v1.KeyValueObject + (*KeyboardInfo)(nil), // 146: ocsf.v1.KeyboardInfo + (*KillChainPhase)(nil), // 147: ocsf.v1.KillChainPhase + (*LdapPerson)(nil), // 148: ocsf.v1.LdapPerson + (*Location)(nil), // 149: ocsf.v1.Location + (*Logger)(nil), // 150: ocsf.v1.Logger + (*LongString)(nil), // 151: ocsf.v1.LongString + (*Malware)(nil), // 152: ocsf.v1.Malware + (*MalwareScanInfo)(nil), // 153: ocsf.v1.MalwareScanInfo + (*ManagedEntity)(nil), // 154: ocsf.v1.ManagedEntity + (*MessageContext)(nil), // 155: ocsf.v1.MessageContext + (*Metadata)(nil), // 156: ocsf.v1.Metadata + (*Metric)(nil), // 157: ocsf.v1.Metric + (*Mitigation)(nil), // 158: ocsf.v1.Mitigation + (*NetworkEndpoint)(nil), // 159: ocsf.v1.NetworkEndpoint + (*NetworkInterface)(nil), // 160: ocsf.v1.NetworkInterface + (*NetworkProxy)(nil), // 161: ocsf.v1.NetworkProxy + (*Node)(nil), // 162: ocsf.v1.Node + (*Observable)(nil), // 163: ocsf.v1.Observable + (*OccurrenceDetails)(nil), // 164: ocsf.v1.OccurrenceDetails + (*Organization)(nil), // 165: ocsf.v1.Organization + (*Os)(nil), // 166: ocsf.v1.Os + (*Osint)(nil), // 167: ocsf.v1.Osint + (*Package)(nil), // 168: ocsf.v1.Package + (*Policy)(nil), // 169: ocsf.v1.Policy + (*PortInfo)(nil), // 170: ocsf.v1.PortInfo + (*Process)(nil), // 171: ocsf.v1.Process + (*ProcessEntity)(nil), // 172: ocsf.v1.ProcessEntity + (*Product)(nil), // 173: ocsf.v1.Product + (*ProgrammaticCredential)(nil), // 174: ocsf.v1.ProgrammaticCredential + (*Remediation)(nil), // 175: ocsf.v1.Remediation + (*Reporter)(nil), // 176: ocsf.v1.Reporter + (*Reputation)(nil), // 177: ocsf.v1.Reputation + (*Request)(nil), // 178: ocsf.v1.Request + (*ResourceDetails)(nil), // 179: ocsf.v1.ResourceDetails + (*Response)(nil), // 180: ocsf.v1.Response + (*Rule)(nil), // 181: ocsf.v1.Rule + (*San)(nil), // 182: ocsf.v1.San + (*Sbom)(nil), // 183: ocsf.v1.Sbom + (*Scim)(nil), // 184: ocsf.v1.Scim + (*Script)(nil), // 185: ocsf.v1.Script + (*Service)(nil), // 186: ocsf.v1.Service + (*Session)(nil), // 187: ocsf.v1.Session + (*SoftwareComponent)(nil), // 188: ocsf.v1.SoftwareComponent + (*Span)(nil), // 189: ocsf.v1.Span + (*Sso)(nil), // 190: ocsf.v1.Sso + (*SubTechnique)(nil), // 191: ocsf.v1.SubTechnique + (*Tactic)(nil), // 192: ocsf.v1.Tactic + (*Technique)(nil), // 193: ocsf.v1.Technique + (*ThreatActor)(nil), // 194: ocsf.v1.ThreatActor + (*Timespan)(nil), // 195: ocsf.v1.Timespan + (*Token)(nil), // 196: ocsf.v1.Token + (*Trace)(nil), // 197: ocsf.v1.Trace + (*TransformationInfo)(nil), // 198: ocsf.v1.TransformationInfo + (*Url)(nil), // 199: ocsf.v1.Url + (*User)(nil), // 200: ocsf.v1.User + (*Vulnerability)(nil), // 201: ocsf.v1.Vulnerability + (*Whois)(nil), // 202: ocsf.v1.Whois + (*WinService)(nil), // 203: ocsf.v1.WinService + (*structpb.Value)(nil), // 204: google.protobuf.Value +} +var file_api_entity_proto_depIdxs = []int32{ + 0, // 0: ocsf.v1.ApiActivity.action_id:type_name -> ocsf.v1.ApiActivity.ActionId + 1, // 1: ocsf.v1.ApiActivity.activity_id:type_name -> ocsf.v1.ApiActivity.ActivityId + 91, // 2: ocsf.v1.ApiActivity.actor:type_name -> ocsf.v1.Actor + 96, // 3: ocsf.v1.ApiActivity.ai_model:type_name -> ocsf.v1.AiModel + 98, // 4: ocsf.v1.ApiActivity.api:type_name -> ocsf.v1.Api + 100, // 5: ocsf.v1.ApiActivity.attacks:type_name -> ocsf.v1.Attack + 102, // 6: ocsf.v1.ApiActivity.authorizations:type_name -> ocsf.v1.Authorization + 2, // 7: ocsf.v1.ApiActivity.category_uid:type_name -> ocsf.v1.ApiActivity.CategoryUid + 3, // 8: ocsf.v1.ApiActivity.class_uid:type_name -> ocsf.v1.ApiActivity.ClassUid + 108, // 9: ocsf.v1.ApiActivity.cloud:type_name -> ocsf.v1.Cloud + 4, // 10: ocsf.v1.ApiActivity.confidence_id:type_name -> ocsf.v1.ApiActivity.ConfidenceId + 117, // 11: ocsf.v1.ApiActivity.device:type_name -> ocsf.v1.Device + 5, // 12: ocsf.v1.ApiActivity.disposition_id:type_name -> ocsf.v1.ApiActivity.DispositionId + 159, // 13: ocsf.v1.ApiActivity.dst_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 128, // 14: ocsf.v1.ApiActivity.enrichments:type_name -> ocsf.v1.Enrichment + 135, // 15: ocsf.v1.ApiActivity.firewall_rule:type_name -> ocsf.v1.FirewallRule + 140, // 16: ocsf.v1.ApiActivity.http_request:type_name -> ocsf.v1.HttpRequest + 141, // 17: ocsf.v1.ApiActivity.http_response:type_name -> ocsf.v1.HttpResponse + 152, // 18: ocsf.v1.ApiActivity.malware:type_name -> ocsf.v1.Malware + 153, // 19: ocsf.v1.ApiActivity.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo + 155, // 20: ocsf.v1.ApiActivity.message_context:type_name -> ocsf.v1.MessageContext + 156, // 21: ocsf.v1.ApiActivity.metadata:type_name -> ocsf.v1.Metadata + 163, // 22: ocsf.v1.ApiActivity.observables:type_name -> ocsf.v1.Observable + 167, // 23: ocsf.v1.ApiActivity.osint:type_name -> ocsf.v1.Osint + 169, // 24: ocsf.v1.ApiActivity.policy:type_name -> ocsf.v1.Policy + 134, // 25: ocsf.v1.ApiActivity.raw_data_hash:type_name -> ocsf.v1.Fingerprint + 179, // 26: ocsf.v1.ApiActivity.resources:type_name -> ocsf.v1.ResourceDetails + 6, // 27: ocsf.v1.ApiActivity.risk_level_id:type_name -> ocsf.v1.ApiActivity.RiskLevelId + 7, // 28: ocsf.v1.ApiActivity.severity_id:type_name -> ocsf.v1.ApiActivity.SeverityId + 159, // 29: ocsf.v1.ApiActivity.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 8, // 30: ocsf.v1.ApiActivity.status_id:type_name -> ocsf.v1.ApiActivity.StatusId + 197, // 31: ocsf.v1.ApiActivity.trace:type_name -> ocsf.v1.Trace + 9, // 32: ocsf.v1.ApiActivity.type_uid:type_name -> ocsf.v1.ApiActivity.TypeUid + 204, // 33: ocsf.v1.ApiActivity.unmapped:type_name -> google.protobuf.Value + 10, // 34: ocsf.v1.EntityManagement.action_id:type_name -> ocsf.v1.EntityManagement.ActionId + 11, // 35: ocsf.v1.EntityManagement.activity_id:type_name -> ocsf.v1.EntityManagement.ActivityId + 91, // 36: ocsf.v1.EntityManagement.actor:type_name -> ocsf.v1.Actor + 98, // 37: ocsf.v1.EntityManagement.api:type_name -> ocsf.v1.Api + 100, // 38: ocsf.v1.EntityManagement.attacks:type_name -> ocsf.v1.Attack + 102, // 39: ocsf.v1.EntityManagement.authorizations:type_name -> ocsf.v1.Authorization + 12, // 40: ocsf.v1.EntityManagement.category_uid:type_name -> ocsf.v1.EntityManagement.CategoryUid + 13, // 41: ocsf.v1.EntityManagement.class_uid:type_name -> ocsf.v1.EntityManagement.ClassUid + 108, // 42: ocsf.v1.EntityManagement.cloud:type_name -> ocsf.v1.Cloud + 14, // 43: ocsf.v1.EntityManagement.confidence_id:type_name -> ocsf.v1.EntityManagement.ConfidenceId + 117, // 44: ocsf.v1.EntityManagement.device:type_name -> ocsf.v1.Device + 15, // 45: ocsf.v1.EntityManagement.disposition_id:type_name -> ocsf.v1.EntityManagement.DispositionId + 128, // 46: ocsf.v1.EntityManagement.enrichments:type_name -> ocsf.v1.Enrichment + 154, // 47: ocsf.v1.EntityManagement.entity:type_name -> ocsf.v1.ManagedEntity + 154, // 48: ocsf.v1.EntityManagement.entity_result:type_name -> ocsf.v1.ManagedEntity + 135, // 49: ocsf.v1.EntityManagement.firewall_rule:type_name -> ocsf.v1.FirewallRule + 140, // 50: ocsf.v1.EntityManagement.http_request:type_name -> ocsf.v1.HttpRequest + 141, // 51: ocsf.v1.EntityManagement.http_response:type_name -> ocsf.v1.HttpResponse + 152, // 52: ocsf.v1.EntityManagement.malware:type_name -> ocsf.v1.Malware + 153, // 53: ocsf.v1.EntityManagement.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo + 156, // 54: ocsf.v1.EntityManagement.metadata:type_name -> ocsf.v1.Metadata + 163, // 55: ocsf.v1.EntityManagement.observables:type_name -> ocsf.v1.Observable + 167, // 56: ocsf.v1.EntityManagement.osint:type_name -> ocsf.v1.Osint + 169, // 57: ocsf.v1.EntityManagement.policy:type_name -> ocsf.v1.Policy + 134, // 58: ocsf.v1.EntityManagement.raw_data_hash:type_name -> ocsf.v1.Fingerprint + 16, // 59: ocsf.v1.EntityManagement.risk_level_id:type_name -> ocsf.v1.EntityManagement.RiskLevelId + 17, // 60: ocsf.v1.EntityManagement.severity_id:type_name -> ocsf.v1.EntityManagement.SeverityId + 159, // 61: ocsf.v1.EntityManagement.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 18, // 62: ocsf.v1.EntityManagement.status_id:type_name -> ocsf.v1.EntityManagement.StatusId + 19, // 63: ocsf.v1.EntityManagement.type_uid:type_name -> ocsf.v1.EntityManagement.TypeUid + 204, // 64: ocsf.v1.EntityManagement.unmapped:type_name -> google.protobuf.Value + 145, // 65: ocsf.v1.Account.tags:type_name -> ocsf.v1.KeyValueObject + 20, // 66: ocsf.v1.Account.type_id:type_name -> ocsf.v1.Account.TypeId + 102, // 67: ocsf.v1.Actor.authorizations:type_name -> ocsf.v1.Authorization + 142, // 68: ocsf.v1.Actor.idp:type_name -> ocsf.v1.Idp + 171, // 69: ocsf.v1.Actor.process:type_name -> ocsf.v1.Process + 187, // 70: ocsf.v1.Actor.session:type_name -> ocsf.v1.Session + 200, // 71: ocsf.v1.Actor.user:type_name -> ocsf.v1.User + 195, // 72: ocsf.v1.Advisory.avg_timespan:type_name -> ocsf.v1.Timespan + 21, // 73: ocsf.v1.Advisory.install_state_id:type_name -> ocsf.v1.Advisory.InstallStateId + 166, // 74: ocsf.v1.Advisory.os:type_name -> ocsf.v1.Os + 173, // 75: ocsf.v1.Advisory.product:type_name -> ocsf.v1.Product + 110, // 76: ocsf.v1.Advisory.related_cves:type_name -> ocsf.v1.Cve + 112, // 77: ocsf.v1.Advisory.related_cwes:type_name -> ocsf.v1.Cwe + 133, // 78: ocsf.v1.AffectedCode.file:type_name -> ocsf.v1.File + 200, // 79: ocsf.v1.AffectedCode.owner:type_name -> ocsf.v1.User + 175, // 80: ocsf.v1.AffectedCode.remediation:type_name -> ocsf.v1.Remediation + 181, // 81: ocsf.v1.AffectedCode.rule:type_name -> ocsf.v1.Rule + 134, // 82: ocsf.v1.AffectedPackage.hash:type_name -> ocsf.v1.Fingerprint + 175, // 83: ocsf.v1.AffectedPackage.remediation:type_name -> ocsf.v1.Remediation + 22, // 84: ocsf.v1.AffectedPackage.type_id:type_name -> ocsf.v1.AffectedPackage.TypeId + 169, // 85: ocsf.v1.Agent.policies:type_name -> ocsf.v1.Policy + 23, // 86: ocsf.v1.Agent.type_id:type_name -> ocsf.v1.Agent.TypeId + 97, // 87: ocsf.v1.Analytic.related_analytics:type_name -> ocsf.v1.Analytic + 24, // 88: ocsf.v1.Analytic.state_id:type_name -> ocsf.v1.Analytic.StateId + 25, // 89: ocsf.v1.Analytic.type_id:type_name -> ocsf.v1.Analytic.TypeId + 138, // 90: ocsf.v1.Api.group:type_name -> ocsf.v1.Group + 178, // 91: ocsf.v1.Api.request:type_name -> ocsf.v1.Request + 180, // 92: ocsf.v1.Api.response:type_name -> ocsf.v1.Response + 186, // 93: ocsf.v1.Api.service:type_name -> ocsf.v1.Service + 196, // 94: ocsf.v1.Api.token:type_name -> ocsf.v1.Token + 204, // 95: ocsf.v1.Application.data:type_name -> google.protobuf.Value + 138, // 96: ocsf.v1.Application.group:type_name -> ocsf.v1.Group + 200, // 97: ocsf.v1.Application.owner:type_name -> ocsf.v1.User + 137, // 98: ocsf.v1.Application.resource_relationship:type_name -> ocsf.v1.Graph + 26, // 99: ocsf.v1.Application.risk_level_id:type_name -> ocsf.v1.Application.RiskLevelId + 183, // 100: ocsf.v1.Application.sbom:type_name -> ocsf.v1.Sbom + 145, // 101: ocsf.v1.Application.tags:type_name -> ocsf.v1.KeyValueObject + 199, // 102: ocsf.v1.Application.url:type_name -> ocsf.v1.Url + 158, // 103: ocsf.v1.Attack.mitigation:type_name -> ocsf.v1.Mitigation + 191, // 104: ocsf.v1.Attack.sub_technique:type_name -> ocsf.v1.SubTechnique + 192, // 105: ocsf.v1.Attack.tactic:type_name -> ocsf.v1.Tactic + 192, // 106: ocsf.v1.Attack.tactics:type_name -> ocsf.v1.Tactic + 193, // 107: ocsf.v1.Attack.technique:type_name -> ocsf.v1.Technique + 117, // 108: ocsf.v1.AuthFactor.device:type_name -> ocsf.v1.Device + 27, // 109: ocsf.v1.AuthFactor.factor_type_id:type_name -> ocsf.v1.AuthFactor.FactorTypeId + 169, // 110: ocsf.v1.Authorization.policy:type_name -> ocsf.v1.Policy + 134, // 111: ocsf.v1.Certificate.fingerprints:type_name -> ocsf.v1.Fingerprint + 182, // 112: ocsf.v1.Certificate.sans:type_name -> ocsf.v1.San + 90, // 113: ocsf.v1.Cloud.account:type_name -> ocsf.v1.Account + 165, // 114: ocsf.v1.Cloud.org:type_name -> ocsf.v1.Organization + 134, // 115: ocsf.v1.Container.hash:type_name -> ocsf.v1.Fingerprint + 143, // 116: ocsf.v1.Container.image:type_name -> ocsf.v1.Image + 145, // 117: ocsf.v1.Container.tags:type_name -> ocsf.v1.KeyValueObject + 111, // 118: ocsf.v1.Cve.cvss:type_name -> ocsf.v1.Cvss + 112, // 119: ocsf.v1.Cve.cwe:type_name -> ocsf.v1.Cwe + 130, // 120: ocsf.v1.Cve.epss:type_name -> ocsf.v1.Epss + 173, // 121: ocsf.v1.Cve.product:type_name -> ocsf.v1.Product + 112, // 122: ocsf.v1.Cve.related_cwes:type_name -> ocsf.v1.Cwe + 157, // 123: ocsf.v1.Cvss.metrics:type_name -> ocsf.v1.Metric + 113, // 124: ocsf.v1.D3fend.d3f_tactic:type_name -> ocsf.v1.D3fTactic + 114, // 125: ocsf.v1.D3fend.d3f_technique:type_name -> ocsf.v1.D3fTechnique + 28, // 126: ocsf.v1.DataClassification.category_id:type_name -> ocsf.v1.DataClassification.CategoryId + 107, // 127: ocsf.v1.DataClassification.classifier_details:type_name -> ocsf.v1.ClassifierDetails + 29, // 128: ocsf.v1.DataClassification.confidentiality_id:type_name -> ocsf.v1.DataClassification.ConfidentialityId + 120, // 129: ocsf.v1.DataClassification.discovery_details:type_name -> ocsf.v1.DiscoveryDetails + 169, // 130: ocsf.v1.DataClassification.policy:type_name -> ocsf.v1.Policy + 30, // 131: ocsf.v1.DataClassification.status_id:type_name -> ocsf.v1.DataClassification.StatusId + 95, // 132: ocsf.v1.Device.agent_list:type_name -> ocsf.v1.Agent + 109, // 133: ocsf.v1.Device.container:type_name -> ocsf.v1.Container + 138, // 134: ocsf.v1.Device.groups:type_name -> ocsf.v1.Group + 118, // 135: ocsf.v1.Device.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 143, // 136: ocsf.v1.Device.image:type_name -> ocsf.v1.Image + 149, // 137: ocsf.v1.Device.location:type_name -> ocsf.v1.Location + 160, // 138: ocsf.v1.Device.network_interfaces:type_name -> ocsf.v1.NetworkInterface + 165, // 139: ocsf.v1.Device.org:type_name -> ocsf.v1.Organization + 166, // 140: ocsf.v1.Device.os:type_name -> ocsf.v1.Os + 200, // 141: ocsf.v1.Device.owner:type_name -> ocsf.v1.User + 138, // 142: ocsf.v1.Device.pool:type_name -> ocsf.v1.Group + 31, // 143: ocsf.v1.Device.risk_level_id:type_name -> ocsf.v1.Device.RiskLevelId + 32, // 144: ocsf.v1.Device.type_id:type_name -> ocsf.v1.Device.TypeId + 33, // 145: ocsf.v1.DeviceHwInfo.cpu_architecture_id:type_name -> ocsf.v1.DeviceHwInfo.CpuArchitectureId + 121, // 146: ocsf.v1.DeviceHwInfo.desktop_display:type_name -> ocsf.v1.Display + 136, // 147: ocsf.v1.DeviceHwInfo.gpu_info_list:type_name -> ocsf.v1.GpuInfo + 146, // 148: ocsf.v1.DeviceHwInfo.keyboard_info:type_name -> ocsf.v1.KeyboardInfo + 34, // 149: ocsf.v1.DigitalSignature.algorithm_id:type_name -> ocsf.v1.DigitalSignature.AlgorithmId + 105, // 150: ocsf.v1.DigitalSignature.certificate:type_name -> ocsf.v1.Certificate + 134, // 151: ocsf.v1.DigitalSignature.digest:type_name -> ocsf.v1.Fingerprint + 35, // 152: ocsf.v1.DigitalSignature.state_id:type_name -> ocsf.v1.DigitalSignature.StateId + 164, // 153: ocsf.v1.DiscoveryDetails.occurrence_details:type_name -> ocsf.v1.OccurrenceDetails + 164, // 154: ocsf.v1.DiscoveryDetails.occurrences:type_name -> ocsf.v1.OccurrenceDetails + 36, // 155: ocsf.v1.DnsAnswer.flag_ids:type_name -> ocsf.v1.DnsAnswer.FlagIds + 149, // 156: ocsf.v1.DomainContact.location:type_name -> ocsf.v1.Location + 37, // 157: ocsf.v1.DomainContact.type_id:type_name -> ocsf.v1.DomainContact.TypeId + 204, // 158: ocsf.v1.Edge.data:type_name -> google.protobuf.Value + 116, // 159: ocsf.v1.Email.data_classification:type_name -> ocsf.v1.DataClassification + 116, // 160: ocsf.v1.Email.data_classifications:type_name -> ocsf.v1.DataClassification + 133, // 161: ocsf.v1.Email.files:type_name -> ocsf.v1.File + 139, // 162: ocsf.v1.Email.http_headers:type_name -> ocsf.v1.HttpHeader + 199, // 163: ocsf.v1.Email.urls:type_name -> ocsf.v1.Url + 38, // 164: ocsf.v1.EncryptionDetails.algorithm_id:type_name -> ocsf.v1.EncryptionDetails.AlgorithmId + 204, // 165: ocsf.v1.Enrichment.data:type_name -> google.protobuf.Value + 177, // 166: ocsf.v1.Enrichment.reputation:type_name -> ocsf.v1.Reputation + 200, // 167: ocsf.v1.File.accessor:type_name -> ocsf.v1.User + 39, // 168: ocsf.v1.File.confidentiality_id:type_name -> ocsf.v1.File.ConfidentialityId + 200, // 169: ocsf.v1.File.creator:type_name -> ocsf.v1.User + 116, // 170: ocsf.v1.File.data_classification:type_name -> ocsf.v1.DataClassification + 116, // 171: ocsf.v1.File.data_classifications:type_name -> ocsf.v1.DataClassification + 40, // 172: ocsf.v1.File.drive_type_id:type_name -> ocsf.v1.File.DriveTypeId + 127, // 173: ocsf.v1.File.encryption_details:type_name -> ocsf.v1.EncryptionDetails + 134, // 174: ocsf.v1.File.hashes:type_name -> ocsf.v1.Fingerprint + 200, // 175: ocsf.v1.File.modifier:type_name -> ocsf.v1.User + 200, // 176: ocsf.v1.File.owner:type_name -> ocsf.v1.User + 173, // 177: ocsf.v1.File.product:type_name -> ocsf.v1.Product + 119, // 178: ocsf.v1.File.signature:type_name -> ocsf.v1.DigitalSignature + 119, // 179: ocsf.v1.File.signatures:type_name -> ocsf.v1.DigitalSignature + 145, // 180: ocsf.v1.File.tags:type_name -> ocsf.v1.KeyValueObject + 41, // 181: ocsf.v1.File.type_id:type_name -> ocsf.v1.File.TypeId + 199, // 182: ocsf.v1.File.url:type_name -> ocsf.v1.Url + 204, // 183: ocsf.v1.File.xattributes:type_name -> google.protobuf.Value + 42, // 184: ocsf.v1.Fingerprint.algorithm_id:type_name -> ocsf.v1.Fingerprint.AlgorithmId + 43, // 185: ocsf.v1.GpuInfo.bus_type_id:type_name -> ocsf.v1.GpuInfo.BusTypeId + 44, // 186: ocsf.v1.GpuInfo.vram_mode_id:type_name -> ocsf.v1.GpuInfo.VramModeId + 124, // 187: ocsf.v1.Graph.edges:type_name -> ocsf.v1.Edge + 162, // 188: ocsf.v1.Graph.nodes:type_name -> ocsf.v1.Node + 45, // 189: ocsf.v1.Graph.query_language_id:type_name -> ocsf.v1.Graph.QueryLanguageId + 139, // 190: ocsf.v1.HttpRequest.http_headers:type_name -> ocsf.v1.HttpHeader + 199, // 191: ocsf.v1.HttpRequest.url:type_name -> ocsf.v1.Url + 139, // 192: ocsf.v1.HttpResponse.http_headers:type_name -> ocsf.v1.HttpHeader + 101, // 193: ocsf.v1.Idp.auth_factors:type_name -> ocsf.v1.AuthFactor + 134, // 194: ocsf.v1.Idp.fingerprint:type_name -> ocsf.v1.Fingerprint + 184, // 195: ocsf.v1.Idp.scim:type_name -> ocsf.v1.Scim + 190, // 196: ocsf.v1.Idp.sso:type_name -> ocsf.v1.Sso + 46, // 197: ocsf.v1.Idp.state_id:type_name -> ocsf.v1.Idp.StateId + 145, // 198: ocsf.v1.Image.tags:type_name -> ocsf.v1.KeyValueObject + 195, // 199: ocsf.v1.KbArticle.avg_timespan:type_name -> ocsf.v1.Timespan + 47, // 200: ocsf.v1.KbArticle.install_state_id:type_name -> ocsf.v1.KbArticle.InstallStateId + 166, // 201: ocsf.v1.KbArticle.os:type_name -> ocsf.v1.Os + 173, // 202: ocsf.v1.KbArticle.product:type_name -> ocsf.v1.Product + 48, // 203: ocsf.v1.KillChainPhase.phase_id:type_name -> ocsf.v1.KillChainPhase.PhaseId + 149, // 204: ocsf.v1.LdapPerson.location:type_name -> ocsf.v1.Location + 200, // 205: ocsf.v1.LdapPerson.manager:type_name -> ocsf.v1.User + 145, // 206: ocsf.v1.LdapPerson.tags:type_name -> ocsf.v1.KeyValueObject + 117, // 207: ocsf.v1.Logger.device:type_name -> ocsf.v1.Device + 173, // 208: ocsf.v1.Logger.product:type_name -> ocsf.v1.Product + 49, // 209: ocsf.v1.Malware.classification_ids:type_name -> ocsf.v1.Malware.ClassificationIds + 110, // 210: ocsf.v1.Malware.cves:type_name -> ocsf.v1.Cve + 133, // 211: ocsf.v1.Malware.files:type_name -> ocsf.v1.File + 50, // 212: ocsf.v1.Malware.severity_id:type_name -> ocsf.v1.Malware.SeverityId + 51, // 213: ocsf.v1.MalwareScanInfo.type_id:type_name -> ocsf.v1.MalwareScanInfo.TypeId + 204, // 214: ocsf.v1.ManagedEntity.data:type_name -> google.protobuf.Value + 117, // 215: ocsf.v1.ManagedEntity.device:type_name -> ocsf.v1.Device + 125, // 216: ocsf.v1.ManagedEntity.email:type_name -> ocsf.v1.Email + 138, // 217: ocsf.v1.ManagedEntity.group:type_name -> ocsf.v1.Group + 149, // 218: ocsf.v1.ManagedEntity.location:type_name -> ocsf.v1.Location + 165, // 219: ocsf.v1.ManagedEntity.org:type_name -> ocsf.v1.Organization + 169, // 220: ocsf.v1.ManagedEntity.policy:type_name -> ocsf.v1.Policy + 52, // 221: ocsf.v1.ManagedEntity.type_id:type_name -> ocsf.v1.ManagedEntity.TypeId + 200, // 222: ocsf.v1.ManagedEntity.user:type_name -> ocsf.v1.User + 53, // 223: ocsf.v1.MessageContext.ai_role_id:type_name -> ocsf.v1.MessageContext.AiRoleId + 99, // 224: ocsf.v1.MessageContext.application:type_name -> ocsf.v1.Application + 186, // 225: ocsf.v1.MessageContext.service:type_name -> ocsf.v1.Service + 116, // 226: ocsf.v1.Metadata.data_classification:type_name -> ocsf.v1.DataClassification + 116, // 227: ocsf.v1.Metadata.data_classifications:type_name -> ocsf.v1.DataClassification + 131, // 228: ocsf.v1.Metadata.extension:type_name -> ocsf.v1.Extension + 131, // 229: ocsf.v1.Metadata.extensions:type_name -> ocsf.v1.Extension + 150, // 230: ocsf.v1.Metadata.loggers:type_name -> ocsf.v1.Logger + 173, // 231: ocsf.v1.Metadata.product:type_name -> ocsf.v1.Product + 176, // 232: ocsf.v1.Metadata.reporter:type_name -> ocsf.v1.Reporter + 145, // 233: ocsf.v1.Metadata.tags:type_name -> ocsf.v1.KeyValueObject + 195, // 234: ocsf.v1.Metadata.total_queued_duration:type_name -> ocsf.v1.Timespan + 198, // 235: ocsf.v1.Metadata.transformation_info_list:type_name -> ocsf.v1.TransformationInfo + 115, // 236: ocsf.v1.Mitigation.countermeasures:type_name -> ocsf.v1.D3fend + 95, // 237: ocsf.v1.NetworkEndpoint.agent_list:type_name -> ocsf.v1.Agent + 103, // 238: ocsf.v1.NetworkEndpoint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 109, // 239: ocsf.v1.NetworkEndpoint.container:type_name -> ocsf.v1.Container + 134, // 240: ocsf.v1.NetworkEndpoint.fingerprints:type_name -> ocsf.v1.Fingerprint + 118, // 241: ocsf.v1.NetworkEndpoint.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 149, // 242: ocsf.v1.NetworkEndpoint.location:type_name -> ocsf.v1.Location + 54, // 243: ocsf.v1.NetworkEndpoint.network_scope_id:type_name -> ocsf.v1.NetworkEndpoint.NetworkScopeId + 166, // 244: ocsf.v1.NetworkEndpoint.os:type_name -> ocsf.v1.Os + 200, // 245: ocsf.v1.NetworkEndpoint.owner:type_name -> ocsf.v1.User + 138, // 246: ocsf.v1.NetworkEndpoint.pool:type_name -> ocsf.v1.Group + 161, // 247: ocsf.v1.NetworkEndpoint.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy + 55, // 248: ocsf.v1.NetworkEndpoint.type_id:type_name -> ocsf.v1.NetworkEndpoint.TypeId + 170, // 249: ocsf.v1.NetworkInterface.open_ports:type_name -> ocsf.v1.PortInfo + 56, // 250: ocsf.v1.NetworkInterface.type_id:type_name -> ocsf.v1.NetworkInterface.TypeId + 95, // 251: ocsf.v1.NetworkProxy.agent_list:type_name -> ocsf.v1.Agent + 103, // 252: ocsf.v1.NetworkProxy.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 109, // 253: ocsf.v1.NetworkProxy.container:type_name -> ocsf.v1.Container + 134, // 254: ocsf.v1.NetworkProxy.fingerprints:type_name -> ocsf.v1.Fingerprint + 118, // 255: ocsf.v1.NetworkProxy.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 149, // 256: ocsf.v1.NetworkProxy.location:type_name -> ocsf.v1.Location + 57, // 257: ocsf.v1.NetworkProxy.network_scope_id:type_name -> ocsf.v1.NetworkProxy.NetworkScopeId + 166, // 258: ocsf.v1.NetworkProxy.os:type_name -> ocsf.v1.Os + 200, // 259: ocsf.v1.NetworkProxy.owner:type_name -> ocsf.v1.User + 138, // 260: ocsf.v1.NetworkProxy.pool:type_name -> ocsf.v1.Group + 161, // 261: ocsf.v1.NetworkProxy.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy + 58, // 262: ocsf.v1.NetworkProxy.type_id:type_name -> ocsf.v1.NetworkProxy.TypeId + 204, // 263: ocsf.v1.Node.data:type_name -> google.protobuf.Value + 177, // 264: ocsf.v1.Observable.reputation:type_name -> ocsf.v1.Reputation + 59, // 265: ocsf.v1.Observable.type_id:type_name -> ocsf.v1.Observable.TypeId + 60, // 266: ocsf.v1.Os.type_id:type_name -> ocsf.v1.Os.TypeId + 122, // 267: ocsf.v1.Osint.answers:type_name -> ocsf.v1.DnsAnswer + 100, // 268: ocsf.v1.Osint.attacks:type_name -> ocsf.v1.Attack + 103, // 269: ocsf.v1.Osint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 104, // 270: ocsf.v1.Osint.campaign:type_name -> ocsf.v1.Campaign + 61, // 271: ocsf.v1.Osint.confidence_id:type_name -> ocsf.v1.Osint.ConfidenceId + 200, // 272: ocsf.v1.Osint.creator:type_name -> ocsf.v1.User + 62, // 273: ocsf.v1.Osint.detection_pattern_type_id:type_name -> ocsf.v1.Osint.DetectionPatternTypeId + 125, // 274: ocsf.v1.Osint.email:type_name -> ocsf.v1.Email + 126, // 275: ocsf.v1.Osint.email_auth:type_name -> ocsf.v1.EmailAuth + 133, // 276: ocsf.v1.Osint.file:type_name -> ocsf.v1.File + 147, // 277: ocsf.v1.Osint.kill_chain:type_name -> ocsf.v1.KillChainPhase + 149, // 278: ocsf.v1.Osint.location:type_name -> ocsf.v1.Location + 152, // 279: ocsf.v1.Osint.malware:type_name -> ocsf.v1.Malware + 97, // 280: ocsf.v1.Osint.related_analytics:type_name -> ocsf.v1.Analytic + 177, // 281: ocsf.v1.Osint.reputation:type_name -> ocsf.v1.Reputation + 185, // 282: ocsf.v1.Osint.script:type_name -> ocsf.v1.Script + 63, // 283: ocsf.v1.Osint.severity_id:type_name -> ocsf.v1.Osint.SeverityId + 119, // 284: ocsf.v1.Osint.signatures:type_name -> ocsf.v1.DigitalSignature + 194, // 285: ocsf.v1.Osint.threat_actor:type_name -> ocsf.v1.ThreatActor + 64, // 286: ocsf.v1.Osint.type_id:type_name -> ocsf.v1.Osint.TypeId + 201, // 287: ocsf.v1.Osint.vulnerabilities:type_name -> ocsf.v1.Vulnerability + 202, // 288: ocsf.v1.Osint.whois:type_name -> ocsf.v1.Whois + 134, // 289: ocsf.v1.Package.hash:type_name -> ocsf.v1.Fingerprint + 65, // 290: ocsf.v1.Package.type_id:type_name -> ocsf.v1.Package.TypeId + 204, // 291: ocsf.v1.Policy.data:type_name -> google.protobuf.Value + 138, // 292: ocsf.v1.Policy.group:type_name -> ocsf.v1.Group + 172, // 293: ocsf.v1.Process.ancestry:type_name -> ocsf.v1.ProcessEntity + 109, // 294: ocsf.v1.Process.container:type_name -> ocsf.v1.Container + 129, // 295: ocsf.v1.Process.environment_variables:type_name -> ocsf.v1.EnvironmentVariable + 133, // 296: ocsf.v1.Process.file:type_name -> ocsf.v1.File + 138, // 297: ocsf.v1.Process.group:type_name -> ocsf.v1.Group + 203, // 298: ocsf.v1.Process.hosted_services:type_name -> ocsf.v1.WinService + 66, // 299: ocsf.v1.Process.integrity_id:type_name -> ocsf.v1.Process.IntegrityId + 171, // 300: ocsf.v1.Process.parent_process:type_name -> ocsf.v1.Process + 187, // 301: ocsf.v1.Process.session:type_name -> ocsf.v1.Session + 200, // 302: ocsf.v1.Process.user:type_name -> ocsf.v1.User + 204, // 303: ocsf.v1.Process.xattributes:type_name -> google.protobuf.Value + 116, // 304: ocsf.v1.Product.data_classification:type_name -> ocsf.v1.DataClassification + 116, // 305: ocsf.v1.Product.data_classifications:type_name -> ocsf.v1.DataClassification + 132, // 306: ocsf.v1.Product.feature:type_name -> ocsf.v1.Feature + 106, // 307: ocsf.v1.Remediation.cis_controls:type_name -> ocsf.v1.CisControl + 144, // 308: ocsf.v1.Remediation.kb_article_list:type_name -> ocsf.v1.KbArticle + 165, // 309: ocsf.v1.Reporter.org:type_name -> ocsf.v1.Organization + 67, // 310: ocsf.v1.Reputation.score_id:type_name -> ocsf.v1.Reputation.ScoreId + 109, // 311: ocsf.v1.Request.containers:type_name -> ocsf.v1.Container + 204, // 312: ocsf.v1.Request.data:type_name -> google.protobuf.Value + 95, // 313: ocsf.v1.ResourceDetails.agent_list:type_name -> ocsf.v1.Agent + 204, // 314: ocsf.v1.ResourceDetails.data:type_name -> google.protobuf.Value + 116, // 315: ocsf.v1.ResourceDetails.data_classification:type_name -> ocsf.v1.DataClassification + 116, // 316: ocsf.v1.ResourceDetails.data_classifications:type_name -> ocsf.v1.DataClassification + 138, // 317: ocsf.v1.ResourceDetails.group:type_name -> ocsf.v1.Group + 200, // 318: ocsf.v1.ResourceDetails.owner:type_name -> ocsf.v1.User + 137, // 319: ocsf.v1.ResourceDetails.resource_relationship:type_name -> ocsf.v1.Graph + 68, // 320: ocsf.v1.ResourceDetails.role_id:type_name -> ocsf.v1.ResourceDetails.RoleId + 145, // 321: ocsf.v1.ResourceDetails.tags:type_name -> ocsf.v1.KeyValueObject + 109, // 322: ocsf.v1.Response.containers:type_name -> ocsf.v1.Container + 204, // 323: ocsf.v1.Response.data:type_name -> google.protobuf.Value + 168, // 324: ocsf.v1.Sbom.package:type_name -> ocsf.v1.Package + 173, // 325: ocsf.v1.Sbom.product:type_name -> ocsf.v1.Product + 188, // 326: ocsf.v1.Sbom.software_components:type_name -> ocsf.v1.SoftwareComponent + 69, // 327: ocsf.v1.Sbom.type_id:type_name -> ocsf.v1.Sbom.TypeId + 70, // 328: ocsf.v1.Scim.auth_protocol_id:type_name -> ocsf.v1.Scim.AuthProtocolId + 204, // 329: ocsf.v1.Scim.scim_group_schema:type_name -> google.protobuf.Value + 204, // 330: ocsf.v1.Scim.scim_user_schema:type_name -> google.protobuf.Value + 71, // 331: ocsf.v1.Scim.state_id:type_name -> ocsf.v1.Scim.StateId + 133, // 332: ocsf.v1.Script.file:type_name -> ocsf.v1.File + 134, // 333: ocsf.v1.Script.hashes:type_name -> ocsf.v1.Fingerprint + 151, // 334: ocsf.v1.Script.script_content:type_name -> ocsf.v1.LongString + 72, // 335: ocsf.v1.Script.type_id:type_name -> ocsf.v1.Script.TypeId + 145, // 336: ocsf.v1.Service.tags:type_name -> ocsf.v1.KeyValueObject + 134, // 337: ocsf.v1.SoftwareComponent.hash:type_name -> ocsf.v1.Fingerprint + 73, // 338: ocsf.v1.SoftwareComponent.relationship_id:type_name -> ocsf.v1.SoftwareComponent.RelationshipId + 74, // 339: ocsf.v1.SoftwareComponent.type_id:type_name -> ocsf.v1.SoftwareComponent.TypeId + 186, // 340: ocsf.v1.Span.service:type_name -> ocsf.v1.Service + 75, // 341: ocsf.v1.Sso.auth_protocol_id:type_name -> ocsf.v1.Sso.AuthProtocolId + 105, // 342: ocsf.v1.Sso.certificate:type_name -> ocsf.v1.Certificate + 76, // 343: ocsf.v1.ThreatActor.type_id:type_name -> ocsf.v1.ThreatActor.TypeId + 77, // 344: ocsf.v1.Timespan.type_id:type_name -> ocsf.v1.Timespan.TypeId + 78, // 345: ocsf.v1.Token.type_id:type_name -> ocsf.v1.Token.TypeId + 186, // 346: ocsf.v1.Trace.service:type_name -> ocsf.v1.Service + 189, // 347: ocsf.v1.Trace.span:type_name -> ocsf.v1.Span + 173, // 348: ocsf.v1.TransformationInfo.product:type_name -> ocsf.v1.Product + 79, // 349: ocsf.v1.Url.category_ids:type_name -> ocsf.v1.Url.CategoryIds + 90, // 350: ocsf.v1.User.account:type_name -> ocsf.v1.Account + 138, // 351: ocsf.v1.User.groups:type_name -> ocsf.v1.Group + 148, // 352: ocsf.v1.User.ldap_person:type_name -> ocsf.v1.LdapPerson + 165, // 353: ocsf.v1.User.org:type_name -> ocsf.v1.Organization + 174, // 354: ocsf.v1.User.programmatic_credentials:type_name -> ocsf.v1.ProgrammaticCredential + 80, // 355: ocsf.v1.User.risk_level_id:type_name -> ocsf.v1.User.RiskLevelId + 81, // 356: ocsf.v1.User.type_id:type_name -> ocsf.v1.User.TypeId + 92, // 357: ocsf.v1.Vulnerability.advisory:type_name -> ocsf.v1.Advisory + 93, // 358: ocsf.v1.Vulnerability.affected_code:type_name -> ocsf.v1.AffectedCode + 94, // 359: ocsf.v1.Vulnerability.affected_packages:type_name -> ocsf.v1.AffectedPackage + 110, // 360: ocsf.v1.Vulnerability.cve:type_name -> ocsf.v1.Cve + 112, // 361: ocsf.v1.Vulnerability.cwe:type_name -> ocsf.v1.Cwe + 82, // 362: ocsf.v1.Vulnerability.fix_coverage_id:type_name -> ocsf.v1.Vulnerability.FixCoverageId + 144, // 363: ocsf.v1.Vulnerability.kb_article_list:type_name -> ocsf.v1.KbArticle + 168, // 364: ocsf.v1.Vulnerability.packages:type_name -> ocsf.v1.Package + 175, // 365: ocsf.v1.Vulnerability.remediation:type_name -> ocsf.v1.Remediation + 103, // 366: ocsf.v1.Whois.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 83, // 367: ocsf.v1.Whois.dnssec_status_id:type_name -> ocsf.v1.Whois.DnssecStatusId + 123, // 368: ocsf.v1.Whois.domain_contacts:type_name -> ocsf.v1.DomainContact + 172, // 369: ocsf.v1.WinService.hosting_process:type_name -> ocsf.v1.ProcessEntity + 84, // 370: ocsf.v1.WinService.service_category_id:type_name -> ocsf.v1.WinService.ServiceCategoryId + 133, // 371: ocsf.v1.WinService.service_dll_file:type_name -> ocsf.v1.File + 85, // 372: ocsf.v1.WinService.service_error_control_id:type_name -> ocsf.v1.WinService.ServiceErrorControlId + 133, // 373: ocsf.v1.WinService.service_file:type_name -> ocsf.v1.File + 86, // 374: ocsf.v1.WinService.service_start_type_id:type_name -> ocsf.v1.WinService.ServiceStartTypeId + 87, // 375: ocsf.v1.WinService.service_type_id:type_name -> ocsf.v1.WinService.ServiceTypeId + 145, // 376: ocsf.v1.WinService.tags:type_name -> ocsf.v1.KeyValueObject + 377, // [377:377] is the sub-list for method output_type + 377, // [377:377] is the sub-list for method input_type + 377, // [377:377] is the sub-list for extension type_name + 377, // [377:377] is the sub-list for extension extendee + 0, // [0:377] is the sub-list for field type_name +} + +func init() { file_api_entity_proto_init() } +func file_api_entity_proto_init() { + if File_api_entity_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_entity_proto_rawDesc), len(file_api_entity_proto_rawDesc)), + NumEnums: 88, + NumMessages: 116, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_api_entity_proto_goTypes, + DependencyIndexes: file_api_entity_proto_depIdxs, + EnumInfos: file_api_entity_proto_enumTypes, + MessageInfos: file_api_entity_proto_msgTypes, + }.Build() + File_api_entity_proto = out.File + file_api_entity_proto_goTypes = nil + file_api_entity_proto_depIdxs = nil +} diff --git a/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml b/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml new file mode 100644 index 0000000..efcd809 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml @@ -0,0 +1,28 @@ +# buf.gen.yaml — how api_entity.pb.go is produced from the golden proto. +# +# Regenerate from the ocsf MODULE ROOT. The out/inputs paths below are +# module-root-relative (no "../" counting), so the output always lands in +# ocsf/internal/ocsf/conformance/genpb regardless of the caller's CWD, as long +# as buf is invoked from the ocsf module root: +# +# cd ocsf +# buf generate --template internal/ocsf/conformance/genpb/buf.gen.yaml +# task fmt # gci/gofumpt the freshly generated .pb.go so the Format Check passes +# +# NOTE: do NOT set `clean: true` here — this config file lives inside the `out` +# directory, so cleaning it would delete this file. The module-relative `out` +# is what keeps the location stable; genpb holds a single generated file, so +# there is nothing stale to clean. +# +# Source proto: internal/ocsf/gen/testdata/golden/api_entity.proto +# buf binary: .build/bin/buf (from cloudv2) or any buf >= 1.30 on $PATH +# protoc-gen-go: go install google.golang.org/protobuf/cmd/protoc-gen-go +version: v2 +plugins: + - local: protoc-gen-go + out: internal/ocsf/conformance/genpb + opt: + - paths=source_relative + - Mapi_entity.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb;ocsfv1 +inputs: + - directory: internal/ocsf/gen/testdata/golden From 3ffea041ac2144c6e615858de08d56abde669140 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:09:38 +0200 Subject: [PATCH 08/26] ci(ocsf): run ocsf module tests, buf, and conformance Adds the ocsf module to the test and lint matrices and an ocsf-checks job running buf lint/build, ocsf-protogen --check, the git-based --compat-check against the base ref, and the live OCSF conformance test. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/golangci-lint.yaml | 2 +- .github/workflows/test.yaml | 84 ++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 1 deletion(-) diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml index d34c0c3..1a65c50 100644 --- a/.github/workflows/golangci-lint.yaml +++ b/.github/workflows/golangci-lint.yaml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - dir: [api, rpadmin, secrets, net, rpsr, redpanda-otel-exporter, authz, kvstore, license, licenseupdater, kube, telemetry] + dir: [api, rpadmin, secrets, net, rpsr, redpanda-otel-exporter, authz, kvstore, license, licenseupdater, kube, telemetry, ocsf] steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index c8564d0..4d67624 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -6,12 +6,14 @@ on: - main paths: - '**.go' + - '**.proto' - '**/go.mod' - '**/go.sum' - '.github/workflows/test.yaml' pull_request: paths: - '**.go' + - '**.proto' - '**/go.mod' - '**/go.sum' - '.github/workflows/test.yaml' @@ -32,3 +34,85 @@ jobs: - name: Run tests (${{ matrix.dir }}) run: go test ./... working-directory: ${{ matrix.dir }} + + ocsf-checks: + name: ocsf-checks + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + # Fetch full history so we can resolve the base branch ref for the + # tagmap compat check below. + fetch-depth: 0 + + - uses: actions/setup-go@v5 + with: + go-version: 'stable' + + # buf is used to lint and build the generated .proto files. + - name: Install buf + uses: bufbuild/buf-setup-action@v1 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + + # Wire-stability gate: compare the committed field-numbers.json on this + # branch against the base-branch version. A changed tag number, a + # dropped field without a reserved entry, or a reused reserved tag all + # fail here before the baseline-drift check runs. + # + # On push events github.base_ref is empty; we skip gracefully. + # On the first PR that introduces the tagmap (old file absent on base), + # CompatCheck prints a bootstrap notice and exits 0. + - name: ocsf-protogen --compat-check (wire-stability gate) + if: ${{ github.base_ref != '' }} + working-directory: ocsf + run: | + git fetch origin "${{ github.base_ref }}" --depth=1 + git show "origin/${{ github.base_ref }}:ocsf/cmd/ocsf-protogen/testdata/field-numbers.json" \ + > /tmp/old-field-numbers.json 2>/dev/null || true + go run ./cmd/ocsf-protogen \ + --compat-check \ + --old /tmp/old-field-numbers.json \ + --new cmd/ocsf-protogen/testdata/field-numbers.json + + # Verify the committed proto baseline (api_entity.proto + field-numbers.json) + # exactly matches what the generator would produce today from the committed + # schema fixture. Drift here means someone edited the baseline by hand or + # forgot to regenerate after a schema/generator change. + - name: ocsf-protogen --check (baseline drift detection) + working-directory: ocsf + run: | + go run ./cmd/ocsf-protogen \ + --check \ + --schema internal/ocsf/schema/testdata/ocsf-1.8.0.json \ + --classes api_activity,entity_management \ + --version 1.8.0 \ + --out cmd/ocsf-protogen/testdata/api_entity.proto \ + --tagmap cmd/ocsf-protogen/testdata/field-numbers.json + + # buf lint + build on the committed proto baseline. + - name: buf lint (ocsf testdata) + working-directory: ocsf/cmd/ocsf-protogen/testdata + run: buf lint + + - name: buf build (ocsf testdata) + working-directory: ocsf/cmd/ocsf-protogen/testdata + run: buf build + + # buf lint + build on the golden proto used by gen tests. + - name: buf lint (gen golden) + working-directory: ocsf/internal/ocsf/gen/testdata/golden + run: buf lint + + - name: buf build (gen golden) + working-directory: ocsf/internal/ocsf/gen/testdata/golden + run: buf build + + # Run the full ocsf test suite including TestServerConformance which + # POSTs exported OCSF JSON to schema.ocsf.io/api/v2/validate and gates + # on error_count == 0. This test skips automatically when + # schema.ocsf.io is unreachable (e.g. local dev without internet) but + # must pass here in CI. + - name: ocsf go test (with server conformance) + working-directory: ocsf + run: go test ./... -count=1 From 195d28e763315c7c4837448d954287bb82613a07 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 15:09:49 +0200 Subject: [PATCH 09/26] chore(ocsf): module README, LICENSE, and ownership metadata Adds the ocsf module's README and BSL LICENSE, a CODEOWNERS entry (@redpanda-data/team-ai), and a .licenseupdater.yaml entry, satisfying the repo Project Structure Check. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/CODEOWNERS | 1 + .licenseupdater.yaml | 4 +++ README.md | 1 + ocsf/LICENSE | 72 ++++++++++++++++++++++++++++++++++++++++++++ ocsf/README.md | 42 ++++++++++++++++++++++++++ 5 files changed, 120 insertions(+) create mode 100644 ocsf/LICENSE create mode 100644 ocsf/README.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index f92833f..48eae6e 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -10,6 +10,7 @@ /api/ @sago2k8 @weeco /kube/ @redpanda-data/k8s /authz/ @redpanda-data/team-ai +/ocsf/ @redpanda-data/team-ai /licenseupdater/ @redpanda-data/k8s /alias/ @redpanda-data/k8s /goldenfile/ @redpanda-data/k8s diff --git a/.licenseupdater.yaml b/.licenseupdater.yaml index 48c6aaf..c136677 100644 --- a/.licenseupdater.yaml +++ b/.licenseupdater.yaml @@ -43,6 +43,10 @@ matches: type: go directory: net license: Apache + - extension: .go + type: go + directory: ocsf + license: BSL - extension: .go type: go directory: proto diff --git a/README.md b/README.md index 930857f..4c22686 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ All packages contain their own licensing information and README about how they a | [authz](./authz) | BSL | | [kvstore](./kvstore) | Apache | | [net](./net) | Apache | +| [ocsf](./ocsf) | BSL | | [proto](./proto) | BSL | | [redpanda-otel-exporter](./redpanda-otel-exporter) | BSL | | [rpadmin](./rpadmin) | BSL | diff --git a/ocsf/LICENSE b/ocsf/LICENSE new file mode 100644 index 0000000..ea04c79 --- /dev/null +++ b/ocsf/LICENSE @@ -0,0 +1,72 @@ +Redpanda Business Source License 1.1 + +License: BSL 1.1 + +Licensor: Redpanda Data, Inc. + +Licensed Work: Redpanda The Licensed Work is © 2026 +Redpanda Data, Inc. + +Additional Use Grant: You may make use of the Licensed Work, +provided that you may not use the Licensed Work for a Streaming or +Queuing Service. A "Streaming or Queueing Service" is a commercial +offering that allows third parties (other than your employees and +individual contractors) to access the functionality of the Licensed Work +by performing an action directly or indirectly that causes the creation +of a topic in the Licensed Work. For clarity, a Streaming or Queuing +Service would include providers of infrastructure services, such as +cloud services, hosting services, data center services and similarly +situated third parties (including affiliates of such entities) that +would offer the Licensed Work in connection with a broader service +offering to customers or subscribers of such of such third party’s core +services. + +Change Date: Change date is four years from +release date. Please see [GitHub releases](https://github.com/redpanda-data/redpanda/releases/) +for exact dates + +Change License: [Apache License, Version +2.0](https://www.apache.org/licenses/LICENSE-2.0), as published by the +Apache Foundation. + +Text of BSL 1.1 + +The Licensor hereby grants you the right to copy, modify, create +derivative works, redistribute, and make non-production use of the +Licensed Work. The Licensor may make an Additional Use Grant, above, +permitting limited production use. + +Effective on the Change Date, or the fifth anniversary of the first +publicly available distribution of a specific version of the Licensed +Work under this License, whichever comes first, the Licensor hereby +grants you rights under the terms of the Change License, and the rights +granted in the paragraph above terminate. + +If your use of the Licensed Work does not comply with the requirements +currently in effect as described in this License, you must purchase a +commercial license from the Licensor, its affiliated entities, or +authorized resellers, or you must refrain from using the Licensed Work. + +All copies of the original and modified Licensed Work, and derivative +works of the Licensed Work, are subject to this License. This License +applies separately for each version of the Licensed Work and the Change +Date may vary for each version of the Licensed Work released by +Licensor. + +You must conspicuously display this License on each original or modified +copy of the Licensed Work. If you receive the Licensed Work in original +or modified form from a third party, the terms and conditions set forth +in this License apply to your use of that work. + +Any use of the Licensed Work in violation of this License will +automatically terminate your rights under this License for the current +and all other versions of the Licensed Work. + +This License does not grant you any right in any trademark or logo of +Licensor or its affiliates (provided that you may use a trademark or +logo of Licensor as expressly required by this License).TO THE EXTENT +PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN “AS IS” +BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS +OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND +TITLE. diff --git a/ocsf/README.md b/ocsf/README.md new file mode 100644 index 0000000..5bff5e1 --- /dev/null +++ b/ocsf/README.md @@ -0,0 +1,42 @@ +## OCSF + +`ocsf` turns the compiled [OCSF](https://schema.ocsf.io) (Open Cybersecurity +Schema Framework) security-event schema into wire-stable proto3, and marshals +generated events to schema-valid OCSF JSON. + +### Why + +OCSF ships no protobuf binding, and the schema is versioned JSON. This module +generates proto3 for a chosen set of OCSF classes with **stable field numbers** +across schema versions, so events can be stored and streamed as proto and +exported as OCSF JSON at the boundary. + +### Packages + +- `internal/ocsf/schema` — loads the OCSF `export/v2` compiled schema. +- `internal/ocsf/gen` — maps OCSF types/enums to proto3 and emits deterministic + `.proto` with protovalidate. +- `internal/ocsf/tagmap` — the append-only `(message, attribute) -> tag` map and + its compatibility check (the wire-stability guarantee). +- `internal/ocsf/exporter` — marshals a generated proto message to OCSF JSON + (integer enums, numeric int64, snake_case keys). +- `cmd/ocsf-protogen` — the generator CLI. + +### CLI + +``` +go run ./cmd/ocsf-protogen \ + --schema internal/ocsf/schema/testdata/ocsf-1.8.0.json \ + --classes api_activity,entity_management \ + --version 1.8.0 \ + --out out.proto \ + --tagmap field-numbers.json +``` + +- `--check` regenerates and fails on output drift or newly-stubbed objects. +- `--compat-check --old --new ` fails if field numbers changed + incompatibly between two tag maps (used in CI against the base branch). + +Pinned to OCSF 1.8.0. The schema is fetched from +`https://schema.ocsf.io/{version}/export/v2/schema`; generated events are +conformance-validated against `https://schema.ocsf.io/{version}/api/v2/validate`. From c750d7d9b43598411bb9aa001bcd6d9e25d4a93c Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 16:06:32 +0200 Subject: [PATCH 10/26] refactor(ocsf): emit one proto file per class plus shared objects.proto Emit now returns []GeneratedFile (one .proto per selected class plus a shared ocsf/v/objects.proto) instead of a single monolithic file. --out becomes a module-root directory; --check compares the full generated file set against the committed tree (add/remove/change). Field numbers are keyed by message+attribute and are byte-identical to the prior baseline. Regenerated golden tree, cmd testdata tree, and genpb bindings; dropped the now-unneeded PACKAGE_DIRECTORY_MATCH lint waiver. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yaml | 12 +- ocsf/cmd/ocsf-protogen/main.go | 14 +- ocsf/cmd/ocsf-protogen/protogen/protogen.go | 161 +- .../ocsf-protogen/protogen/protogen_test.go | 45 +- ocsf/cmd/ocsf-protogen/testdata/buf.yaml | 2 - .../testdata/ocsf/v1/api_activity.proto | 171 + .../testdata/ocsf/v1/entity_management.proto | 189 + .../v1/objects.proto} | 338 - .../ocsf/conformance/conformance_test.go | 2 +- .../ocsf/conformance/genpb/buf.gen.yaml | 18 +- .../genpb/ocsf/v1/api_activity.pb.go | 1479 +++ .../genpb/ocsf/v1/entity_management.pb.go | 1548 +++ .../v1/objects.pb.go} | 10938 ++++++---------- ocsf/internal/ocsf/gen/emit.go | 201 +- ocsf/internal/ocsf/gen/emit_test.go | 130 +- .../ocsf/gen/testdata/golden/buf.yaml | 2 - .../golden/ocsf/v1/api_activity.proto | 171 + .../golden/ocsf/v1/entity_management.proto | 189 + .../v1/objects.proto} | 338 - 19 files changed, 8252 insertions(+), 7696 deletions(-) create mode 100644 ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/api_activity.proto create mode 100644 ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/entity_management.proto rename ocsf/cmd/ocsf-protogen/testdata/{api_entity.proto => ocsf/v1/objects.proto} (87%) create mode 100644 ocsf/internal/ocsf/conformance/genpb/ocsf/v1/api_activity.pb.go create mode 100644 ocsf/internal/ocsf/conformance/genpb/ocsf/v1/entity_management.pb.go rename ocsf/internal/ocsf/conformance/genpb/{api_entity.pb.go => ocsf/v1/objects.pb.go} (80%) create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/api_activity.proto create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/entity_management.proto rename ocsf/internal/ocsf/gen/testdata/golden/{api_entity.proto => ocsf/v1/objects.proto} (87%) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 4d67624..5034df1 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -75,10 +75,12 @@ jobs: --old /tmp/old-field-numbers.json \ --new cmd/ocsf-protogen/testdata/field-numbers.json - # Verify the committed proto baseline (api_entity.proto + field-numbers.json) - # exactly matches what the generator would produce today from the committed - # schema fixture. Drift here means someone edited the baseline by hand or - # forgot to regenerate after a schema/generator change. + # Verify the committed proto baseline tree (ocsf/v1/*.proto + + # field-numbers.json) exactly matches what the generator would produce today + # from the committed schema fixture. --out is a module root directory; the + # generator writes one file per class plus a shared objects.proto under + # ocsf/v1/. Drift here means someone edited the baseline by hand or forgot + # to regenerate after a schema/generator change. - name: ocsf-protogen --check (baseline drift detection) working-directory: ocsf run: | @@ -87,7 +89,7 @@ jobs: --schema internal/ocsf/schema/testdata/ocsf-1.8.0.json \ --classes api_activity,entity_management \ --version 1.8.0 \ - --out cmd/ocsf-protogen/testdata/api_entity.proto \ + --out cmd/ocsf-protogen/testdata \ --tagmap cmd/ocsf-protogen/testdata/field-numbers.json # buf lint + build on the committed proto baseline. diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go index 19a48a8..1551c38 100644 --- a/ocsf/cmd/ocsf-protogen/main.go +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -16,16 +16,20 @@ // --schema ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json \ // --classes api_activity,entity_management \ // --version 1.8.0 \ -// --out ocsf/cmd/ocsf-protogen/testdata/api_entity.proto \ +// --out ocsf/cmd/ocsf-protogen/testdata \ // --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json // +// --out is a MODULE ROOT DIRECTORY. Files are written under it at their +// module-relative paths, e.g. /ocsf/v1/api_activity.proto, +// /ocsf/v1/entity_management.proto, /ocsf/v1/objects.proto. +// // Check mode (for CI — verifies committed baseline is up-to-date): // // ocsf-protogen --check \ // --schema ocsf/internal/ocsf/schema/testdata/ocsf-1.8.0.json \ // --classes api_activity,entity_management \ // --version 1.8.0 \ -// --out ocsf/cmd/ocsf-protogen/testdata/api_entity.proto \ +// --out ocsf/cmd/ocsf-protogen/testdata \ // --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json // // Compat-check mode (for CI — verifies field numbers didn't regress vs base branch): @@ -75,7 +79,7 @@ func run(args []string) error { schemaFlag := fs.String("schema", defaultSchemaPath(), "path to compiled OCSF schema JSON") classesFlag := fs.String("classes", "", "comma-separated OCSF class names (e.g. api_activity,entity_management)") versionFlag := fs.String("version", "1.8.0", "OCSF schema version string (e.g. 1.8.0)") - outFlag := fs.String("out", "", "output .proto file path (required)") + outFlag := fs.String("out", "", "output module root directory; files are written under it at ocsf/v/*.proto (required)") tagmapFlag := fs.String("tagmap", "", "path to field-numbers JSON (created on first run)") checkFlag := fs.Bool("check", false, "check committed baseline matches fresh generation (for CI)") compatCheckFlag := fs.Bool("compat-check", false, "check wire stability between two tagmap files (use with --old and --new)") @@ -118,7 +122,7 @@ func run(args []string) error { SchemaPath: *schemaFlag, Classes: classes, Version: *versionFlag, - OutPath: *outFlag, + OutDir: *outFlag, TagmapPath: *tagmapFlag, Check: *checkFlag, } @@ -146,7 +150,7 @@ func run(args []string) error { "Re-run with a full schema snapshot to resolve.\n") } - fmt.Printf("wrote %s\n", cfg.OutPath) + fmt.Printf("wrote proto tree under %s\n", cfg.OutDir) fmt.Printf("saved tagmap %s\n", cfg.TagmapPath) return nil } diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go index 2afa2a6..f4c482c 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -15,6 +15,8 @@ import ( "errors" "fmt" "os" + "path/filepath" + "sort" "strings" "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" @@ -27,7 +29,9 @@ type Config struct { SchemaPath string Classes []string Version string - OutPath string + // OutDir is the module root directory. Generated files are written under it + // at their module-relative GeneratedFile.Path (e.g. /ocsf/v1/...). + OutDir string TagmapPath string Check bool } @@ -49,13 +53,13 @@ func Generate(cfg Config) (stubbed []string, err error) { return nil, fmt.Errorf("load tagmap: %w", err) } - protoOut, stubbed, err := gen.Emit(s, cfg.Classes, tm, cfg.Version) + files, stubbed, err := gen.Emit(s, cfg.Classes, tm, cfg.Version) if err != nil { return nil, fmt.Errorf("emit proto: %w", err) } - if err := os.WriteFile(cfg.OutPath, []byte(protoOut), 0o600); err != nil { - return nil, fmt.Errorf("write proto to %q: %w", cfg.OutPath, err) + if err := writeFiles(cfg.OutDir, files); err != nil { + return nil, err } if err := tm.Save(cfg.TagmapPath); err != nil { @@ -65,12 +69,29 @@ func Generate(cfg Config) (stubbed []string, err error) { return stubbed, nil } -// Check regenerates the proto in memory and detects drift vs. the committed -// baseline files (--out and --tagmap). It returns a non-nil error with a -// descriptive message when: +// writeFiles writes each generated file to /, creating parent +// directories as needed. Paths are slash-separated and converted to the host +// separator. +func writeFiles(outDir string, files []gen.GeneratedFile) error { + for _, f := range files { + dst := filepath.Join(outDir, filepath.FromSlash(f.Path)) + if err := os.MkdirAll(filepath.Dir(dst), 0o750); err != nil { + return fmt.Errorf("create dir for %q: %w", dst, err) + } + if err := os.WriteFile(dst, []byte(f.Content), 0o600); err != nil { + return fmt.Errorf("write proto to %q: %w", dst, err) + } + } + return nil +} + +// Check regenerates the proto tree in memory and detects drift vs. the committed +// baseline tree rooted at OutDir (and the committed --tagmap). It returns a +// non-nil error with a descriptive message when: // - the tagmap is incompatible (tag number changed, dropped without reserve, etc.) -// - the emitted proto text differs from the committed --out file -// - stubbed objects appear in the output (indicates schema regression) +// - the generated file set differs from the committed tree (a file was added, +// removed, or its content changed) +// - a new stubbed object appears (indicates schema regression) func Check(cfg Config) error { s, err := schema.LoadFile(cfg.SchemaPath) if err != nil { @@ -93,25 +114,25 @@ func Check(cfg Config) error { return fmt.Errorf("copy tagmap for check: %w", err) } - protoOut, stubbed, err := gen.Emit(s, cfg.Classes, newTM, cfg.Version) + files, stubbed, err := gen.Emit(s, cfg.Classes, newTM, cfg.Version) if err != nil { return fmt.Errorf("emit proto: %w", err) } - // Read the committed proto before the diff so we can compare stub lists. - committedBytes, err := os.ReadFile(cfg.OutPath) + // Read the committed tree so we can compare stub lists and full content. + committed, err := readCommittedTree(cfg.OutDir, files) if err != nil { - return fmt.Errorf("read committed proto %q: %w", cfg.OutPath, err) + return err } - // Stubs in --check are only a hard failure when they are NEW (i.e. absent - // from the committed baseline). An existing partial schema fixture may - // legitimately produce stubs, and the proto-drift check below already - // catches any regression. We detect "new" stubs by checking whether the - // fresh proto introduces stub declarations not present in the baseline. + // Concatenate committed content to detect NEW stubs (absent from baseline). + var committedAll strings.Builder + for _, c := range committed { + committedAll.WriteString(c) + } for _, stubName := range stubbed { stubDecl := "message " + stubName + " {}" - if !strings.Contains(string(committedBytes), stubDecl) { + if !strings.Contains(committedAll.String(), stubDecl) { return fmt.Errorf("new stub message %q appeared in generated proto but is absent from committed baseline — "+ "schema regression or missing object in schema snapshot", stubName) } @@ -122,12 +143,106 @@ func Check(cfg Config) error { return fmt.Errorf("tagmap incompatibility detected (regenerate and commit field-numbers.json):\n%w", err) } - // Proto content drift. - if string(committedBytes) != protoOut { + // File-set drift: any file added, removed, or changed. + return diffTree(cfg.OutDir, files, committed) +} + +// readCommittedTree loads the committed content of every path produced by Emit +// plus every committed .proto file under the versioned directories, keyed by +// module-relative slash path. A generated path that is missing on disk is +// recorded as absent (empty string, not present in the map) so diffTree can +// report it as added. +func readCommittedTree(outDir string, files []gen.GeneratedFile) (map[string]string, error) { + committed := make(map[string]string) + + // Read each generated file's committed counterpart (if present). + for _, f := range files { + p := filepath.Join(outDir, filepath.FromSlash(f.Path)) + b, err := os.ReadFile(filepath.Clean(p)) + switch { + case err == nil: + committed[f.Path] = string(b) + case os.IsNotExist(err): + // leave absent + default: + return nil, fmt.Errorf("read committed proto %q: %w", p, err) + } + } + + // Also enumerate committed .proto files under each versioned dir the + // generator writes into, so we catch files that should have been removed. + dirs := make(map[string]struct{}) + for _, f := range files { + dirs[filepath.Dir(f.Path)] = struct{}{} + } + for d := range dirs { + root := filepath.Join(outDir, filepath.FromSlash(d)) + entries, err := os.ReadDir(root) + if os.IsNotExist(err) { + continue + } + if err != nil { + return nil, fmt.Errorf("read committed dir %q: %w", root, err) + } + for _, e := range entries { + if e.IsDir() || filepath.Ext(e.Name()) != ".proto" { + continue + } + rel := d + "/" + e.Name() + if _, ok := committed[rel]; ok { + continue + } + b, err := os.ReadFile(filepath.Clean(filepath.Join(root, e.Name()))) + if err != nil { + return nil, fmt.Errorf("read committed proto %q: %w", rel, err) + } + committed[rel] = string(b) + } + } + + return committed, nil +} + +// diffTree compares the generated file set against the committed tree and +// returns a descriptive error on any add/remove/change. +func diffTree(outDir string, files []gen.GeneratedFile, committed map[string]string) error { + want := make(map[string]string, len(files)) + for _, f := range files { + want[f.Path] = f.Content + } + + // Missing or changed generated files. + for _, f := range files { + got, ok := committed[f.Path] + if !ok { + return fmt.Errorf( + "generated file %q is missing from committed tree rooted at %q "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + f.Path, outDir, + ) + } + if got != f.Content { + return fmt.Errorf( + "committed proto %q differs from freshly generated output "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + f.Path, + ) + } + } + + // Stray committed files not produced by the generator. + stray := make([]string, 0) + for path := range committed { + if _, ok := want[path]; !ok { + stray = append(stray, path) + } + } + if len(stray) > 0 { + sort.Strings(stray) return fmt.Errorf( - "committed proto %q differs from freshly generated output "+ + "committed tree rooted at %q contains files not produced by the generator: %s "+ "(run ocsf-protogen without --check to regenerate, then commit the diff)", - cfg.OutPath, + outDir, strings.Join(stray, ", "), ) } diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go index 237fe14..5ef2718 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -34,16 +34,17 @@ func schemaFixture() string { return filepath.Join(root, "ocsf-1.8.0.json") } -// committedBaseline returns the absolute path to the committed proto baseline -// and field-numbers.json that were generated from the CLI. -func committedBaseline() (protoPath, tagmapPath string) { +// committedBaseline returns the absolute path to the committed baseline module +// root directory and its field-numbers.json. The proto tree lives under +// /ocsf/v1/*.proto. +func committedBaseline() (outDir, tagmapPath string) { _, thisFile, _, ok := runtime.Caller(0) if !ok { panic("runtime.Caller failed") } // testdata is at .../ocsf/cmd/ocsf-protogen/testdata/ td := filepath.Join(filepath.Dir(thisFile), "..", "testdata") - return filepath.Join(td, "api_entity.proto"), filepath.Join(td, "field-numbers.json") + return td, filepath.Join(td, "field-numbers.json") } // ─── ParseClasses ───────────────────────────────────────────────────────────── @@ -82,14 +83,13 @@ func TestParseClasses_OnlyCommas(t *testing.T) { // same temp dir and asserts it passes (exit 0 equivalent). func TestGenerateThenCheck(t *testing.T) { dir := t.TempDir() - outPath := filepath.Join(dir, "out.proto") tagmapPath := filepath.Join(dir, "field-numbers.json") cfg := protogen.Config{ SchemaPath: schemaFixture(), Classes: []string{"api_activity", "entity_management"}, Version: "1.8.0", - OutPath: outPath, + OutDir: dir, TagmapPath: tagmapPath, Check: false, } @@ -97,8 +97,10 @@ func TestGenerateThenCheck(t *testing.T) { _, err := protogen.Generate(cfg) require.NoError(t, err) - // Both files should have been created. - require.FileExists(t, outPath) + // The multi-file tree and the tagmap should have been created. + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "api_activity.proto")) + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "entity_management.proto")) + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "objects.proto")) require.FileExists(t, tagmapPath) // --check against the just-generated baseline must pass. @@ -116,14 +118,13 @@ func TestGenerateThenCheck(t *testing.T) { // generated proto to diverge from the committed baseline. func TestCheckFailsOnProtoDriftFromEditedTagmap(t *testing.T) { dir := t.TempDir() - outPath := filepath.Join(dir, "out.proto") tagmapPath := filepath.Join(dir, "field-numbers.json") cfg := protogen.Config{ SchemaPath: schemaFixture(), Classes: []string{"api_activity", "entity_management"}, Version: "1.8.0", - OutPath: outPath, + OutDir: dir, TagmapPath: tagmapPath, } @@ -185,25 +186,25 @@ func TestCheckFailsOnProtoDriftFromEditedTagmap(t *testing.T) { // file, and asserts Check detects the drift. func TestCheckFailsOnProtoDrift(t *testing.T) { dir := t.TempDir() - outPath := filepath.Join(dir, "out.proto") tagmapPath := filepath.Join(dir, "field-numbers.json") cfg := protogen.Config{ SchemaPath: schemaFixture(), Classes: []string{"api_activity", "entity_management"}, Version: "1.8.0", - OutPath: outPath, + OutDir: dir, TagmapPath: tagmapPath, } _, err := protogen.Generate(cfg) require.NoError(t, err) - // Corrupt the committed proto file. - content, err := os.ReadFile(outPath) + // Corrupt one generated proto file in the tree. + objPath := filepath.Join(dir, "ocsf", "v1", "objects.proto") + content, err := os.ReadFile(objPath) require.NoError(t, err) corrupted := string(content) + "\n// CORRUPTED BY TEST\n" - require.NoError(t, os.WriteFile(outPath, []byte(corrupted), 0o644)) + require.NoError(t, os.WriteFile(objPath, []byte(corrupted), 0o644)) // Check must fail with a drift error. checkCfg := cfg @@ -215,16 +216,16 @@ func TestCheckFailsOnProtoDrift(t *testing.T) { // ─── Check: committed baseline ─────────────────────────────────────────────── -// TestCheckAgainstCommittedBaseline runs --check against the files committed to -// the repository (testdata/api_entity.proto and testdata/field-numbers.json). +// TestCheckAgainstCommittedBaseline runs --check against the tree committed to +// the repository (testdata/ocsf/v1/*.proto and testdata/field-numbers.json). // This test fails if the committed baseline drifts from what the generator // would produce today. func TestCheckAgainstCommittedBaseline(t *testing.T) { - protoPath, tagmapPath := committedBaseline() + outDir, tagmapPath := committedBaseline() // Skip gracefully if the committed baseline does not exist yet // (before the first `go run ./cmd/ocsf-protogen --out ... --tagmap ...` is run). - if _, err := os.Stat(protoPath); os.IsNotExist(err) { + if _, err := os.Stat(filepath.Join(outDir, "ocsf", "v1", "objects.proto")); os.IsNotExist(err) { t.Skip("committed baseline not yet generated; run: go run ./cmd/ocsf-protogen ...") } if _, err := os.Stat(tagmapPath); os.IsNotExist(err) { @@ -235,7 +236,7 @@ func TestCheckAgainstCommittedBaseline(t *testing.T) { SchemaPath: schemaFixture(), Classes: []string{"api_activity", "entity_management"}, Version: "1.8.0", - OutPath: protoPath, + OutDir: outDir, TagmapPath: tagmapPath, Check: true, } @@ -254,7 +255,7 @@ func TestGenerateVersionMismatch(t *testing.T) { SchemaPath: schemaFixture(), Classes: []string{"api_activity"}, Version: "9.9.9", // wrong: schema is 1.8.0 - OutPath: filepath.Join(dir, "out.proto"), + OutDir: dir, TagmapPath: filepath.Join(dir, "field-numbers.json"), } _, err := protogen.Generate(cfg) @@ -272,7 +273,7 @@ func TestCheckVersionMismatch(t *testing.T) { SchemaPath: schemaFixture(), Classes: []string{"api_activity"}, Version: "1.8.0", - OutPath: filepath.Join(dir, "out.proto"), + OutDir: dir, TagmapPath: filepath.Join(dir, "field-numbers.json"), } _, err := protogen.Generate(cfg) diff --git a/ocsf/cmd/ocsf-protogen/testdata/buf.yaml b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml index 4d2ee62..5e2f6a2 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/buf.yaml +++ b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml @@ -7,8 +7,6 @@ lint: use: - STANDARD except: - # Generated files don't follow a consistent package/directory convention. - - PACKAGE_DIRECTORY_MATCH # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values by design. - ENUM_ZERO_VALUE_SUFFIX breaking: diff --git a/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/api_activity.proto b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/api_activity.proto new file mode 100644 index 0000000..212b9f3 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/api_activity.proto @@ -0,0 +1,171 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message ApiActivity { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + string action = 1; + ActionId action_id = 2; + ActivityId activity_id = 3 [(buf.validate.field).required = true]; + string activity_name = 4; + Actor actor = 5 [(buf.validate.field).required = true]; + AiModel ai_model = 6; + Api api = 7 [(buf.validate.field).required = true]; + repeated Attack attacks = 8; + repeated Authorization authorizations = 9; + string category_name = 10; + CategoryUid category_uid = 11 [(buf.validate.field).required = true]; + string class_name = 12; + ClassUid class_uid = 13 [(buf.validate.field).required = true]; + Cloud cloud = 14 [(buf.validate.field).required = true]; + string confidence = 15; + ConfidenceId confidence_id = 16; + int32 confidence_score = 17; + int32 count = 18; + Device device = 19; + string disposition = 20; + DispositionId disposition_id = 21; + NetworkEndpoint dst_endpoint = 22; + int64 duration = 23; + int64 end_time = 24; + string end_time_dt = 25; + repeated Enrichment enrichments = 26; + FirewallRule firewall_rule = 27; + HttpRequest http_request = 28; + HttpResponse http_response = 29; + bool is_alert = 30; + repeated Malware malware = 31; + MalwareScanInfo malware_scan_info = 32; + string message = 33; + MessageContext message_context = 34; + Metadata metadata = 35 [(buf.validate.field).required = true]; + repeated Observable observables = 36; + repeated Osint osint = 37; + Policy policy = 38; + string raw_data = 39; + Fingerprint raw_data_hash = 40; + int64 raw_data_size = 41; + repeated ResourceDetails resources = 42; + string risk_details = 43; + string risk_level = 44; + RiskLevelId risk_level_id = 45; + int32 risk_score = 46; + string severity = 47; + SeverityId severity_id = 48 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; + int64 start_time = 50; + string start_time_dt = 51; + string status = 52; + string status_code = 53; + string status_detail = 54; + StatusId status_id = 55; + int64 time = 56 [(buf.validate.field).required = true]; + string time_dt = 57; + int32 timezone_offset = 58; + Trace trace = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + diff --git a/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/entity_management.proto b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/entity_management.proto new file mode 100644 index 0000000..b39653c --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/entity_management.proto @@ -0,0 +1,189 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message EntityManagement { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_MOVE = 5; + ACTIVITY_ID_ENROLL = 6; + ACTIVITY_ID_UNENROLL = 7; + ACTIVITY_ID_ENABLE = 8; + ACTIVITY_ID_DISABLE = 9; + ACTIVITY_ID_ACTIVATE = 10; + ACTIVITY_ID_DEACTIVATE = 11; + ACTIVITY_ID_SUSPEND = 12; + ACTIVITY_ID_RESUME = 13; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + ActivityId activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + Api api = 8; + repeated Attack attacks = 9; + repeated Authorization authorizations = 10; + string category_name = 11; + CategoryUid category_uid = 12 [(buf.validate.field).required = true]; + string class_name = 13; + ClassUid class_uid = 14 [(buf.validate.field).required = true]; + Cloud cloud = 15 [(buf.validate.field).required = true]; + string comment = 16; + string confidence = 17; + ConfidenceId confidence_id = 18; + int32 confidence_score = 19; + int32 count = 20; + Device device = 21; + string disposition = 22; + DispositionId disposition_id = 23; + int64 duration = 24; + int64 end_time = 25; + string end_time_dt = 26; + repeated Enrichment enrichments = 27; + ManagedEntity entity = 28 [(buf.validate.field).required = true]; + ManagedEntity entity_result = 29; + FirewallRule firewall_rule = 30; + HttpRequest http_request = 31; + HttpResponse http_response = 32; + bool is_alert = 33; + repeated Malware malware = 34; + MalwareScanInfo malware_scan_info = 35; + string message = 36; + Metadata metadata = 37 [(buf.validate.field).required = true]; + repeated Observable observables = 38; + repeated Osint osint = 39; + Policy policy = 40; + string raw_data = 41; + Fingerprint raw_data_hash = 42; + int64 raw_data_size = 43; + string risk_details = 44; + string risk_level = 45; + RiskLevelId risk_level_id = 46; + int32 risk_score = 47; + string severity = 48; + SeverityId severity_id = 49 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 50; + int64 start_time = 51; + string start_time_dt = 52; + string status = 53; + string status_code = 54; + string status_detail = 55; + StatusId status_id = 56; + int64 time = 57 [(buf.validate.field).required = true]; + string time_dt = 58; + int32 timezone_offset = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + diff --git a/ocsf/cmd/ocsf-protogen/testdata/api_entity.proto b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/objects.proto similarity index 87% rename from ocsf/cmd/ocsf-protogen/testdata/api_entity.proto rename to ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/objects.proto index 928b0c1..28a24b6 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/api_entity.proto +++ b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/objects.proto @@ -8,344 +8,6 @@ package ocsf.v1; import "buf/validate/validate.proto"; import "google/protobuf/struct.proto"; -message ApiActivity { - enum ActionId { - ACTION_ID_UNKNOWN = 0; - ACTION_ID_ALLOWED = 1; - ACTION_ID_DENIED = 2; - ACTION_ID_OBSERVED = 3; - ACTION_ID_MODIFIED = 4; - ACTION_ID_OTHER = 99; - } - enum ActivityId { - ACTIVITY_ID_UNKNOWN = 0; - ACTIVITY_ID_CREATE = 1; - ACTIVITY_ID_READ = 2; - ACTIVITY_ID_UPDATE = 3; - ACTIVITY_ID_DELETE = 4; - ACTIVITY_ID_OTHER = 99; - } - enum CategoryUid { - CATEGORY_UID_UNKNOWN = 0; - CATEGORY_UID_APPLICATION_ACTIVITY = 6; - } - enum ClassUid { - CLASS_UID_UNKNOWN = 0; - CLASS_UID_API_ACTIVITY = 6003; - } - enum ConfidenceId { - CONFIDENCE_ID_UNKNOWN = 0; - CONFIDENCE_ID_LOW = 1; - CONFIDENCE_ID_MEDIUM = 2; - CONFIDENCE_ID_HIGH = 3; - CONFIDENCE_ID_OTHER = 99; - } - enum DispositionId { - DISPOSITION_ID_UNKNOWN = 0; - DISPOSITION_ID_ALLOWED = 1; - DISPOSITION_ID_BLOCKED = 2; - DISPOSITION_ID_QUARANTINED = 3; - DISPOSITION_ID_ISOLATED = 4; - DISPOSITION_ID_DELETED = 5; - DISPOSITION_ID_DROPPED = 6; - DISPOSITION_ID_CUSTOM_ACTION = 7; - DISPOSITION_ID_APPROVED = 8; - DISPOSITION_ID_RESTORED = 9; - DISPOSITION_ID_EXONERATED = 10; - DISPOSITION_ID_CORRECTED = 11; - DISPOSITION_ID_PARTIALLY_CORRECTED = 12; - DISPOSITION_ID_UNCORRECTED = 13; - DISPOSITION_ID_DELAYED = 14; - DISPOSITION_ID_DETECTED = 15; - DISPOSITION_ID_NO_ACTION = 16; - DISPOSITION_ID_LOGGED = 17; - DISPOSITION_ID_TAGGED = 18; - DISPOSITION_ID_ALERT = 19; - DISPOSITION_ID_COUNT = 20; - DISPOSITION_ID_RESET = 21; - DISPOSITION_ID_CAPTCHA = 22; - DISPOSITION_ID_CHALLENGE = 23; - DISPOSITION_ID_ACCESS_REVOKED = 24; - DISPOSITION_ID_REJECTED = 25; - DISPOSITION_ID_UNAUTHORIZED = 26; - DISPOSITION_ID_ERROR = 27; - DISPOSITION_ID_OTHER = 99; - } - enum RiskLevelId { - RISK_LEVEL_ID_INFO = 0; - RISK_LEVEL_ID_LOW = 1; - RISK_LEVEL_ID_MEDIUM = 2; - RISK_LEVEL_ID_HIGH = 3; - RISK_LEVEL_ID_CRITICAL = 4; - RISK_LEVEL_ID_OTHER = 99; - } - enum SeverityId { - SEVERITY_ID_UNKNOWN = 0; - SEVERITY_ID_INFORMATIONAL = 1; - SEVERITY_ID_LOW = 2; - SEVERITY_ID_MEDIUM = 3; - SEVERITY_ID_HIGH = 4; - SEVERITY_ID_CRITICAL = 5; - SEVERITY_ID_FATAL = 6; - SEVERITY_ID_OTHER = 99; - } - enum StatusId { - STATUS_ID_UNKNOWN = 0; - STATUS_ID_SUCCESS = 1; - STATUS_ID_FAILURE = 2; - STATUS_ID_OTHER = 99; - } - enum TypeUid { - TYPE_UID_UNKNOWN = 0; - TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; - TYPE_UID_API_ACTIVITY_CREATE = 600301; - TYPE_UID_API_ACTIVITY_READ = 600302; - TYPE_UID_API_ACTIVITY_UPDATE = 600303; - TYPE_UID_API_ACTIVITY_DELETE = 600304; - TYPE_UID_API_ACTIVITY_OTHER = 600399; - } - string action = 1; - ActionId action_id = 2; - ActivityId activity_id = 3 [(buf.validate.field).required = true]; - string activity_name = 4; - Actor actor = 5 [(buf.validate.field).required = true]; - AiModel ai_model = 6; - Api api = 7 [(buf.validate.field).required = true]; - repeated Attack attacks = 8; - repeated Authorization authorizations = 9; - string category_name = 10; - CategoryUid category_uid = 11 [(buf.validate.field).required = true]; - string class_name = 12; - ClassUid class_uid = 13 [(buf.validate.field).required = true]; - Cloud cloud = 14 [(buf.validate.field).required = true]; - string confidence = 15; - ConfidenceId confidence_id = 16; - int32 confidence_score = 17; - int32 count = 18; - Device device = 19; - string disposition = 20; - DispositionId disposition_id = 21; - NetworkEndpoint dst_endpoint = 22; - int64 duration = 23; - int64 end_time = 24; - string end_time_dt = 25; - repeated Enrichment enrichments = 26; - FirewallRule firewall_rule = 27; - HttpRequest http_request = 28; - HttpResponse http_response = 29; - bool is_alert = 30; - repeated Malware malware = 31; - MalwareScanInfo malware_scan_info = 32; - string message = 33; - MessageContext message_context = 34; - Metadata metadata = 35 [(buf.validate.field).required = true]; - repeated Observable observables = 36; - repeated Osint osint = 37; - Policy policy = 38; - string raw_data = 39; - Fingerprint raw_data_hash = 40; - int64 raw_data_size = 41; - repeated ResourceDetails resources = 42; - string risk_details = 43; - string risk_level = 44; - RiskLevelId risk_level_id = 45; - int32 risk_score = 46; - string severity = 47; - SeverityId severity_id = 48 [(buf.validate.field).required = true]; - NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; - int64 start_time = 50; - string start_time_dt = 51; - string status = 52; - string status_code = 53; - string status_detail = 54; - StatusId status_id = 55; - int64 time = 56 [(buf.validate.field).required = true]; - string time_dt = 57; - int32 timezone_offset = 58; - Trace trace = 59; - string type_name = 60; - TypeUid type_uid = 61 [(buf.validate.field).required = true]; - google.protobuf.Value unmapped = 62; -} - -message EntityManagement { - enum ActionId { - ACTION_ID_UNKNOWN = 0; - ACTION_ID_ALLOWED = 1; - ACTION_ID_DENIED = 2; - ACTION_ID_OBSERVED = 3; - ACTION_ID_MODIFIED = 4; - ACTION_ID_OTHER = 99; - } - enum ActivityId { - ACTIVITY_ID_UNKNOWN = 0; - ACTIVITY_ID_CREATE = 1; - ACTIVITY_ID_READ = 2; - ACTIVITY_ID_UPDATE = 3; - ACTIVITY_ID_DELETE = 4; - ACTIVITY_ID_MOVE = 5; - ACTIVITY_ID_ENROLL = 6; - ACTIVITY_ID_UNENROLL = 7; - ACTIVITY_ID_ENABLE = 8; - ACTIVITY_ID_DISABLE = 9; - ACTIVITY_ID_ACTIVATE = 10; - ACTIVITY_ID_DEACTIVATE = 11; - ACTIVITY_ID_SUSPEND = 12; - ACTIVITY_ID_RESUME = 13; - ACTIVITY_ID_OTHER = 99; - } - enum CategoryUid { - CATEGORY_UID_UNKNOWN = 0; - CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; - } - enum ClassUid { - CLASS_UID_UNKNOWN = 0; - CLASS_UID_ENTITY_MANAGEMENT = 3004; - } - enum ConfidenceId { - CONFIDENCE_ID_UNKNOWN = 0; - CONFIDENCE_ID_LOW = 1; - CONFIDENCE_ID_MEDIUM = 2; - CONFIDENCE_ID_HIGH = 3; - CONFIDENCE_ID_OTHER = 99; - } - enum DispositionId { - DISPOSITION_ID_UNKNOWN = 0; - DISPOSITION_ID_ALLOWED = 1; - DISPOSITION_ID_BLOCKED = 2; - DISPOSITION_ID_QUARANTINED = 3; - DISPOSITION_ID_ISOLATED = 4; - DISPOSITION_ID_DELETED = 5; - DISPOSITION_ID_DROPPED = 6; - DISPOSITION_ID_CUSTOM_ACTION = 7; - DISPOSITION_ID_APPROVED = 8; - DISPOSITION_ID_RESTORED = 9; - DISPOSITION_ID_EXONERATED = 10; - DISPOSITION_ID_CORRECTED = 11; - DISPOSITION_ID_PARTIALLY_CORRECTED = 12; - DISPOSITION_ID_UNCORRECTED = 13; - DISPOSITION_ID_DELAYED = 14; - DISPOSITION_ID_DETECTED = 15; - DISPOSITION_ID_NO_ACTION = 16; - DISPOSITION_ID_LOGGED = 17; - DISPOSITION_ID_TAGGED = 18; - DISPOSITION_ID_ALERT = 19; - DISPOSITION_ID_COUNT = 20; - DISPOSITION_ID_RESET = 21; - DISPOSITION_ID_CAPTCHA = 22; - DISPOSITION_ID_CHALLENGE = 23; - DISPOSITION_ID_ACCESS_REVOKED = 24; - DISPOSITION_ID_REJECTED = 25; - DISPOSITION_ID_UNAUTHORIZED = 26; - DISPOSITION_ID_ERROR = 27; - DISPOSITION_ID_OTHER = 99; - } - enum RiskLevelId { - RISK_LEVEL_ID_INFO = 0; - RISK_LEVEL_ID_LOW = 1; - RISK_LEVEL_ID_MEDIUM = 2; - RISK_LEVEL_ID_HIGH = 3; - RISK_LEVEL_ID_CRITICAL = 4; - RISK_LEVEL_ID_OTHER = 99; - } - enum SeverityId { - SEVERITY_ID_UNKNOWN = 0; - SEVERITY_ID_INFORMATIONAL = 1; - SEVERITY_ID_LOW = 2; - SEVERITY_ID_MEDIUM = 3; - SEVERITY_ID_HIGH = 4; - SEVERITY_ID_CRITICAL = 5; - SEVERITY_ID_FATAL = 6; - SEVERITY_ID_OTHER = 99; - } - enum StatusId { - STATUS_ID_UNKNOWN = 0; - STATUS_ID_SUCCESS = 1; - STATUS_ID_FAILURE = 2; - STATUS_ID_OTHER = 99; - } - enum TypeUid { - TYPE_UID_UNKNOWN = 0; - TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; - TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; - TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; - TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; - TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; - TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; - TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; - TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; - TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; - TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; - TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; - TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; - TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; - TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; - TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; - } - repeated string access_list = 1; - int32 access_mask = 2; - string action = 3; - ActionId action_id = 4; - ActivityId activity_id = 5 [(buf.validate.field).required = true]; - string activity_name = 6; - Actor actor = 7; - Api api = 8; - repeated Attack attacks = 9; - repeated Authorization authorizations = 10; - string category_name = 11; - CategoryUid category_uid = 12 [(buf.validate.field).required = true]; - string class_name = 13; - ClassUid class_uid = 14 [(buf.validate.field).required = true]; - Cloud cloud = 15 [(buf.validate.field).required = true]; - string comment = 16; - string confidence = 17; - ConfidenceId confidence_id = 18; - int32 confidence_score = 19; - int32 count = 20; - Device device = 21; - string disposition = 22; - DispositionId disposition_id = 23; - int64 duration = 24; - int64 end_time = 25; - string end_time_dt = 26; - repeated Enrichment enrichments = 27; - ManagedEntity entity = 28 [(buf.validate.field).required = true]; - ManagedEntity entity_result = 29; - FirewallRule firewall_rule = 30; - HttpRequest http_request = 31; - HttpResponse http_response = 32; - bool is_alert = 33; - repeated Malware malware = 34; - MalwareScanInfo malware_scan_info = 35; - string message = 36; - Metadata metadata = 37 [(buf.validate.field).required = true]; - repeated Observable observables = 38; - repeated Osint osint = 39; - Policy policy = 40; - string raw_data = 41; - Fingerprint raw_data_hash = 42; - int64 raw_data_size = 43; - string risk_details = 44; - string risk_level = 45; - RiskLevelId risk_level_id = 46; - int32 risk_score = 47; - string severity = 48; - SeverityId severity_id = 49 [(buf.validate.field).required = true]; - NetworkEndpoint src_endpoint = 50; - int64 start_time = 51; - string start_time_dt = 52; - string status = 53; - string status_code = 54; - string status_detail = 55; - StatusId status_id = 56; - int64 time = 57 [(buf.validate.field).required = true]; - string time_dt = 58; - int32 timezone_offset = 59; - string type_name = 60; - TypeUid type_uid = 61 [(buf.validate.field).required = true]; - google.protobuf.Value unmapped = 62; -} - message Account { option (buf.validate.message).cel = { id: "Account.at_least_one", diff --git a/ocsf/internal/ocsf/conformance/conformance_test.go b/ocsf/internal/ocsf/conformance/conformance_test.go index 7fcd116..657b9a1 100644 --- a/ocsf/internal/ocsf/conformance/conformance_test.go +++ b/ocsf/internal/ocsf/conformance/conformance_test.go @@ -38,7 +38,7 @@ import ( "github.com/stretchr/testify/require" "google.golang.org/protobuf/proto" - ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb" + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1" "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" ) diff --git a/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml b/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml index efcd809..61a219f 100644 --- a/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml +++ b/ocsf/internal/ocsf/conformance/genpb/buf.gen.yaml @@ -1,4 +1,4 @@ -# buf.gen.yaml — how api_entity.pb.go is produced from the golden proto. +# buf.gen.yaml — how the *.pb.go bindings are produced from the golden proto tree. # # Regenerate from the ocsf MODULE ROOT. The out/inputs paths below are # module-root-relative (no "../" counting), so the output always lands in @@ -9,12 +9,18 @@ # buf generate --template internal/ocsf/conformance/genpb/buf.gen.yaml # task fmt # gci/gofumpt the freshly generated .pb.go so the Format Check passes # +# The golden proto tree is now multi-file (one file per class plus a shared +# objects.proto), all in proto package ocsf.v1. Every file is mapped to the same +# Go import path + package alias (ocsfv1) so protoc-gen-go emits one .pb.go per +# .proto file, all in Go package ocsfv1 under genpb/ocsf/v1/. The conformance +# test imports the whole package under the ocsfv1 alias, so it is unaffected by +# the file split. +# # NOTE: do NOT set `clean: true` here — this config file lives inside the `out` # directory, so cleaning it would delete this file. The module-relative `out` -# is what keeps the location stable; genpb holds a single generated file, so -# there is nothing stale to clean. +# is what keeps the location stable. # -# Source proto: internal/ocsf/gen/testdata/golden/api_entity.proto +# Source protos: internal/ocsf/gen/testdata/golden/ocsf/v1/*.proto # buf binary: .build/bin/buf (from cloudv2) or any buf >= 1.30 on $PATH # protoc-gen-go: go install google.golang.org/protobuf/cmd/protoc-gen-go version: v2 @@ -23,6 +29,8 @@ plugins: out: internal/ocsf/conformance/genpb opt: - paths=source_relative - - Mapi_entity.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb;ocsfv1 + - Mocsf/v1/api_activity.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1;ocsfv1 + - Mocsf/v1/entity_management.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1;ocsfv1 + - Mocsf/v1/objects.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1;ocsfv1 inputs: - directory: internal/ocsf/gen/testdata/golden diff --git a/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/api_activity.pb.go b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/api_activity.pb.go new file mode 100644 index 0000000..282d238 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/api_activity.pb.go @@ -0,0 +1,1479 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.6 +// protoc (unknown) +// source: ocsf/v1/api_activity.proto + +package ocsfv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + structpb "google.golang.org/protobuf/types/known/structpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type ApiActivity_ActionId int32 + +const ( + ApiActivity_ACTION_ID_UNKNOWN ApiActivity_ActionId = 0 + ApiActivity_ACTION_ID_ALLOWED ApiActivity_ActionId = 1 + ApiActivity_ACTION_ID_DENIED ApiActivity_ActionId = 2 + ApiActivity_ACTION_ID_OBSERVED ApiActivity_ActionId = 3 + ApiActivity_ACTION_ID_MODIFIED ApiActivity_ActionId = 4 + ApiActivity_ACTION_ID_OTHER ApiActivity_ActionId = 99 +) + +// Enum value maps for ApiActivity_ActionId. +var ( + ApiActivity_ActionId_name = map[int32]string{ + 0: "ACTION_ID_UNKNOWN", + 1: "ACTION_ID_ALLOWED", + 2: "ACTION_ID_DENIED", + 3: "ACTION_ID_OBSERVED", + 4: "ACTION_ID_MODIFIED", + 99: "ACTION_ID_OTHER", + } + ApiActivity_ActionId_value = map[string]int32{ + "ACTION_ID_UNKNOWN": 0, + "ACTION_ID_ALLOWED": 1, + "ACTION_ID_DENIED": 2, + "ACTION_ID_OBSERVED": 3, + "ACTION_ID_MODIFIED": 4, + "ACTION_ID_OTHER": 99, + } +) + +func (x ApiActivity_ActionId) Enum() *ApiActivity_ActionId { + p := new(ApiActivity_ActionId) + *p = x + return p +} + +func (x ApiActivity_ActionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ActionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[0].Descriptor() +} + +func (ApiActivity_ActionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[0] +} + +func (x ApiActivity_ActionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ActionId.Descriptor instead. +func (ApiActivity_ActionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 0} +} + +type ApiActivity_ActivityId int32 + +const ( + ApiActivity_ACTIVITY_ID_UNKNOWN ApiActivity_ActivityId = 0 + ApiActivity_ACTIVITY_ID_CREATE ApiActivity_ActivityId = 1 + ApiActivity_ACTIVITY_ID_READ ApiActivity_ActivityId = 2 + ApiActivity_ACTIVITY_ID_UPDATE ApiActivity_ActivityId = 3 + ApiActivity_ACTIVITY_ID_DELETE ApiActivity_ActivityId = 4 + ApiActivity_ACTIVITY_ID_OTHER ApiActivity_ActivityId = 99 +) + +// Enum value maps for ApiActivity_ActivityId. +var ( + ApiActivity_ActivityId_name = map[int32]string{ + 0: "ACTIVITY_ID_UNKNOWN", + 1: "ACTIVITY_ID_CREATE", + 2: "ACTIVITY_ID_READ", + 3: "ACTIVITY_ID_UPDATE", + 4: "ACTIVITY_ID_DELETE", + 99: "ACTIVITY_ID_OTHER", + } + ApiActivity_ActivityId_value = map[string]int32{ + "ACTIVITY_ID_UNKNOWN": 0, + "ACTIVITY_ID_CREATE": 1, + "ACTIVITY_ID_READ": 2, + "ACTIVITY_ID_UPDATE": 3, + "ACTIVITY_ID_DELETE": 4, + "ACTIVITY_ID_OTHER": 99, + } +) + +func (x ApiActivity_ActivityId) Enum() *ApiActivity_ActivityId { + p := new(ApiActivity_ActivityId) + *p = x + return p +} + +func (x ApiActivity_ActivityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ActivityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[1].Descriptor() +} + +func (ApiActivity_ActivityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[1] +} + +func (x ApiActivity_ActivityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ActivityId.Descriptor instead. +func (ApiActivity_ActivityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 1} +} + +type ApiActivity_CategoryUid int32 + +const ( + ApiActivity_CATEGORY_UID_UNKNOWN ApiActivity_CategoryUid = 0 + ApiActivity_CATEGORY_UID_APPLICATION_ACTIVITY ApiActivity_CategoryUid = 6 +) + +// Enum value maps for ApiActivity_CategoryUid. +var ( + ApiActivity_CategoryUid_name = map[int32]string{ + 0: "CATEGORY_UID_UNKNOWN", + 6: "CATEGORY_UID_APPLICATION_ACTIVITY", + } + ApiActivity_CategoryUid_value = map[string]int32{ + "CATEGORY_UID_UNKNOWN": 0, + "CATEGORY_UID_APPLICATION_ACTIVITY": 6, + } +) + +func (x ApiActivity_CategoryUid) Enum() *ApiActivity_CategoryUid { + p := new(ApiActivity_CategoryUid) + *p = x + return p +} + +func (x ApiActivity_CategoryUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_CategoryUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[2].Descriptor() +} + +func (ApiActivity_CategoryUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[2] +} + +func (x ApiActivity_CategoryUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_CategoryUid.Descriptor instead. +func (ApiActivity_CategoryUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 2} +} + +type ApiActivity_ClassUid int32 + +const ( + ApiActivity_CLASS_UID_UNKNOWN ApiActivity_ClassUid = 0 + ApiActivity_CLASS_UID_API_ACTIVITY ApiActivity_ClassUid = 6003 +) + +// Enum value maps for ApiActivity_ClassUid. +var ( + ApiActivity_ClassUid_name = map[int32]string{ + 0: "CLASS_UID_UNKNOWN", + 6003: "CLASS_UID_API_ACTIVITY", + } + ApiActivity_ClassUid_value = map[string]int32{ + "CLASS_UID_UNKNOWN": 0, + "CLASS_UID_API_ACTIVITY": 6003, + } +) + +func (x ApiActivity_ClassUid) Enum() *ApiActivity_ClassUid { + p := new(ApiActivity_ClassUid) + *p = x + return p +} + +func (x ApiActivity_ClassUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ClassUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[3].Descriptor() +} + +func (ApiActivity_ClassUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[3] +} + +func (x ApiActivity_ClassUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ClassUid.Descriptor instead. +func (ApiActivity_ClassUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 3} +} + +type ApiActivity_ConfidenceId int32 + +const ( + ApiActivity_CONFIDENCE_ID_UNKNOWN ApiActivity_ConfidenceId = 0 + ApiActivity_CONFIDENCE_ID_LOW ApiActivity_ConfidenceId = 1 + ApiActivity_CONFIDENCE_ID_MEDIUM ApiActivity_ConfidenceId = 2 + ApiActivity_CONFIDENCE_ID_HIGH ApiActivity_ConfidenceId = 3 + ApiActivity_CONFIDENCE_ID_OTHER ApiActivity_ConfidenceId = 99 +) + +// Enum value maps for ApiActivity_ConfidenceId. +var ( + ApiActivity_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + ApiActivity_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x ApiActivity_ConfidenceId) Enum() *ApiActivity_ConfidenceId { + p := new(ApiActivity_ConfidenceId) + *p = x + return p +} + +func (x ApiActivity_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[4].Descriptor() +} + +func (ApiActivity_ConfidenceId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[4] +} + +func (x ApiActivity_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_ConfidenceId.Descriptor instead. +func (ApiActivity_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 4} +} + +type ApiActivity_DispositionId int32 + +const ( + ApiActivity_DISPOSITION_ID_UNKNOWN ApiActivity_DispositionId = 0 + ApiActivity_DISPOSITION_ID_ALLOWED ApiActivity_DispositionId = 1 + ApiActivity_DISPOSITION_ID_BLOCKED ApiActivity_DispositionId = 2 + ApiActivity_DISPOSITION_ID_QUARANTINED ApiActivity_DispositionId = 3 + ApiActivity_DISPOSITION_ID_ISOLATED ApiActivity_DispositionId = 4 + ApiActivity_DISPOSITION_ID_DELETED ApiActivity_DispositionId = 5 + ApiActivity_DISPOSITION_ID_DROPPED ApiActivity_DispositionId = 6 + ApiActivity_DISPOSITION_ID_CUSTOM_ACTION ApiActivity_DispositionId = 7 + ApiActivity_DISPOSITION_ID_APPROVED ApiActivity_DispositionId = 8 + ApiActivity_DISPOSITION_ID_RESTORED ApiActivity_DispositionId = 9 + ApiActivity_DISPOSITION_ID_EXONERATED ApiActivity_DispositionId = 10 + ApiActivity_DISPOSITION_ID_CORRECTED ApiActivity_DispositionId = 11 + ApiActivity_DISPOSITION_ID_PARTIALLY_CORRECTED ApiActivity_DispositionId = 12 + ApiActivity_DISPOSITION_ID_UNCORRECTED ApiActivity_DispositionId = 13 + ApiActivity_DISPOSITION_ID_DELAYED ApiActivity_DispositionId = 14 + ApiActivity_DISPOSITION_ID_DETECTED ApiActivity_DispositionId = 15 + ApiActivity_DISPOSITION_ID_NO_ACTION ApiActivity_DispositionId = 16 + ApiActivity_DISPOSITION_ID_LOGGED ApiActivity_DispositionId = 17 + ApiActivity_DISPOSITION_ID_TAGGED ApiActivity_DispositionId = 18 + ApiActivity_DISPOSITION_ID_ALERT ApiActivity_DispositionId = 19 + ApiActivity_DISPOSITION_ID_COUNT ApiActivity_DispositionId = 20 + ApiActivity_DISPOSITION_ID_RESET ApiActivity_DispositionId = 21 + ApiActivity_DISPOSITION_ID_CAPTCHA ApiActivity_DispositionId = 22 + ApiActivity_DISPOSITION_ID_CHALLENGE ApiActivity_DispositionId = 23 + ApiActivity_DISPOSITION_ID_ACCESS_REVOKED ApiActivity_DispositionId = 24 + ApiActivity_DISPOSITION_ID_REJECTED ApiActivity_DispositionId = 25 + ApiActivity_DISPOSITION_ID_UNAUTHORIZED ApiActivity_DispositionId = 26 + ApiActivity_DISPOSITION_ID_ERROR ApiActivity_DispositionId = 27 + ApiActivity_DISPOSITION_ID_OTHER ApiActivity_DispositionId = 99 +) + +// Enum value maps for ApiActivity_DispositionId. +var ( + ApiActivity_DispositionId_name = map[int32]string{ + 0: "DISPOSITION_ID_UNKNOWN", + 1: "DISPOSITION_ID_ALLOWED", + 2: "DISPOSITION_ID_BLOCKED", + 3: "DISPOSITION_ID_QUARANTINED", + 4: "DISPOSITION_ID_ISOLATED", + 5: "DISPOSITION_ID_DELETED", + 6: "DISPOSITION_ID_DROPPED", + 7: "DISPOSITION_ID_CUSTOM_ACTION", + 8: "DISPOSITION_ID_APPROVED", + 9: "DISPOSITION_ID_RESTORED", + 10: "DISPOSITION_ID_EXONERATED", + 11: "DISPOSITION_ID_CORRECTED", + 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", + 13: "DISPOSITION_ID_UNCORRECTED", + 14: "DISPOSITION_ID_DELAYED", + 15: "DISPOSITION_ID_DETECTED", + 16: "DISPOSITION_ID_NO_ACTION", + 17: "DISPOSITION_ID_LOGGED", + 18: "DISPOSITION_ID_TAGGED", + 19: "DISPOSITION_ID_ALERT", + 20: "DISPOSITION_ID_COUNT", + 21: "DISPOSITION_ID_RESET", + 22: "DISPOSITION_ID_CAPTCHA", + 23: "DISPOSITION_ID_CHALLENGE", + 24: "DISPOSITION_ID_ACCESS_REVOKED", + 25: "DISPOSITION_ID_REJECTED", + 26: "DISPOSITION_ID_UNAUTHORIZED", + 27: "DISPOSITION_ID_ERROR", + 99: "DISPOSITION_ID_OTHER", + } + ApiActivity_DispositionId_value = map[string]int32{ + "DISPOSITION_ID_UNKNOWN": 0, + "DISPOSITION_ID_ALLOWED": 1, + "DISPOSITION_ID_BLOCKED": 2, + "DISPOSITION_ID_QUARANTINED": 3, + "DISPOSITION_ID_ISOLATED": 4, + "DISPOSITION_ID_DELETED": 5, + "DISPOSITION_ID_DROPPED": 6, + "DISPOSITION_ID_CUSTOM_ACTION": 7, + "DISPOSITION_ID_APPROVED": 8, + "DISPOSITION_ID_RESTORED": 9, + "DISPOSITION_ID_EXONERATED": 10, + "DISPOSITION_ID_CORRECTED": 11, + "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, + "DISPOSITION_ID_UNCORRECTED": 13, + "DISPOSITION_ID_DELAYED": 14, + "DISPOSITION_ID_DETECTED": 15, + "DISPOSITION_ID_NO_ACTION": 16, + "DISPOSITION_ID_LOGGED": 17, + "DISPOSITION_ID_TAGGED": 18, + "DISPOSITION_ID_ALERT": 19, + "DISPOSITION_ID_COUNT": 20, + "DISPOSITION_ID_RESET": 21, + "DISPOSITION_ID_CAPTCHA": 22, + "DISPOSITION_ID_CHALLENGE": 23, + "DISPOSITION_ID_ACCESS_REVOKED": 24, + "DISPOSITION_ID_REJECTED": 25, + "DISPOSITION_ID_UNAUTHORIZED": 26, + "DISPOSITION_ID_ERROR": 27, + "DISPOSITION_ID_OTHER": 99, + } +) + +func (x ApiActivity_DispositionId) Enum() *ApiActivity_DispositionId { + p := new(ApiActivity_DispositionId) + *p = x + return p +} + +func (x ApiActivity_DispositionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_DispositionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[5].Descriptor() +} + +func (ApiActivity_DispositionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[5] +} + +func (x ApiActivity_DispositionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_DispositionId.Descriptor instead. +func (ApiActivity_DispositionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 5} +} + +type ApiActivity_RiskLevelId int32 + +const ( + ApiActivity_RISK_LEVEL_ID_INFO ApiActivity_RiskLevelId = 0 + ApiActivity_RISK_LEVEL_ID_LOW ApiActivity_RiskLevelId = 1 + ApiActivity_RISK_LEVEL_ID_MEDIUM ApiActivity_RiskLevelId = 2 + ApiActivity_RISK_LEVEL_ID_HIGH ApiActivity_RiskLevelId = 3 + ApiActivity_RISK_LEVEL_ID_CRITICAL ApiActivity_RiskLevelId = 4 + ApiActivity_RISK_LEVEL_ID_OTHER ApiActivity_RiskLevelId = 99 +) + +// Enum value maps for ApiActivity_RiskLevelId. +var ( + ApiActivity_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + ApiActivity_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x ApiActivity_RiskLevelId) Enum() *ApiActivity_RiskLevelId { + p := new(ApiActivity_RiskLevelId) + *p = x + return p +} + +func (x ApiActivity_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[6].Descriptor() +} + +func (ApiActivity_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[6] +} + +func (x ApiActivity_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_RiskLevelId.Descriptor instead. +func (ApiActivity_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 6} +} + +type ApiActivity_SeverityId int32 + +const ( + ApiActivity_SEVERITY_ID_UNKNOWN ApiActivity_SeverityId = 0 + ApiActivity_SEVERITY_ID_INFORMATIONAL ApiActivity_SeverityId = 1 + ApiActivity_SEVERITY_ID_LOW ApiActivity_SeverityId = 2 + ApiActivity_SEVERITY_ID_MEDIUM ApiActivity_SeverityId = 3 + ApiActivity_SEVERITY_ID_HIGH ApiActivity_SeverityId = 4 + ApiActivity_SEVERITY_ID_CRITICAL ApiActivity_SeverityId = 5 + ApiActivity_SEVERITY_ID_FATAL ApiActivity_SeverityId = 6 + ApiActivity_SEVERITY_ID_OTHER ApiActivity_SeverityId = 99 +) + +// Enum value maps for ApiActivity_SeverityId. +var ( + ApiActivity_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + ApiActivity_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x ApiActivity_SeverityId) Enum() *ApiActivity_SeverityId { + p := new(ApiActivity_SeverityId) + *p = x + return p +} + +func (x ApiActivity_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[7].Descriptor() +} + +func (ApiActivity_SeverityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[7] +} + +func (x ApiActivity_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_SeverityId.Descriptor instead. +func (ApiActivity_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 7} +} + +type ApiActivity_StatusId int32 + +const ( + ApiActivity_STATUS_ID_UNKNOWN ApiActivity_StatusId = 0 + ApiActivity_STATUS_ID_SUCCESS ApiActivity_StatusId = 1 + ApiActivity_STATUS_ID_FAILURE ApiActivity_StatusId = 2 + ApiActivity_STATUS_ID_OTHER ApiActivity_StatusId = 99 +) + +// Enum value maps for ApiActivity_StatusId. +var ( + ApiActivity_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_SUCCESS", + 2: "STATUS_ID_FAILURE", + 99: "STATUS_ID_OTHER", + } + ApiActivity_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_SUCCESS": 1, + "STATUS_ID_FAILURE": 2, + "STATUS_ID_OTHER": 99, + } +) + +func (x ApiActivity_StatusId) Enum() *ApiActivity_StatusId { + p := new(ApiActivity_StatusId) + *p = x + return p +} + +func (x ApiActivity_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[8].Descriptor() +} + +func (ApiActivity_StatusId) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[8] +} + +func (x ApiActivity_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_StatusId.Descriptor instead. +func (ApiActivity_StatusId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 8} +} + +type ApiActivity_TypeUid int32 + +const ( + ApiActivity_TYPE_UID_UNKNOWN ApiActivity_TypeUid = 0 + ApiActivity_TYPE_UID_API_ACTIVITY_UNKNOWN ApiActivity_TypeUid = 600300 + ApiActivity_TYPE_UID_API_ACTIVITY_CREATE ApiActivity_TypeUid = 600301 + ApiActivity_TYPE_UID_API_ACTIVITY_READ ApiActivity_TypeUid = 600302 + ApiActivity_TYPE_UID_API_ACTIVITY_UPDATE ApiActivity_TypeUid = 600303 + ApiActivity_TYPE_UID_API_ACTIVITY_DELETE ApiActivity_TypeUid = 600304 + ApiActivity_TYPE_UID_API_ACTIVITY_OTHER ApiActivity_TypeUid = 600399 +) + +// Enum value maps for ApiActivity_TypeUid. +var ( + ApiActivity_TypeUid_name = map[int32]string{ + 0: "TYPE_UID_UNKNOWN", + 600300: "TYPE_UID_API_ACTIVITY_UNKNOWN", + 600301: "TYPE_UID_API_ACTIVITY_CREATE", + 600302: "TYPE_UID_API_ACTIVITY_READ", + 600303: "TYPE_UID_API_ACTIVITY_UPDATE", + 600304: "TYPE_UID_API_ACTIVITY_DELETE", + 600399: "TYPE_UID_API_ACTIVITY_OTHER", + } + ApiActivity_TypeUid_value = map[string]int32{ + "TYPE_UID_UNKNOWN": 0, + "TYPE_UID_API_ACTIVITY_UNKNOWN": 600300, + "TYPE_UID_API_ACTIVITY_CREATE": 600301, + "TYPE_UID_API_ACTIVITY_READ": 600302, + "TYPE_UID_API_ACTIVITY_UPDATE": 600303, + "TYPE_UID_API_ACTIVITY_DELETE": 600304, + "TYPE_UID_API_ACTIVITY_OTHER": 600399, + } +) + +func (x ApiActivity_TypeUid) Enum() *ApiActivity_TypeUid { + p := new(ApiActivity_TypeUid) + *p = x + return p +} + +func (x ApiActivity_TypeUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ApiActivity_TypeUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_api_activity_proto_enumTypes[9].Descriptor() +} + +func (ApiActivity_TypeUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_api_activity_proto_enumTypes[9] +} + +func (x ApiActivity_TypeUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ApiActivity_TypeUid.Descriptor instead. +func (ApiActivity_TypeUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0, 9} +} + +type ApiActivity struct { + state protoimpl.MessageState `protogen:"open.v1"` + Action string `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"` + ActionId ApiActivity_ActionId `protobuf:"varint,2,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.ApiActivity_ActionId" json:"action_id,omitempty"` + ActivityId ApiActivity_ActivityId `protobuf:"varint,3,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.ApiActivity_ActivityId" json:"activity_id,omitempty"` + ActivityName string `protobuf:"bytes,4,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` + Actor *Actor `protobuf:"bytes,5,opt,name=actor,proto3" json:"actor,omitempty"` + AiModel *AiModel `protobuf:"bytes,6,opt,name=ai_model,json=aiModel,proto3" json:"ai_model,omitempty"` + Api *Api `protobuf:"bytes,7,opt,name=api,proto3" json:"api,omitempty"` + Attacks []*Attack `protobuf:"bytes,8,rep,name=attacks,proto3" json:"attacks,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,9,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + CategoryName string `protobuf:"bytes,10,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` + CategoryUid ApiActivity_CategoryUid `protobuf:"varint,11,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.ApiActivity_CategoryUid" json:"category_uid,omitempty"` + ClassName string `protobuf:"bytes,12,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` + ClassUid ApiActivity_ClassUid `protobuf:"varint,13,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.ApiActivity_ClassUid" json:"class_uid,omitempty"` + Cloud *Cloud `protobuf:"bytes,14,opt,name=cloud,proto3" json:"cloud,omitempty"` + Confidence string `protobuf:"bytes,15,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId ApiActivity_ConfidenceId `protobuf:"varint,16,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.ApiActivity_ConfidenceId" json:"confidence_id,omitempty"` + ConfidenceScore int32 `protobuf:"varint,17,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` + Count int32 `protobuf:"varint,18,opt,name=count,proto3" json:"count,omitempty"` + Device *Device `protobuf:"bytes,19,opt,name=device,proto3" json:"device,omitempty"` + Disposition string `protobuf:"bytes,20,opt,name=disposition,proto3" json:"disposition,omitempty"` + DispositionId ApiActivity_DispositionId `protobuf:"varint,21,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.ApiActivity_DispositionId" json:"disposition_id,omitempty"` + DstEndpoint *NetworkEndpoint `protobuf:"bytes,22,opt,name=dst_endpoint,json=dstEndpoint,proto3" json:"dst_endpoint,omitempty"` + Duration int64 `protobuf:"varint,23,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,24,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,25,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Enrichments []*Enrichment `protobuf:"bytes,26,rep,name=enrichments,proto3" json:"enrichments,omitempty"` + FirewallRule *FirewallRule `protobuf:"bytes,27,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` + HttpRequest *HttpRequest `protobuf:"bytes,28,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` + HttpResponse *HttpResponse `protobuf:"bytes,29,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` + IsAlert bool `protobuf:"varint,30,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + Malware []*Malware `protobuf:"bytes,31,rep,name=malware,proto3" json:"malware,omitempty"` + MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,32,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` + Message string `protobuf:"bytes,33,opt,name=message,proto3" json:"message,omitempty"` + MessageContext *MessageContext `protobuf:"bytes,34,opt,name=message_context,json=messageContext,proto3" json:"message_context,omitempty"` + Metadata *Metadata `protobuf:"bytes,35,opt,name=metadata,proto3" json:"metadata,omitempty"` + Observables []*Observable `protobuf:"bytes,36,rep,name=observables,proto3" json:"observables,omitempty"` + Osint []*Osint `protobuf:"bytes,37,rep,name=osint,proto3" json:"osint,omitempty"` + Policy *Policy `protobuf:"bytes,38,opt,name=policy,proto3" json:"policy,omitempty"` + RawData string `protobuf:"bytes,39,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` + RawDataHash *Fingerprint `protobuf:"bytes,40,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` + RawDataSize int64 `protobuf:"varint,41,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` + Resources []*ResourceDetails `protobuf:"bytes,42,rep,name=resources,proto3" json:"resources,omitempty"` + RiskDetails string `protobuf:"bytes,43,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` + RiskLevel string `protobuf:"bytes,44,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId ApiActivity_RiskLevelId `protobuf:"varint,45,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.ApiActivity_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,46,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Severity string `protobuf:"bytes,47,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId ApiActivity_SeverityId `protobuf:"varint,48,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.ApiActivity_SeverityId" json:"severity_id,omitempty"` + SrcEndpoint *NetworkEndpoint `protobuf:"bytes,49,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` + StartTime int64 `protobuf:"varint,50,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,51,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Status string `protobuf:"bytes,52,opt,name=status,proto3" json:"status,omitempty"` + StatusCode string `protobuf:"bytes,53,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + StatusDetail string `protobuf:"bytes,54,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` + StatusId ApiActivity_StatusId `protobuf:"varint,55,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.ApiActivity_StatusId" json:"status_id,omitempty"` + Time int64 `protobuf:"varint,56,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,57,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + TimezoneOffset int32 `protobuf:"varint,58,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` + Trace *Trace `protobuf:"bytes,59,opt,name=trace,proto3" json:"trace,omitempty"` + TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` + TypeUid ApiActivity_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.ApiActivity_TypeUid" json:"type_uid,omitempty"` + Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ApiActivity) Reset() { + *x = ApiActivity{} + mi := &file_ocsf_v1_api_activity_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ApiActivity) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ApiActivity) ProtoMessage() {} + +func (x *ApiActivity) ProtoReflect() protoreflect.Message { + mi := &file_ocsf_v1_api_activity_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ApiActivity.ProtoReflect.Descriptor instead. +func (*ApiActivity) Descriptor() ([]byte, []int) { + return file_ocsf_v1_api_activity_proto_rawDescGZIP(), []int{0} +} + +func (x *ApiActivity) GetAction() string { + if x != nil { + return x.Action + } + return "" +} + +func (x *ApiActivity) GetActionId() ApiActivity_ActionId { + if x != nil { + return x.ActionId + } + return ApiActivity_ACTION_ID_UNKNOWN +} + +func (x *ApiActivity) GetActivityId() ApiActivity_ActivityId { + if x != nil { + return x.ActivityId + } + return ApiActivity_ACTIVITY_ID_UNKNOWN +} + +func (x *ApiActivity) GetActivityName() string { + if x != nil { + return x.ActivityName + } + return "" +} + +func (x *ApiActivity) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *ApiActivity) GetAiModel() *AiModel { + if x != nil { + return x.AiModel + } + return nil +} + +func (x *ApiActivity) GetApi() *Api { + if x != nil { + return x.Api + } + return nil +} + +func (x *ApiActivity) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *ApiActivity) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *ApiActivity) GetCategoryName() string { + if x != nil { + return x.CategoryName + } + return "" +} + +func (x *ApiActivity) GetCategoryUid() ApiActivity_CategoryUid { + if x != nil { + return x.CategoryUid + } + return ApiActivity_CATEGORY_UID_UNKNOWN +} + +func (x *ApiActivity) GetClassName() string { + if x != nil { + return x.ClassName + } + return "" +} + +func (x *ApiActivity) GetClassUid() ApiActivity_ClassUid { + if x != nil { + return x.ClassUid + } + return ApiActivity_CLASS_UID_UNKNOWN +} + +func (x *ApiActivity) GetCloud() *Cloud { + if x != nil { + return x.Cloud + } + return nil +} + +func (x *ApiActivity) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *ApiActivity) GetConfidenceId() ApiActivity_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return ApiActivity_CONFIDENCE_ID_UNKNOWN +} + +func (x *ApiActivity) GetConfidenceScore() int32 { + if x != nil { + return x.ConfidenceScore + } + return 0 +} + +func (x *ApiActivity) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *ApiActivity) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *ApiActivity) GetDisposition() string { + if x != nil { + return x.Disposition + } + return "" +} + +func (x *ApiActivity) GetDispositionId() ApiActivity_DispositionId { + if x != nil { + return x.DispositionId + } + return ApiActivity_DISPOSITION_ID_UNKNOWN +} + +func (x *ApiActivity) GetDstEndpoint() *NetworkEndpoint { + if x != nil { + return x.DstEndpoint + } + return nil +} + +func (x *ApiActivity) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *ApiActivity) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *ApiActivity) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *ApiActivity) GetEnrichments() []*Enrichment { + if x != nil { + return x.Enrichments + } + return nil +} + +func (x *ApiActivity) GetFirewallRule() *FirewallRule { + if x != nil { + return x.FirewallRule + } + return nil +} + +func (x *ApiActivity) GetHttpRequest() *HttpRequest { + if x != nil { + return x.HttpRequest + } + return nil +} + +func (x *ApiActivity) GetHttpResponse() *HttpResponse { + if x != nil { + return x.HttpResponse + } + return nil +} + +func (x *ApiActivity) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *ApiActivity) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *ApiActivity) GetMalwareScanInfo() *MalwareScanInfo { + if x != nil { + return x.MalwareScanInfo + } + return nil +} + +func (x *ApiActivity) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *ApiActivity) GetMessageContext() *MessageContext { + if x != nil { + return x.MessageContext + } + return nil +} + +func (x *ApiActivity) GetMetadata() *Metadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *ApiActivity) GetObservables() []*Observable { + if x != nil { + return x.Observables + } + return nil +} + +func (x *ApiActivity) GetOsint() []*Osint { + if x != nil { + return x.Osint + } + return nil +} + +func (x *ApiActivity) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *ApiActivity) GetRawData() string { + if x != nil { + return x.RawData + } + return "" +} + +func (x *ApiActivity) GetRawDataHash() *Fingerprint { + if x != nil { + return x.RawDataHash + } + return nil +} + +func (x *ApiActivity) GetRawDataSize() int64 { + if x != nil { + return x.RawDataSize + } + return 0 +} + +func (x *ApiActivity) GetResources() []*ResourceDetails { + if x != nil { + return x.Resources + } + return nil +} + +func (x *ApiActivity) GetRiskDetails() string { + if x != nil { + return x.RiskDetails + } + return "" +} + +func (x *ApiActivity) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *ApiActivity) GetRiskLevelId() ApiActivity_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return ApiActivity_RISK_LEVEL_ID_INFO +} + +func (x *ApiActivity) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *ApiActivity) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *ApiActivity) GetSeverityId() ApiActivity_SeverityId { + if x != nil { + return x.SeverityId + } + return ApiActivity_SEVERITY_ID_UNKNOWN +} + +func (x *ApiActivity) GetSrcEndpoint() *NetworkEndpoint { + if x != nil { + return x.SrcEndpoint + } + return nil +} + +func (x *ApiActivity) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *ApiActivity) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *ApiActivity) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *ApiActivity) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *ApiActivity) GetStatusDetail() string { + if x != nil { + return x.StatusDetail + } + return "" +} + +func (x *ApiActivity) GetStatusId() ApiActivity_StatusId { + if x != nil { + return x.StatusId + } + return ApiActivity_STATUS_ID_UNKNOWN +} + +func (x *ApiActivity) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *ApiActivity) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *ApiActivity) GetTimezoneOffset() int32 { + if x != nil { + return x.TimezoneOffset + } + return 0 +} + +func (x *ApiActivity) GetTrace() *Trace { + if x != nil { + return x.Trace + } + return nil +} + +func (x *ApiActivity) GetTypeName() string { + if x != nil { + return x.TypeName + } + return "" +} + +func (x *ApiActivity) GetTypeUid() ApiActivity_TypeUid { + if x != nil { + return x.TypeUid + } + return ApiActivity_TYPE_UID_UNKNOWN +} + +func (x *ApiActivity) GetUnmapped() *structpb.Value { + if x != nil { + return x.Unmapped + } + return nil +} + +var File_ocsf_v1_api_activity_proto protoreflect.FileDescriptor + +const file_ocsf_v1_api_activity_proto_rawDesc = "" + + "\n" + + "\x1aocsf/v1/api_activity.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x15ocsf/v1/objects.proto\"\xa5'\n" + + "\vApiActivity\x12\x16\n" + + "\x06action\x18\x01 \x01(\tR\x06action\x12:\n" + + "\taction_id\x18\x02 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ActionIdR\bactionId\x12H\n" + + "\vactivity_id\x18\x03 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "activityId\x12#\n" + + "\ractivity_name\x18\x04 \x01(\tR\factivityName\x12,\n" + + "\x05actor\x18\x05 \x01(\v2\x0e.ocsf.v1.ActorB\x06\xbaH\x03\xc8\x01\x01R\x05actor\x12+\n" + + "\bai_model\x18\x06 \x01(\v2\x10.ocsf.v1.AiModelR\aaiModel\x12&\n" + + "\x03api\x18\a \x01(\v2\f.ocsf.v1.ApiB\x06\xbaH\x03\xc8\x01\x01R\x03api\x12)\n" + + "\aattacks\x18\b \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + + "\x0eauthorizations\x18\t \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + + "\rcategory_name\x18\n" + + " \x01(\tR\fcategoryName\x12K\n" + + "\fcategory_uid\x18\v \x01(\x0e2 .ocsf.v1.ApiActivity.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + + "\n" + + "class_name\x18\f \x01(\tR\tclassName\x12B\n" + + "\tclass_uid\x18\r \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + + "\x05cloud\x18\x0e \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x1e\n" + + "\n" + + "confidence\x18\x0f \x01(\tR\n" + + "confidence\x12F\n" + + "\rconfidence_id\x18\x10 \x01(\x0e2!.ocsf.v1.ApiActivity.ConfidenceIdR\fconfidenceId\x12)\n" + + "\x10confidence_score\x18\x11 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + + "\x05count\x18\x12 \x01(\x05R\x05count\x12'\n" + + "\x06device\x18\x13 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + + "\vdisposition\x18\x14 \x01(\tR\vdisposition\x12I\n" + + "\x0edisposition_id\x18\x15 \x01(\x0e2\".ocsf.v1.ApiActivity.DispositionIdR\rdispositionId\x12;\n" + + "\fdst_endpoint\x18\x16 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vdstEndpoint\x12\x1a\n" + + "\bduration\x18\x17 \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x18 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x19 \x01(\tR\tendTimeDt\x125\n" + + "\venrichments\x18\x1a \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x12:\n" + + "\rfirewall_rule\x18\x1b \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + + "\fhttp_request\x18\x1c \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + + "\rhttp_response\x18\x1d \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + + "\bis_alert\x18\x1e \x01(\bR\aisAlert\x12*\n" + + "\amalware\x18\x1f \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + + "\x11malware_scan_info\x18 \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + + "\amessage\x18! \x01(\tR\amessage\x12@\n" + + "\x0fmessage_context\x18\" \x01(\v2\x17.ocsf.v1.MessageContextR\x0emessageContext\x125\n" + + "\bmetadata\x18# \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + + "\vobservables\x18$ \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + + "\x05osint\x18% \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + + "\x06policy\x18& \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + + "\braw_data\x18' \x01(\tR\arawData\x128\n" + + "\rraw_data_hash\x18( \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + + "\rraw_data_size\x18) \x01(\x03R\vrawDataSize\x126\n" + + "\tresources\x18* \x03(\v2\x18.ocsf.v1.ResourceDetailsR\tresources\x12!\n" + + "\frisk_details\x18+ \x01(\tR\vriskDetails\x12\x1d\n" + + "\n" + + "risk_level\x18, \x01(\tR\triskLevel\x12D\n" + + "\rrisk_level_id\x18- \x01(\x0e2 .ocsf.v1.ApiActivity.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18. \x01(\x05R\triskScore\x12\x1a\n" + + "\bseverity\x18/ \x01(\tR\bseverity\x12H\n" + + "\vseverity_id\x180 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "severityId\x12C\n" + + "\fsrc_endpoint\x181 \x01(\v2\x18.ocsf.v1.NetworkEndpointB\x06\xbaH\x03\xc8\x01\x01R\vsrcEndpoint\x12\x1d\n" + + "\n" + + "start_time\x182 \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x183 \x01(\tR\vstartTimeDt\x12\x16\n" + + "\x06status\x184 \x01(\tR\x06status\x12\x1f\n" + + "\vstatus_code\x185 \x01(\tR\n" + + "statusCode\x12#\n" + + "\rstatus_detail\x186 \x01(\tR\fstatusDetail\x12:\n" + + "\tstatus_id\x187 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.StatusIdR\bstatusId\x12\x1a\n" + + "\x04time\x188 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + + "\atime_dt\x189 \x01(\tR\x06timeDt\x12'\n" + + "\x0ftimezone_offset\x18: \x01(\x05R\x0etimezoneOffset\x12$\n" + + "\x05trace\x18; \x01(\v2\x0e.ocsf.v1.TraceR\x05trace\x12\x1b\n" + + "\ttype_name\x18< \x01(\tR\btypeName\x12?\n" + + "\btype_uid\x18= \x01(\x0e2\x1c.ocsf.v1.ApiActivity.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + + "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + + "\bActionId\x12\x15\n" + + "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + + "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + + "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + + "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + + "\x0fACTION_ID_OTHER\x10c\"\x9a\x01\n" + + "\n" + + "ActivityId\x12\x17\n" + + "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + + "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + + "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + + "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x15\n" + + "\x11ACTIVITY_ID_OTHER\x10c\"N\n" + + "\vCategoryUid\x12\x18\n" + + "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12%\n" + + "!CATEGORY_UID_APPLICATION_ACTIVITY\x10\x06\">\n" + + "\bClassUid\x12\x15\n" + + "\x11CLASS_UID_UNKNOWN\x10\x00\x12\x1b\n" + + "\x16CLASS_UID_API_ACTIVITY\x10\xf3.\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + + "\rDispositionId\x12\x1a\n" + + "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + + "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + + "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + + "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + + "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + + "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + + "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + + "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + + "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + + "\x19DISPOSITION_ID_EXONERATED\x10\n" + + "\x12\x1c\n" + + "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + + "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + + "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + + "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + + "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + + "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + + "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + + "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + + "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + + "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + + "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + + "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + + "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + + "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + + "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + + "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + + "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + + "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"d\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + + "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c\"\xf5\x01\n" + + "\aTypeUid\x12\x14\n" + + "\x10TYPE_UID_UNKNOWN\x10\x00\x12#\n" + + "\x1dTYPE_UID_API_ACTIVITY_UNKNOWN\x10\xec\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_CREATE\x10\xed\xd1$\x12 \n" + + "\x1aTYPE_UID_API_ACTIVITY_READ\x10\xee\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_UPDATE\x10\xef\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_DELETE\x10\xf0\xd1$\x12!\n" + + "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$b\x06proto3" + +var ( + file_ocsf_v1_api_activity_proto_rawDescOnce sync.Once + file_ocsf_v1_api_activity_proto_rawDescData []byte +) + +func file_ocsf_v1_api_activity_proto_rawDescGZIP() []byte { + file_ocsf_v1_api_activity_proto_rawDescOnce.Do(func() { + file_ocsf_v1_api_activity_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ocsf_v1_api_activity_proto_rawDesc), len(file_ocsf_v1_api_activity_proto_rawDesc))) + }) + return file_ocsf_v1_api_activity_proto_rawDescData +} + +var file_ocsf_v1_api_activity_proto_enumTypes = make([]protoimpl.EnumInfo, 10) +var file_ocsf_v1_api_activity_proto_msgTypes = make([]protoimpl.MessageInfo, 1) +var file_ocsf_v1_api_activity_proto_goTypes = []any{ + (ApiActivity_ActionId)(0), // 0: ocsf.v1.ApiActivity.ActionId + (ApiActivity_ActivityId)(0), // 1: ocsf.v1.ApiActivity.ActivityId + (ApiActivity_CategoryUid)(0), // 2: ocsf.v1.ApiActivity.CategoryUid + (ApiActivity_ClassUid)(0), // 3: ocsf.v1.ApiActivity.ClassUid + (ApiActivity_ConfidenceId)(0), // 4: ocsf.v1.ApiActivity.ConfidenceId + (ApiActivity_DispositionId)(0), // 5: ocsf.v1.ApiActivity.DispositionId + (ApiActivity_RiskLevelId)(0), // 6: ocsf.v1.ApiActivity.RiskLevelId + (ApiActivity_SeverityId)(0), // 7: ocsf.v1.ApiActivity.SeverityId + (ApiActivity_StatusId)(0), // 8: ocsf.v1.ApiActivity.StatusId + (ApiActivity_TypeUid)(0), // 9: ocsf.v1.ApiActivity.TypeUid + (*ApiActivity)(nil), // 10: ocsf.v1.ApiActivity + (*Actor)(nil), // 11: ocsf.v1.Actor + (*AiModel)(nil), // 12: ocsf.v1.AiModel + (*Api)(nil), // 13: ocsf.v1.Api + (*Attack)(nil), // 14: ocsf.v1.Attack + (*Authorization)(nil), // 15: ocsf.v1.Authorization + (*Cloud)(nil), // 16: ocsf.v1.Cloud + (*Device)(nil), // 17: ocsf.v1.Device + (*NetworkEndpoint)(nil), // 18: ocsf.v1.NetworkEndpoint + (*Enrichment)(nil), // 19: ocsf.v1.Enrichment + (*FirewallRule)(nil), // 20: ocsf.v1.FirewallRule + (*HttpRequest)(nil), // 21: ocsf.v1.HttpRequest + (*HttpResponse)(nil), // 22: ocsf.v1.HttpResponse + (*Malware)(nil), // 23: ocsf.v1.Malware + (*MalwareScanInfo)(nil), // 24: ocsf.v1.MalwareScanInfo + (*MessageContext)(nil), // 25: ocsf.v1.MessageContext + (*Metadata)(nil), // 26: ocsf.v1.Metadata + (*Observable)(nil), // 27: ocsf.v1.Observable + (*Osint)(nil), // 28: ocsf.v1.Osint + (*Policy)(nil), // 29: ocsf.v1.Policy + (*Fingerprint)(nil), // 30: ocsf.v1.Fingerprint + (*ResourceDetails)(nil), // 31: ocsf.v1.ResourceDetails + (*Trace)(nil), // 32: ocsf.v1.Trace + (*structpb.Value)(nil), // 33: google.protobuf.Value +} +var file_ocsf_v1_api_activity_proto_depIdxs = []int32{ + 0, // 0: ocsf.v1.ApiActivity.action_id:type_name -> ocsf.v1.ApiActivity.ActionId + 1, // 1: ocsf.v1.ApiActivity.activity_id:type_name -> ocsf.v1.ApiActivity.ActivityId + 11, // 2: ocsf.v1.ApiActivity.actor:type_name -> ocsf.v1.Actor + 12, // 3: ocsf.v1.ApiActivity.ai_model:type_name -> ocsf.v1.AiModel + 13, // 4: ocsf.v1.ApiActivity.api:type_name -> ocsf.v1.Api + 14, // 5: ocsf.v1.ApiActivity.attacks:type_name -> ocsf.v1.Attack + 15, // 6: ocsf.v1.ApiActivity.authorizations:type_name -> ocsf.v1.Authorization + 2, // 7: ocsf.v1.ApiActivity.category_uid:type_name -> ocsf.v1.ApiActivity.CategoryUid + 3, // 8: ocsf.v1.ApiActivity.class_uid:type_name -> ocsf.v1.ApiActivity.ClassUid + 16, // 9: ocsf.v1.ApiActivity.cloud:type_name -> ocsf.v1.Cloud + 4, // 10: ocsf.v1.ApiActivity.confidence_id:type_name -> ocsf.v1.ApiActivity.ConfidenceId + 17, // 11: ocsf.v1.ApiActivity.device:type_name -> ocsf.v1.Device + 5, // 12: ocsf.v1.ApiActivity.disposition_id:type_name -> ocsf.v1.ApiActivity.DispositionId + 18, // 13: ocsf.v1.ApiActivity.dst_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 19, // 14: ocsf.v1.ApiActivity.enrichments:type_name -> ocsf.v1.Enrichment + 20, // 15: ocsf.v1.ApiActivity.firewall_rule:type_name -> ocsf.v1.FirewallRule + 21, // 16: ocsf.v1.ApiActivity.http_request:type_name -> ocsf.v1.HttpRequest + 22, // 17: ocsf.v1.ApiActivity.http_response:type_name -> ocsf.v1.HttpResponse + 23, // 18: ocsf.v1.ApiActivity.malware:type_name -> ocsf.v1.Malware + 24, // 19: ocsf.v1.ApiActivity.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo + 25, // 20: ocsf.v1.ApiActivity.message_context:type_name -> ocsf.v1.MessageContext + 26, // 21: ocsf.v1.ApiActivity.metadata:type_name -> ocsf.v1.Metadata + 27, // 22: ocsf.v1.ApiActivity.observables:type_name -> ocsf.v1.Observable + 28, // 23: ocsf.v1.ApiActivity.osint:type_name -> ocsf.v1.Osint + 29, // 24: ocsf.v1.ApiActivity.policy:type_name -> ocsf.v1.Policy + 30, // 25: ocsf.v1.ApiActivity.raw_data_hash:type_name -> ocsf.v1.Fingerprint + 31, // 26: ocsf.v1.ApiActivity.resources:type_name -> ocsf.v1.ResourceDetails + 6, // 27: ocsf.v1.ApiActivity.risk_level_id:type_name -> ocsf.v1.ApiActivity.RiskLevelId + 7, // 28: ocsf.v1.ApiActivity.severity_id:type_name -> ocsf.v1.ApiActivity.SeverityId + 18, // 29: ocsf.v1.ApiActivity.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 8, // 30: ocsf.v1.ApiActivity.status_id:type_name -> ocsf.v1.ApiActivity.StatusId + 32, // 31: ocsf.v1.ApiActivity.trace:type_name -> ocsf.v1.Trace + 9, // 32: ocsf.v1.ApiActivity.type_uid:type_name -> ocsf.v1.ApiActivity.TypeUid + 33, // 33: ocsf.v1.ApiActivity.unmapped:type_name -> google.protobuf.Value + 34, // [34:34] is the sub-list for method output_type + 34, // [34:34] is the sub-list for method input_type + 34, // [34:34] is the sub-list for extension type_name + 34, // [34:34] is the sub-list for extension extendee + 0, // [0:34] is the sub-list for field type_name +} + +func init() { file_ocsf_v1_api_activity_proto_init() } +func file_ocsf_v1_api_activity_proto_init() { + if File_ocsf_v1_api_activity_proto != nil { + return + } + file_ocsf_v1_objects_proto_init() + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_ocsf_v1_api_activity_proto_rawDesc), len(file_ocsf_v1_api_activity_proto_rawDesc)), + NumEnums: 10, + NumMessages: 1, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_ocsf_v1_api_activity_proto_goTypes, + DependencyIndexes: file_ocsf_v1_api_activity_proto_depIdxs, + EnumInfos: file_ocsf_v1_api_activity_proto_enumTypes, + MessageInfos: file_ocsf_v1_api_activity_proto_msgTypes, + }.Build() + File_ocsf_v1_api_activity_proto = out.File + file_ocsf_v1_api_activity_proto_goTypes = nil + file_ocsf_v1_api_activity_proto_depIdxs = nil +} diff --git a/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/entity_management.pb.go b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/entity_management.pb.go new file mode 100644 index 0000000..9b41855 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/entity_management.pb.go @@ -0,0 +1,1548 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.6 +// protoc (unknown) +// source: ocsf/v1/entity_management.proto + +package ocsfv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + structpb "google.golang.org/protobuf/types/known/structpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type EntityManagement_ActionId int32 + +const ( + EntityManagement_ACTION_ID_UNKNOWN EntityManagement_ActionId = 0 + EntityManagement_ACTION_ID_ALLOWED EntityManagement_ActionId = 1 + EntityManagement_ACTION_ID_DENIED EntityManagement_ActionId = 2 + EntityManagement_ACTION_ID_OBSERVED EntityManagement_ActionId = 3 + EntityManagement_ACTION_ID_MODIFIED EntityManagement_ActionId = 4 + EntityManagement_ACTION_ID_OTHER EntityManagement_ActionId = 99 +) + +// Enum value maps for EntityManagement_ActionId. +var ( + EntityManagement_ActionId_name = map[int32]string{ + 0: "ACTION_ID_UNKNOWN", + 1: "ACTION_ID_ALLOWED", + 2: "ACTION_ID_DENIED", + 3: "ACTION_ID_OBSERVED", + 4: "ACTION_ID_MODIFIED", + 99: "ACTION_ID_OTHER", + } + EntityManagement_ActionId_value = map[string]int32{ + "ACTION_ID_UNKNOWN": 0, + "ACTION_ID_ALLOWED": 1, + "ACTION_ID_DENIED": 2, + "ACTION_ID_OBSERVED": 3, + "ACTION_ID_MODIFIED": 4, + "ACTION_ID_OTHER": 99, + } +) + +func (x EntityManagement_ActionId) Enum() *EntityManagement_ActionId { + p := new(EntityManagement_ActionId) + *p = x + return p +} + +func (x EntityManagement_ActionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ActionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[0].Descriptor() +} + +func (EntityManagement_ActionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[0] +} + +func (x EntityManagement_ActionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ActionId.Descriptor instead. +func (EntityManagement_ActionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 0} +} + +type EntityManagement_ActivityId int32 + +const ( + EntityManagement_ACTIVITY_ID_UNKNOWN EntityManagement_ActivityId = 0 + EntityManagement_ACTIVITY_ID_CREATE EntityManagement_ActivityId = 1 + EntityManagement_ACTIVITY_ID_READ EntityManagement_ActivityId = 2 + EntityManagement_ACTIVITY_ID_UPDATE EntityManagement_ActivityId = 3 + EntityManagement_ACTIVITY_ID_DELETE EntityManagement_ActivityId = 4 + EntityManagement_ACTIVITY_ID_MOVE EntityManagement_ActivityId = 5 + EntityManagement_ACTIVITY_ID_ENROLL EntityManagement_ActivityId = 6 + EntityManagement_ACTIVITY_ID_UNENROLL EntityManagement_ActivityId = 7 + EntityManagement_ACTIVITY_ID_ENABLE EntityManagement_ActivityId = 8 + EntityManagement_ACTIVITY_ID_DISABLE EntityManagement_ActivityId = 9 + EntityManagement_ACTIVITY_ID_ACTIVATE EntityManagement_ActivityId = 10 + EntityManagement_ACTIVITY_ID_DEACTIVATE EntityManagement_ActivityId = 11 + EntityManagement_ACTIVITY_ID_SUSPEND EntityManagement_ActivityId = 12 + EntityManagement_ACTIVITY_ID_RESUME EntityManagement_ActivityId = 13 + EntityManagement_ACTIVITY_ID_OTHER EntityManagement_ActivityId = 99 +) + +// Enum value maps for EntityManagement_ActivityId. +var ( + EntityManagement_ActivityId_name = map[int32]string{ + 0: "ACTIVITY_ID_UNKNOWN", + 1: "ACTIVITY_ID_CREATE", + 2: "ACTIVITY_ID_READ", + 3: "ACTIVITY_ID_UPDATE", + 4: "ACTIVITY_ID_DELETE", + 5: "ACTIVITY_ID_MOVE", + 6: "ACTIVITY_ID_ENROLL", + 7: "ACTIVITY_ID_UNENROLL", + 8: "ACTIVITY_ID_ENABLE", + 9: "ACTIVITY_ID_DISABLE", + 10: "ACTIVITY_ID_ACTIVATE", + 11: "ACTIVITY_ID_DEACTIVATE", + 12: "ACTIVITY_ID_SUSPEND", + 13: "ACTIVITY_ID_RESUME", + 99: "ACTIVITY_ID_OTHER", + } + EntityManagement_ActivityId_value = map[string]int32{ + "ACTIVITY_ID_UNKNOWN": 0, + "ACTIVITY_ID_CREATE": 1, + "ACTIVITY_ID_READ": 2, + "ACTIVITY_ID_UPDATE": 3, + "ACTIVITY_ID_DELETE": 4, + "ACTIVITY_ID_MOVE": 5, + "ACTIVITY_ID_ENROLL": 6, + "ACTIVITY_ID_UNENROLL": 7, + "ACTIVITY_ID_ENABLE": 8, + "ACTIVITY_ID_DISABLE": 9, + "ACTIVITY_ID_ACTIVATE": 10, + "ACTIVITY_ID_DEACTIVATE": 11, + "ACTIVITY_ID_SUSPEND": 12, + "ACTIVITY_ID_RESUME": 13, + "ACTIVITY_ID_OTHER": 99, + } +) + +func (x EntityManagement_ActivityId) Enum() *EntityManagement_ActivityId { + p := new(EntityManagement_ActivityId) + *p = x + return p +} + +func (x EntityManagement_ActivityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ActivityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[1].Descriptor() +} + +func (EntityManagement_ActivityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[1] +} + +func (x EntityManagement_ActivityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ActivityId.Descriptor instead. +func (EntityManagement_ActivityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 1} +} + +type EntityManagement_CategoryUid int32 + +const ( + EntityManagement_CATEGORY_UID_UNKNOWN EntityManagement_CategoryUid = 0 + EntityManagement_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT EntityManagement_CategoryUid = 3 +) + +// Enum value maps for EntityManagement_CategoryUid. +var ( + EntityManagement_CategoryUid_name = map[int32]string{ + 0: "CATEGORY_UID_UNKNOWN", + 3: "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT", + } + EntityManagement_CategoryUid_value = map[string]int32{ + "CATEGORY_UID_UNKNOWN": 0, + "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT": 3, + } +) + +func (x EntityManagement_CategoryUid) Enum() *EntityManagement_CategoryUid { + p := new(EntityManagement_CategoryUid) + *p = x + return p +} + +func (x EntityManagement_CategoryUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_CategoryUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[2].Descriptor() +} + +func (EntityManagement_CategoryUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[2] +} + +func (x EntityManagement_CategoryUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_CategoryUid.Descriptor instead. +func (EntityManagement_CategoryUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 2} +} + +type EntityManagement_ClassUid int32 + +const ( + EntityManagement_CLASS_UID_UNKNOWN EntityManagement_ClassUid = 0 + EntityManagement_CLASS_UID_ENTITY_MANAGEMENT EntityManagement_ClassUid = 3004 +) + +// Enum value maps for EntityManagement_ClassUid. +var ( + EntityManagement_ClassUid_name = map[int32]string{ + 0: "CLASS_UID_UNKNOWN", + 3004: "CLASS_UID_ENTITY_MANAGEMENT", + } + EntityManagement_ClassUid_value = map[string]int32{ + "CLASS_UID_UNKNOWN": 0, + "CLASS_UID_ENTITY_MANAGEMENT": 3004, + } +) + +func (x EntityManagement_ClassUid) Enum() *EntityManagement_ClassUid { + p := new(EntityManagement_ClassUid) + *p = x + return p +} + +func (x EntityManagement_ClassUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ClassUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[3].Descriptor() +} + +func (EntityManagement_ClassUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[3] +} + +func (x EntityManagement_ClassUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ClassUid.Descriptor instead. +func (EntityManagement_ClassUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 3} +} + +type EntityManagement_ConfidenceId int32 + +const ( + EntityManagement_CONFIDENCE_ID_UNKNOWN EntityManagement_ConfidenceId = 0 + EntityManagement_CONFIDENCE_ID_LOW EntityManagement_ConfidenceId = 1 + EntityManagement_CONFIDENCE_ID_MEDIUM EntityManagement_ConfidenceId = 2 + EntityManagement_CONFIDENCE_ID_HIGH EntityManagement_ConfidenceId = 3 + EntityManagement_CONFIDENCE_ID_OTHER EntityManagement_ConfidenceId = 99 +) + +// Enum value maps for EntityManagement_ConfidenceId. +var ( + EntityManagement_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + EntityManagement_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x EntityManagement_ConfidenceId) Enum() *EntityManagement_ConfidenceId { + p := new(EntityManagement_ConfidenceId) + *p = x + return p +} + +func (x EntityManagement_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[4].Descriptor() +} + +func (EntityManagement_ConfidenceId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[4] +} + +func (x EntityManagement_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_ConfidenceId.Descriptor instead. +func (EntityManagement_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 4} +} + +type EntityManagement_DispositionId int32 + +const ( + EntityManagement_DISPOSITION_ID_UNKNOWN EntityManagement_DispositionId = 0 + EntityManagement_DISPOSITION_ID_ALLOWED EntityManagement_DispositionId = 1 + EntityManagement_DISPOSITION_ID_BLOCKED EntityManagement_DispositionId = 2 + EntityManagement_DISPOSITION_ID_QUARANTINED EntityManagement_DispositionId = 3 + EntityManagement_DISPOSITION_ID_ISOLATED EntityManagement_DispositionId = 4 + EntityManagement_DISPOSITION_ID_DELETED EntityManagement_DispositionId = 5 + EntityManagement_DISPOSITION_ID_DROPPED EntityManagement_DispositionId = 6 + EntityManagement_DISPOSITION_ID_CUSTOM_ACTION EntityManagement_DispositionId = 7 + EntityManagement_DISPOSITION_ID_APPROVED EntityManagement_DispositionId = 8 + EntityManagement_DISPOSITION_ID_RESTORED EntityManagement_DispositionId = 9 + EntityManagement_DISPOSITION_ID_EXONERATED EntityManagement_DispositionId = 10 + EntityManagement_DISPOSITION_ID_CORRECTED EntityManagement_DispositionId = 11 + EntityManagement_DISPOSITION_ID_PARTIALLY_CORRECTED EntityManagement_DispositionId = 12 + EntityManagement_DISPOSITION_ID_UNCORRECTED EntityManagement_DispositionId = 13 + EntityManagement_DISPOSITION_ID_DELAYED EntityManagement_DispositionId = 14 + EntityManagement_DISPOSITION_ID_DETECTED EntityManagement_DispositionId = 15 + EntityManagement_DISPOSITION_ID_NO_ACTION EntityManagement_DispositionId = 16 + EntityManagement_DISPOSITION_ID_LOGGED EntityManagement_DispositionId = 17 + EntityManagement_DISPOSITION_ID_TAGGED EntityManagement_DispositionId = 18 + EntityManagement_DISPOSITION_ID_ALERT EntityManagement_DispositionId = 19 + EntityManagement_DISPOSITION_ID_COUNT EntityManagement_DispositionId = 20 + EntityManagement_DISPOSITION_ID_RESET EntityManagement_DispositionId = 21 + EntityManagement_DISPOSITION_ID_CAPTCHA EntityManagement_DispositionId = 22 + EntityManagement_DISPOSITION_ID_CHALLENGE EntityManagement_DispositionId = 23 + EntityManagement_DISPOSITION_ID_ACCESS_REVOKED EntityManagement_DispositionId = 24 + EntityManagement_DISPOSITION_ID_REJECTED EntityManagement_DispositionId = 25 + EntityManagement_DISPOSITION_ID_UNAUTHORIZED EntityManagement_DispositionId = 26 + EntityManagement_DISPOSITION_ID_ERROR EntityManagement_DispositionId = 27 + EntityManagement_DISPOSITION_ID_OTHER EntityManagement_DispositionId = 99 +) + +// Enum value maps for EntityManagement_DispositionId. +var ( + EntityManagement_DispositionId_name = map[int32]string{ + 0: "DISPOSITION_ID_UNKNOWN", + 1: "DISPOSITION_ID_ALLOWED", + 2: "DISPOSITION_ID_BLOCKED", + 3: "DISPOSITION_ID_QUARANTINED", + 4: "DISPOSITION_ID_ISOLATED", + 5: "DISPOSITION_ID_DELETED", + 6: "DISPOSITION_ID_DROPPED", + 7: "DISPOSITION_ID_CUSTOM_ACTION", + 8: "DISPOSITION_ID_APPROVED", + 9: "DISPOSITION_ID_RESTORED", + 10: "DISPOSITION_ID_EXONERATED", + 11: "DISPOSITION_ID_CORRECTED", + 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", + 13: "DISPOSITION_ID_UNCORRECTED", + 14: "DISPOSITION_ID_DELAYED", + 15: "DISPOSITION_ID_DETECTED", + 16: "DISPOSITION_ID_NO_ACTION", + 17: "DISPOSITION_ID_LOGGED", + 18: "DISPOSITION_ID_TAGGED", + 19: "DISPOSITION_ID_ALERT", + 20: "DISPOSITION_ID_COUNT", + 21: "DISPOSITION_ID_RESET", + 22: "DISPOSITION_ID_CAPTCHA", + 23: "DISPOSITION_ID_CHALLENGE", + 24: "DISPOSITION_ID_ACCESS_REVOKED", + 25: "DISPOSITION_ID_REJECTED", + 26: "DISPOSITION_ID_UNAUTHORIZED", + 27: "DISPOSITION_ID_ERROR", + 99: "DISPOSITION_ID_OTHER", + } + EntityManagement_DispositionId_value = map[string]int32{ + "DISPOSITION_ID_UNKNOWN": 0, + "DISPOSITION_ID_ALLOWED": 1, + "DISPOSITION_ID_BLOCKED": 2, + "DISPOSITION_ID_QUARANTINED": 3, + "DISPOSITION_ID_ISOLATED": 4, + "DISPOSITION_ID_DELETED": 5, + "DISPOSITION_ID_DROPPED": 6, + "DISPOSITION_ID_CUSTOM_ACTION": 7, + "DISPOSITION_ID_APPROVED": 8, + "DISPOSITION_ID_RESTORED": 9, + "DISPOSITION_ID_EXONERATED": 10, + "DISPOSITION_ID_CORRECTED": 11, + "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, + "DISPOSITION_ID_UNCORRECTED": 13, + "DISPOSITION_ID_DELAYED": 14, + "DISPOSITION_ID_DETECTED": 15, + "DISPOSITION_ID_NO_ACTION": 16, + "DISPOSITION_ID_LOGGED": 17, + "DISPOSITION_ID_TAGGED": 18, + "DISPOSITION_ID_ALERT": 19, + "DISPOSITION_ID_COUNT": 20, + "DISPOSITION_ID_RESET": 21, + "DISPOSITION_ID_CAPTCHA": 22, + "DISPOSITION_ID_CHALLENGE": 23, + "DISPOSITION_ID_ACCESS_REVOKED": 24, + "DISPOSITION_ID_REJECTED": 25, + "DISPOSITION_ID_UNAUTHORIZED": 26, + "DISPOSITION_ID_ERROR": 27, + "DISPOSITION_ID_OTHER": 99, + } +) + +func (x EntityManagement_DispositionId) Enum() *EntityManagement_DispositionId { + p := new(EntityManagement_DispositionId) + *p = x + return p +} + +func (x EntityManagement_DispositionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_DispositionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[5].Descriptor() +} + +func (EntityManagement_DispositionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[5] +} + +func (x EntityManagement_DispositionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_DispositionId.Descriptor instead. +func (EntityManagement_DispositionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 5} +} + +type EntityManagement_RiskLevelId int32 + +const ( + EntityManagement_RISK_LEVEL_ID_INFO EntityManagement_RiskLevelId = 0 + EntityManagement_RISK_LEVEL_ID_LOW EntityManagement_RiskLevelId = 1 + EntityManagement_RISK_LEVEL_ID_MEDIUM EntityManagement_RiskLevelId = 2 + EntityManagement_RISK_LEVEL_ID_HIGH EntityManagement_RiskLevelId = 3 + EntityManagement_RISK_LEVEL_ID_CRITICAL EntityManagement_RiskLevelId = 4 + EntityManagement_RISK_LEVEL_ID_OTHER EntityManagement_RiskLevelId = 99 +) + +// Enum value maps for EntityManagement_RiskLevelId. +var ( + EntityManagement_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + EntityManagement_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x EntityManagement_RiskLevelId) Enum() *EntityManagement_RiskLevelId { + p := new(EntityManagement_RiskLevelId) + *p = x + return p +} + +func (x EntityManagement_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[6].Descriptor() +} + +func (EntityManagement_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[6] +} + +func (x EntityManagement_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_RiskLevelId.Descriptor instead. +func (EntityManagement_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 6} +} + +type EntityManagement_SeverityId int32 + +const ( + EntityManagement_SEVERITY_ID_UNKNOWN EntityManagement_SeverityId = 0 + EntityManagement_SEVERITY_ID_INFORMATIONAL EntityManagement_SeverityId = 1 + EntityManagement_SEVERITY_ID_LOW EntityManagement_SeverityId = 2 + EntityManagement_SEVERITY_ID_MEDIUM EntityManagement_SeverityId = 3 + EntityManagement_SEVERITY_ID_HIGH EntityManagement_SeverityId = 4 + EntityManagement_SEVERITY_ID_CRITICAL EntityManagement_SeverityId = 5 + EntityManagement_SEVERITY_ID_FATAL EntityManagement_SeverityId = 6 + EntityManagement_SEVERITY_ID_OTHER EntityManagement_SeverityId = 99 +) + +// Enum value maps for EntityManagement_SeverityId. +var ( + EntityManagement_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + EntityManagement_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x EntityManagement_SeverityId) Enum() *EntityManagement_SeverityId { + p := new(EntityManagement_SeverityId) + *p = x + return p +} + +func (x EntityManagement_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[7].Descriptor() +} + +func (EntityManagement_SeverityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[7] +} + +func (x EntityManagement_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_SeverityId.Descriptor instead. +func (EntityManagement_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 7} +} + +type EntityManagement_StatusId int32 + +const ( + EntityManagement_STATUS_ID_UNKNOWN EntityManagement_StatusId = 0 + EntityManagement_STATUS_ID_SUCCESS EntityManagement_StatusId = 1 + EntityManagement_STATUS_ID_FAILURE EntityManagement_StatusId = 2 + EntityManagement_STATUS_ID_OTHER EntityManagement_StatusId = 99 +) + +// Enum value maps for EntityManagement_StatusId. +var ( + EntityManagement_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_SUCCESS", + 2: "STATUS_ID_FAILURE", + 99: "STATUS_ID_OTHER", + } + EntityManagement_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_SUCCESS": 1, + "STATUS_ID_FAILURE": 2, + "STATUS_ID_OTHER": 99, + } +) + +func (x EntityManagement_StatusId) Enum() *EntityManagement_StatusId { + p := new(EntityManagement_StatusId) + *p = x + return p +} + +func (x EntityManagement_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[8].Descriptor() +} + +func (EntityManagement_StatusId) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[8] +} + +func (x EntityManagement_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_StatusId.Descriptor instead. +func (EntityManagement_StatusId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 8} +} + +type EntityManagement_TypeUid int32 + +const ( + EntityManagement_TYPE_UID_UNKNOWN EntityManagement_TypeUid = 0 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN EntityManagement_TypeUid = 300400 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_CREATE EntityManagement_TypeUid = 300401 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_READ EntityManagement_TypeUid = 300402 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UPDATE EntityManagement_TypeUid = 300403 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DELETE EntityManagement_TypeUid = 300404 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_MOVE EntityManagement_TypeUid = 300405 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENROLL EntityManagement_TypeUid = 300406 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNENROLL EntityManagement_TypeUid = 300407 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENABLE EntityManagement_TypeUid = 300408 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DISABLE EntityManagement_TypeUid = 300409 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE EntityManagement_TypeUid = 300410 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE EntityManagement_TypeUid = 300411 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_SUSPEND EntityManagement_TypeUid = 300412 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_RESUME EntityManagement_TypeUid = 300413 + EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_OTHER EntityManagement_TypeUid = 300499 +) + +// Enum value maps for EntityManagement_TypeUid. +var ( + EntityManagement_TypeUid_name = map[int32]string{ + 0: "TYPE_UID_UNKNOWN", + 300400: "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN", + 300401: "TYPE_UID_ENTITY_MANAGEMENT_CREATE", + 300402: "TYPE_UID_ENTITY_MANAGEMENT_READ", + 300403: "TYPE_UID_ENTITY_MANAGEMENT_UPDATE", + 300404: "TYPE_UID_ENTITY_MANAGEMENT_DELETE", + 300405: "TYPE_UID_ENTITY_MANAGEMENT_MOVE", + 300406: "TYPE_UID_ENTITY_MANAGEMENT_ENROLL", + 300407: "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL", + 300408: "TYPE_UID_ENTITY_MANAGEMENT_ENABLE", + 300409: "TYPE_UID_ENTITY_MANAGEMENT_DISABLE", + 300410: "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE", + 300411: "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE", + 300412: "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND", + 300413: "TYPE_UID_ENTITY_MANAGEMENT_RESUME", + 300499: "TYPE_UID_ENTITY_MANAGEMENT_OTHER", + } + EntityManagement_TypeUid_value = map[string]int32{ + "TYPE_UID_UNKNOWN": 0, + "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN": 300400, + "TYPE_UID_ENTITY_MANAGEMENT_CREATE": 300401, + "TYPE_UID_ENTITY_MANAGEMENT_READ": 300402, + "TYPE_UID_ENTITY_MANAGEMENT_UPDATE": 300403, + "TYPE_UID_ENTITY_MANAGEMENT_DELETE": 300404, + "TYPE_UID_ENTITY_MANAGEMENT_MOVE": 300405, + "TYPE_UID_ENTITY_MANAGEMENT_ENROLL": 300406, + "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL": 300407, + "TYPE_UID_ENTITY_MANAGEMENT_ENABLE": 300408, + "TYPE_UID_ENTITY_MANAGEMENT_DISABLE": 300409, + "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE": 300410, + "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE": 300411, + "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND": 300412, + "TYPE_UID_ENTITY_MANAGEMENT_RESUME": 300413, + "TYPE_UID_ENTITY_MANAGEMENT_OTHER": 300499, + } +) + +func (x EntityManagement_TypeUid) Enum() *EntityManagement_TypeUid { + p := new(EntityManagement_TypeUid) + *p = x + return p +} + +func (x EntityManagement_TypeUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (EntityManagement_TypeUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_entity_management_proto_enumTypes[9].Descriptor() +} + +func (EntityManagement_TypeUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_entity_management_proto_enumTypes[9] +} + +func (x EntityManagement_TypeUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use EntityManagement_TypeUid.Descriptor instead. +func (EntityManagement_TypeUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0, 9} +} + +type EntityManagement struct { + state protoimpl.MessageState `protogen:"open.v1"` + AccessList []string `protobuf:"bytes,1,rep,name=access_list,json=accessList,proto3" json:"access_list,omitempty"` + AccessMask int32 `protobuf:"varint,2,opt,name=access_mask,json=accessMask,proto3" json:"access_mask,omitempty"` + Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` + ActionId EntityManagement_ActionId `protobuf:"varint,4,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.EntityManagement_ActionId" json:"action_id,omitempty"` + ActivityId EntityManagement_ActivityId `protobuf:"varint,5,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.EntityManagement_ActivityId" json:"activity_id,omitempty"` + ActivityName string `protobuf:"bytes,6,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` + Actor *Actor `protobuf:"bytes,7,opt,name=actor,proto3" json:"actor,omitempty"` + Api *Api `protobuf:"bytes,8,opt,name=api,proto3" json:"api,omitempty"` + Attacks []*Attack `protobuf:"bytes,9,rep,name=attacks,proto3" json:"attacks,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,10,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + CategoryName string `protobuf:"bytes,11,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` + CategoryUid EntityManagement_CategoryUid `protobuf:"varint,12,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.EntityManagement_CategoryUid" json:"category_uid,omitempty"` + ClassName string `protobuf:"bytes,13,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` + ClassUid EntityManagement_ClassUid `protobuf:"varint,14,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.EntityManagement_ClassUid" json:"class_uid,omitempty"` + Cloud *Cloud `protobuf:"bytes,15,opt,name=cloud,proto3" json:"cloud,omitempty"` + Comment string `protobuf:"bytes,16,opt,name=comment,proto3" json:"comment,omitempty"` + Confidence string `protobuf:"bytes,17,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId EntityManagement_ConfidenceId `protobuf:"varint,18,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.EntityManagement_ConfidenceId" json:"confidence_id,omitempty"` + ConfidenceScore int32 `protobuf:"varint,19,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` + Count int32 `protobuf:"varint,20,opt,name=count,proto3" json:"count,omitempty"` + Device *Device `protobuf:"bytes,21,opt,name=device,proto3" json:"device,omitempty"` + Disposition string `protobuf:"bytes,22,opt,name=disposition,proto3" json:"disposition,omitempty"` + DispositionId EntityManagement_DispositionId `protobuf:"varint,23,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.EntityManagement_DispositionId" json:"disposition_id,omitempty"` + Duration int64 `protobuf:"varint,24,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,25,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,26,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Enrichments []*Enrichment `protobuf:"bytes,27,rep,name=enrichments,proto3" json:"enrichments,omitempty"` + Entity *ManagedEntity `protobuf:"bytes,28,opt,name=entity,proto3" json:"entity,omitempty"` + EntityResult *ManagedEntity `protobuf:"bytes,29,opt,name=entity_result,json=entityResult,proto3" json:"entity_result,omitempty"` + FirewallRule *FirewallRule `protobuf:"bytes,30,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` + HttpRequest *HttpRequest `protobuf:"bytes,31,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` + HttpResponse *HttpResponse `protobuf:"bytes,32,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` + IsAlert bool `protobuf:"varint,33,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + Malware []*Malware `protobuf:"bytes,34,rep,name=malware,proto3" json:"malware,omitempty"` + MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,35,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` + Message string `protobuf:"bytes,36,opt,name=message,proto3" json:"message,omitempty"` + Metadata *Metadata `protobuf:"bytes,37,opt,name=metadata,proto3" json:"metadata,omitempty"` + Observables []*Observable `protobuf:"bytes,38,rep,name=observables,proto3" json:"observables,omitempty"` + Osint []*Osint `protobuf:"bytes,39,rep,name=osint,proto3" json:"osint,omitempty"` + Policy *Policy `protobuf:"bytes,40,opt,name=policy,proto3" json:"policy,omitempty"` + RawData string `protobuf:"bytes,41,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` + RawDataHash *Fingerprint `protobuf:"bytes,42,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` + RawDataSize int64 `protobuf:"varint,43,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` + RiskDetails string `protobuf:"bytes,44,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` + RiskLevel string `protobuf:"bytes,45,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId EntityManagement_RiskLevelId `protobuf:"varint,46,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.EntityManagement_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,47,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Severity string `protobuf:"bytes,48,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId EntityManagement_SeverityId `protobuf:"varint,49,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.EntityManagement_SeverityId" json:"severity_id,omitempty"` + SrcEndpoint *NetworkEndpoint `protobuf:"bytes,50,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` + StartTime int64 `protobuf:"varint,51,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,52,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Status string `protobuf:"bytes,53,opt,name=status,proto3" json:"status,omitempty"` + StatusCode string `protobuf:"bytes,54,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + StatusDetail string `protobuf:"bytes,55,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` + StatusId EntityManagement_StatusId `protobuf:"varint,56,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.EntityManagement_StatusId" json:"status_id,omitempty"` + Time int64 `protobuf:"varint,57,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,58,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + TimezoneOffset int32 `protobuf:"varint,59,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` + TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` + TypeUid EntityManagement_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.EntityManagement_TypeUid" json:"type_uid,omitempty"` + Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EntityManagement) Reset() { + *x = EntityManagement{} + mi := &file_ocsf_v1_entity_management_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EntityManagement) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EntityManagement) ProtoMessage() {} + +func (x *EntityManagement) ProtoReflect() protoreflect.Message { + mi := &file_ocsf_v1_entity_management_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EntityManagement.ProtoReflect.Descriptor instead. +func (*EntityManagement) Descriptor() ([]byte, []int) { + return file_ocsf_v1_entity_management_proto_rawDescGZIP(), []int{0} +} + +func (x *EntityManagement) GetAccessList() []string { + if x != nil { + return x.AccessList + } + return nil +} + +func (x *EntityManagement) GetAccessMask() int32 { + if x != nil { + return x.AccessMask + } + return 0 +} + +func (x *EntityManagement) GetAction() string { + if x != nil { + return x.Action + } + return "" +} + +func (x *EntityManagement) GetActionId() EntityManagement_ActionId { + if x != nil { + return x.ActionId + } + return EntityManagement_ACTION_ID_UNKNOWN +} + +func (x *EntityManagement) GetActivityId() EntityManagement_ActivityId { + if x != nil { + return x.ActivityId + } + return EntityManagement_ACTIVITY_ID_UNKNOWN +} + +func (x *EntityManagement) GetActivityName() string { + if x != nil { + return x.ActivityName + } + return "" +} + +func (x *EntityManagement) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *EntityManagement) GetApi() *Api { + if x != nil { + return x.Api + } + return nil +} + +func (x *EntityManagement) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *EntityManagement) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *EntityManagement) GetCategoryName() string { + if x != nil { + return x.CategoryName + } + return "" +} + +func (x *EntityManagement) GetCategoryUid() EntityManagement_CategoryUid { + if x != nil { + return x.CategoryUid + } + return EntityManagement_CATEGORY_UID_UNKNOWN +} + +func (x *EntityManagement) GetClassName() string { + if x != nil { + return x.ClassName + } + return "" +} + +func (x *EntityManagement) GetClassUid() EntityManagement_ClassUid { + if x != nil { + return x.ClassUid + } + return EntityManagement_CLASS_UID_UNKNOWN +} + +func (x *EntityManagement) GetCloud() *Cloud { + if x != nil { + return x.Cloud + } + return nil +} + +func (x *EntityManagement) GetComment() string { + if x != nil { + return x.Comment + } + return "" +} + +func (x *EntityManagement) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *EntityManagement) GetConfidenceId() EntityManagement_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return EntityManagement_CONFIDENCE_ID_UNKNOWN +} + +func (x *EntityManagement) GetConfidenceScore() int32 { + if x != nil { + return x.ConfidenceScore + } + return 0 +} + +func (x *EntityManagement) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *EntityManagement) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *EntityManagement) GetDisposition() string { + if x != nil { + return x.Disposition + } + return "" +} + +func (x *EntityManagement) GetDispositionId() EntityManagement_DispositionId { + if x != nil { + return x.DispositionId + } + return EntityManagement_DISPOSITION_ID_UNKNOWN +} + +func (x *EntityManagement) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *EntityManagement) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *EntityManagement) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *EntityManagement) GetEnrichments() []*Enrichment { + if x != nil { + return x.Enrichments + } + return nil +} + +func (x *EntityManagement) GetEntity() *ManagedEntity { + if x != nil { + return x.Entity + } + return nil +} + +func (x *EntityManagement) GetEntityResult() *ManagedEntity { + if x != nil { + return x.EntityResult + } + return nil +} + +func (x *EntityManagement) GetFirewallRule() *FirewallRule { + if x != nil { + return x.FirewallRule + } + return nil +} + +func (x *EntityManagement) GetHttpRequest() *HttpRequest { + if x != nil { + return x.HttpRequest + } + return nil +} + +func (x *EntityManagement) GetHttpResponse() *HttpResponse { + if x != nil { + return x.HttpResponse + } + return nil +} + +func (x *EntityManagement) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *EntityManagement) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *EntityManagement) GetMalwareScanInfo() *MalwareScanInfo { + if x != nil { + return x.MalwareScanInfo + } + return nil +} + +func (x *EntityManagement) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *EntityManagement) GetMetadata() *Metadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *EntityManagement) GetObservables() []*Observable { + if x != nil { + return x.Observables + } + return nil +} + +func (x *EntityManagement) GetOsint() []*Osint { + if x != nil { + return x.Osint + } + return nil +} + +func (x *EntityManagement) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *EntityManagement) GetRawData() string { + if x != nil { + return x.RawData + } + return "" +} + +func (x *EntityManagement) GetRawDataHash() *Fingerprint { + if x != nil { + return x.RawDataHash + } + return nil +} + +func (x *EntityManagement) GetRawDataSize() int64 { + if x != nil { + return x.RawDataSize + } + return 0 +} + +func (x *EntityManagement) GetRiskDetails() string { + if x != nil { + return x.RiskDetails + } + return "" +} + +func (x *EntityManagement) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *EntityManagement) GetRiskLevelId() EntityManagement_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return EntityManagement_RISK_LEVEL_ID_INFO +} + +func (x *EntityManagement) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *EntityManagement) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *EntityManagement) GetSeverityId() EntityManagement_SeverityId { + if x != nil { + return x.SeverityId + } + return EntityManagement_SEVERITY_ID_UNKNOWN +} + +func (x *EntityManagement) GetSrcEndpoint() *NetworkEndpoint { + if x != nil { + return x.SrcEndpoint + } + return nil +} + +func (x *EntityManagement) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *EntityManagement) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *EntityManagement) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *EntityManagement) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *EntityManagement) GetStatusDetail() string { + if x != nil { + return x.StatusDetail + } + return "" +} + +func (x *EntityManagement) GetStatusId() EntityManagement_StatusId { + if x != nil { + return x.StatusId + } + return EntityManagement_STATUS_ID_UNKNOWN +} + +func (x *EntityManagement) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *EntityManagement) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *EntityManagement) GetTimezoneOffset() int32 { + if x != nil { + return x.TimezoneOffset + } + return 0 +} + +func (x *EntityManagement) GetTypeName() string { + if x != nil { + return x.TypeName + } + return "" +} + +func (x *EntityManagement) GetTypeUid() EntityManagement_TypeUid { + if x != nil { + return x.TypeUid + } + return EntityManagement_TYPE_UID_UNKNOWN +} + +func (x *EntityManagement) GetUnmapped() *structpb.Value { + if x != nil { + return x.Unmapped + } + return nil +} + +var File_ocsf_v1_entity_management_proto protoreflect.FileDescriptor + +const file_ocsf_v1_entity_management_proto_rawDesc = "" + + "\n" + + "\x1focsf/v1/entity_management.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x15ocsf/v1/objects.proto\"\x8d,\n" + + "\x10EntityManagement\x12\x1f\n" + + "\vaccess_list\x18\x01 \x03(\tR\n" + + "accessList\x12\x1f\n" + + "\vaccess_mask\x18\x02 \x01(\x05R\n" + + "accessMask\x12\x16\n" + + "\x06action\x18\x03 \x01(\tR\x06action\x12?\n" + + "\taction_id\x18\x04 \x01(\x0e2\".ocsf.v1.EntityManagement.ActionIdR\bactionId\x12M\n" + + "\vactivity_id\x18\x05 \x01(\x0e2$.ocsf.v1.EntityManagement.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "activityId\x12#\n" + + "\ractivity_name\x18\x06 \x01(\tR\factivityName\x12$\n" + + "\x05actor\x18\a \x01(\v2\x0e.ocsf.v1.ActorR\x05actor\x12\x1e\n" + + "\x03api\x18\b \x01(\v2\f.ocsf.v1.ApiR\x03api\x12)\n" + + "\aattacks\x18\t \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + + "\x0eauthorizations\x18\n" + + " \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + + "\rcategory_name\x18\v \x01(\tR\fcategoryName\x12P\n" + + "\fcategory_uid\x18\f \x01(\x0e2%.ocsf.v1.EntityManagement.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + + "\n" + + "class_name\x18\r \x01(\tR\tclassName\x12G\n" + + "\tclass_uid\x18\x0e \x01(\x0e2\".ocsf.v1.EntityManagement.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + + "\x05cloud\x18\x0f \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x18\n" + + "\acomment\x18\x10 \x01(\tR\acomment\x12\x1e\n" + + "\n" + + "confidence\x18\x11 \x01(\tR\n" + + "confidence\x12K\n" + + "\rconfidence_id\x18\x12 \x01(\x0e2&.ocsf.v1.EntityManagement.ConfidenceIdR\fconfidenceId\x12)\n" + + "\x10confidence_score\x18\x13 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + + "\x05count\x18\x14 \x01(\x05R\x05count\x12'\n" + + "\x06device\x18\x15 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + + "\vdisposition\x18\x16 \x01(\tR\vdisposition\x12N\n" + + "\x0edisposition_id\x18\x17 \x01(\x0e2'.ocsf.v1.EntityManagement.DispositionIdR\rdispositionId\x12\x1a\n" + + "\bduration\x18\x18 \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x19 \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x1a \x01(\tR\tendTimeDt\x125\n" + + "\venrichments\x18\x1b \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x126\n" + + "\x06entity\x18\x1c \x01(\v2\x16.ocsf.v1.ManagedEntityB\x06\xbaH\x03\xc8\x01\x01R\x06entity\x12;\n" + + "\rentity_result\x18\x1d \x01(\v2\x16.ocsf.v1.ManagedEntityR\fentityResult\x12:\n" + + "\rfirewall_rule\x18\x1e \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + + "\fhttp_request\x18\x1f \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + + "\rhttp_response\x18 \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + + "\bis_alert\x18! \x01(\bR\aisAlert\x12*\n" + + "\amalware\x18\" \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + + "\x11malware_scan_info\x18# \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + + "\amessage\x18$ \x01(\tR\amessage\x125\n" + + "\bmetadata\x18% \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + + "\vobservables\x18& \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + + "\x05osint\x18' \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + + "\x06policy\x18( \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + + "\braw_data\x18) \x01(\tR\arawData\x128\n" + + "\rraw_data_hash\x18* \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + + "\rraw_data_size\x18+ \x01(\x03R\vrawDataSize\x12!\n" + + "\frisk_details\x18, \x01(\tR\vriskDetails\x12\x1d\n" + + "\n" + + "risk_level\x18- \x01(\tR\triskLevel\x12I\n" + + "\rrisk_level_id\x18. \x01(\x0e2%.ocsf.v1.EntityManagement.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x18/ \x01(\x05R\triskScore\x12\x1a\n" + + "\bseverity\x180 \x01(\tR\bseverity\x12M\n" + + "\vseverity_id\x181 \x01(\x0e2$.ocsf.v1.EntityManagement.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "severityId\x12;\n" + + "\fsrc_endpoint\x182 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vsrcEndpoint\x12\x1d\n" + + "\n" + + "start_time\x183 \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x184 \x01(\tR\vstartTimeDt\x12\x16\n" + + "\x06status\x185 \x01(\tR\x06status\x12\x1f\n" + + "\vstatus_code\x186 \x01(\tR\n" + + "statusCode\x12#\n" + + "\rstatus_detail\x187 \x01(\tR\fstatusDetail\x12?\n" + + "\tstatus_id\x188 \x01(\x0e2\".ocsf.v1.EntityManagement.StatusIdR\bstatusId\x12\x1a\n" + + "\x04time\x189 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + + "\atime_dt\x18: \x01(\tR\x06timeDt\x12'\n" + + "\x0ftimezone_offset\x18; \x01(\x05R\x0etimezoneOffset\x12\x1b\n" + + "\ttype_name\x18< \x01(\tR\btypeName\x12D\n" + + "\btype_uid\x18= \x01(\x0e2!.ocsf.v1.EntityManagement.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + + "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + + "\bActionId\x12\x15\n" + + "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + + "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + + "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + + "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + + "\x0fACTION_ID_OTHER\x10c\"\xfa\x02\n" + + "\n" + + "ActivityId\x12\x17\n" + + "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + + "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + + "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + + "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + + "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x14\n" + + "\x10ACTIVITY_ID_MOVE\x10\x05\x12\x16\n" + + "\x12ACTIVITY_ID_ENROLL\x10\x06\x12\x18\n" + + "\x14ACTIVITY_ID_UNENROLL\x10\a\x12\x16\n" + + "\x12ACTIVITY_ID_ENABLE\x10\b\x12\x17\n" + + "\x13ACTIVITY_ID_DISABLE\x10\t\x12\x18\n" + + "\x14ACTIVITY_ID_ACTIVATE\x10\n" + + "\x12\x1a\n" + + "\x16ACTIVITY_ID_DEACTIVATE\x10\v\x12\x17\n" + + "\x13ACTIVITY_ID_SUSPEND\x10\f\x12\x16\n" + + "\x12ACTIVITY_ID_RESUME\x10\r\x12\x15\n" + + "\x11ACTIVITY_ID_OTHER\x10c\"T\n" + + "\vCategoryUid\x12\x18\n" + + "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12+\n" + + "'CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT\x10\x03\"C\n" + + "\bClassUid\x12\x15\n" + + "\x11CLASS_UID_UNKNOWN\x10\x00\x12 \n" + + "\x1bCLASS_UID_ENTITY_MANAGEMENT\x10\xbc\x17\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + + "\rDispositionId\x12\x1a\n" + + "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + + "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + + "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + + "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + + "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + + "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + + "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + + "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + + "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + + "\x19DISPOSITION_ID_EXONERATED\x10\n" + + "\x12\x1c\n" + + "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + + "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + + "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + + "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + + "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + + "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + + "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + + "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + + "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + + "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + + "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + + "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + + "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + + "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + + "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + + "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + + "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + + "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"d\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + + "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c\"\x8c\x05\n" + + "\aTypeUid\x12\x14\n" + + "\x10TYPE_UID_UNKNOWN\x10\x00\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN\x10\xf0\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_CREATE\x10\xf1\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_READ\x10\xf2\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_UPDATE\x10\xf3\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_DELETE\x10\xf4\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_MOVE\x10\xf5\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENROLL\x10\xf6\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_UNENROLL\x10\xf7\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENABLE\x10\xf8\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_DISABLE\x10\xf9\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE\x10\xfa\xaa\x12\x12+\n" + + "%TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE\x10\xfb\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_SUSPEND\x10\xfc\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_RESUME\x10\xfd\xaa\x12\x12&\n" + + " TYPE_UID_ENTITY_MANAGEMENT_OTHER\x10ӫ\x12b\x06proto3" + +var ( + file_ocsf_v1_entity_management_proto_rawDescOnce sync.Once + file_ocsf_v1_entity_management_proto_rawDescData []byte +) + +func file_ocsf_v1_entity_management_proto_rawDescGZIP() []byte { + file_ocsf_v1_entity_management_proto_rawDescOnce.Do(func() { + file_ocsf_v1_entity_management_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ocsf_v1_entity_management_proto_rawDesc), len(file_ocsf_v1_entity_management_proto_rawDesc))) + }) + return file_ocsf_v1_entity_management_proto_rawDescData +} + +var file_ocsf_v1_entity_management_proto_enumTypes = make([]protoimpl.EnumInfo, 10) +var file_ocsf_v1_entity_management_proto_msgTypes = make([]protoimpl.MessageInfo, 1) +var file_ocsf_v1_entity_management_proto_goTypes = []any{ + (EntityManagement_ActionId)(0), // 0: ocsf.v1.EntityManagement.ActionId + (EntityManagement_ActivityId)(0), // 1: ocsf.v1.EntityManagement.ActivityId + (EntityManagement_CategoryUid)(0), // 2: ocsf.v1.EntityManagement.CategoryUid + (EntityManagement_ClassUid)(0), // 3: ocsf.v1.EntityManagement.ClassUid + (EntityManagement_ConfidenceId)(0), // 4: ocsf.v1.EntityManagement.ConfidenceId + (EntityManagement_DispositionId)(0), // 5: ocsf.v1.EntityManagement.DispositionId + (EntityManagement_RiskLevelId)(0), // 6: ocsf.v1.EntityManagement.RiskLevelId + (EntityManagement_SeverityId)(0), // 7: ocsf.v1.EntityManagement.SeverityId + (EntityManagement_StatusId)(0), // 8: ocsf.v1.EntityManagement.StatusId + (EntityManagement_TypeUid)(0), // 9: ocsf.v1.EntityManagement.TypeUid + (*EntityManagement)(nil), // 10: ocsf.v1.EntityManagement + (*Actor)(nil), // 11: ocsf.v1.Actor + (*Api)(nil), // 12: ocsf.v1.Api + (*Attack)(nil), // 13: ocsf.v1.Attack + (*Authorization)(nil), // 14: ocsf.v1.Authorization + (*Cloud)(nil), // 15: ocsf.v1.Cloud + (*Device)(nil), // 16: ocsf.v1.Device + (*Enrichment)(nil), // 17: ocsf.v1.Enrichment + (*ManagedEntity)(nil), // 18: ocsf.v1.ManagedEntity + (*FirewallRule)(nil), // 19: ocsf.v1.FirewallRule + (*HttpRequest)(nil), // 20: ocsf.v1.HttpRequest + (*HttpResponse)(nil), // 21: ocsf.v1.HttpResponse + (*Malware)(nil), // 22: ocsf.v1.Malware + (*MalwareScanInfo)(nil), // 23: ocsf.v1.MalwareScanInfo + (*Metadata)(nil), // 24: ocsf.v1.Metadata + (*Observable)(nil), // 25: ocsf.v1.Observable + (*Osint)(nil), // 26: ocsf.v1.Osint + (*Policy)(nil), // 27: ocsf.v1.Policy + (*Fingerprint)(nil), // 28: ocsf.v1.Fingerprint + (*NetworkEndpoint)(nil), // 29: ocsf.v1.NetworkEndpoint + (*structpb.Value)(nil), // 30: google.protobuf.Value +} +var file_ocsf_v1_entity_management_proto_depIdxs = []int32{ + 0, // 0: ocsf.v1.EntityManagement.action_id:type_name -> ocsf.v1.EntityManagement.ActionId + 1, // 1: ocsf.v1.EntityManagement.activity_id:type_name -> ocsf.v1.EntityManagement.ActivityId + 11, // 2: ocsf.v1.EntityManagement.actor:type_name -> ocsf.v1.Actor + 12, // 3: ocsf.v1.EntityManagement.api:type_name -> ocsf.v1.Api + 13, // 4: ocsf.v1.EntityManagement.attacks:type_name -> ocsf.v1.Attack + 14, // 5: ocsf.v1.EntityManagement.authorizations:type_name -> ocsf.v1.Authorization + 2, // 6: ocsf.v1.EntityManagement.category_uid:type_name -> ocsf.v1.EntityManagement.CategoryUid + 3, // 7: ocsf.v1.EntityManagement.class_uid:type_name -> ocsf.v1.EntityManagement.ClassUid + 15, // 8: ocsf.v1.EntityManagement.cloud:type_name -> ocsf.v1.Cloud + 4, // 9: ocsf.v1.EntityManagement.confidence_id:type_name -> ocsf.v1.EntityManagement.ConfidenceId + 16, // 10: ocsf.v1.EntityManagement.device:type_name -> ocsf.v1.Device + 5, // 11: ocsf.v1.EntityManagement.disposition_id:type_name -> ocsf.v1.EntityManagement.DispositionId + 17, // 12: ocsf.v1.EntityManagement.enrichments:type_name -> ocsf.v1.Enrichment + 18, // 13: ocsf.v1.EntityManagement.entity:type_name -> ocsf.v1.ManagedEntity + 18, // 14: ocsf.v1.EntityManagement.entity_result:type_name -> ocsf.v1.ManagedEntity + 19, // 15: ocsf.v1.EntityManagement.firewall_rule:type_name -> ocsf.v1.FirewallRule + 20, // 16: ocsf.v1.EntityManagement.http_request:type_name -> ocsf.v1.HttpRequest + 21, // 17: ocsf.v1.EntityManagement.http_response:type_name -> ocsf.v1.HttpResponse + 22, // 18: ocsf.v1.EntityManagement.malware:type_name -> ocsf.v1.Malware + 23, // 19: ocsf.v1.EntityManagement.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo + 24, // 20: ocsf.v1.EntityManagement.metadata:type_name -> ocsf.v1.Metadata + 25, // 21: ocsf.v1.EntityManagement.observables:type_name -> ocsf.v1.Observable + 26, // 22: ocsf.v1.EntityManagement.osint:type_name -> ocsf.v1.Osint + 27, // 23: ocsf.v1.EntityManagement.policy:type_name -> ocsf.v1.Policy + 28, // 24: ocsf.v1.EntityManagement.raw_data_hash:type_name -> ocsf.v1.Fingerprint + 6, // 25: ocsf.v1.EntityManagement.risk_level_id:type_name -> ocsf.v1.EntityManagement.RiskLevelId + 7, // 26: ocsf.v1.EntityManagement.severity_id:type_name -> ocsf.v1.EntityManagement.SeverityId + 29, // 27: ocsf.v1.EntityManagement.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 8, // 28: ocsf.v1.EntityManagement.status_id:type_name -> ocsf.v1.EntityManagement.StatusId + 9, // 29: ocsf.v1.EntityManagement.type_uid:type_name -> ocsf.v1.EntityManagement.TypeUid + 30, // 30: ocsf.v1.EntityManagement.unmapped:type_name -> google.protobuf.Value + 31, // [31:31] is the sub-list for method output_type + 31, // [31:31] is the sub-list for method input_type + 31, // [31:31] is the sub-list for extension type_name + 31, // [31:31] is the sub-list for extension extendee + 0, // [0:31] is the sub-list for field type_name +} + +func init() { file_ocsf_v1_entity_management_proto_init() } +func file_ocsf_v1_entity_management_proto_init() { + if File_ocsf_v1_entity_management_proto != nil { + return + } + file_ocsf_v1_objects_proto_init() + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_ocsf_v1_entity_management_proto_rawDesc), len(file_ocsf_v1_entity_management_proto_rawDesc)), + NumEnums: 10, + NumMessages: 1, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_ocsf_v1_entity_management_proto_goTypes, + DependencyIndexes: file_ocsf_v1_entity_management_proto_depIdxs, + EnumInfos: file_ocsf_v1_entity_management_proto_enumTypes, + MessageInfos: file_ocsf_v1_entity_management_proto_msgTypes, + }.Build() + File_ocsf_v1_entity_management_proto = out.File + file_ocsf_v1_entity_management_proto_goTypes = nil + file_ocsf_v1_entity_management_proto_depIdxs = nil +} diff --git a/ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/objects.pb.go similarity index 80% rename from ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go rename to ocsf/internal/ocsf/conformance/genpb/ocsf/v1/objects.pb.go index c7c1b15..0ff0145 100644 --- a/ocsf/internal/ocsf/conformance/genpb/api_entity.pb.go +++ b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/objects.pb.go @@ -14,7 +14,7 @@ // versions: // protoc-gen-go v1.36.6 // protoc (unknown) -// source: api_entity.proto +// source: ocsf/v1/objects.proto package ocsfv1 @@ -36,410 +36,437 @@ const ( _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) -type ApiActivity_ActionId int32 +type Account_TypeId int32 const ( - ApiActivity_ACTION_ID_UNKNOWN ApiActivity_ActionId = 0 - ApiActivity_ACTION_ID_ALLOWED ApiActivity_ActionId = 1 - ApiActivity_ACTION_ID_DENIED ApiActivity_ActionId = 2 - ApiActivity_ACTION_ID_OBSERVED ApiActivity_ActionId = 3 - ApiActivity_ACTION_ID_MODIFIED ApiActivity_ActionId = 4 - ApiActivity_ACTION_ID_OTHER ApiActivity_ActionId = 99 + Account_TYPE_ID_UNKNOWN Account_TypeId = 0 + Account_TYPE_ID_LDAP_ACCOUNT Account_TypeId = 1 + Account_TYPE_ID_WINDOWS_ACCOUNT Account_TypeId = 2 + Account_TYPE_ID_AWS_IAM_USER Account_TypeId = 3 + Account_TYPE_ID_AWS_IAM_ROLE Account_TypeId = 4 + Account_TYPE_ID_GCP_ACCOUNT Account_TypeId = 5 + Account_TYPE_ID_AZURE_AD_ACCOUNT Account_TypeId = 6 + Account_TYPE_ID_MAC_OS_ACCOUNT Account_TypeId = 7 + Account_TYPE_ID_APPLE_ACCOUNT Account_TypeId = 8 + Account_TYPE_ID_LINUX_ACCOUNT Account_TypeId = 9 + Account_TYPE_ID_AWS_ACCOUNT Account_TypeId = 10 + Account_TYPE_ID_GCP_PROJECT Account_TypeId = 11 + Account_TYPE_ID_OCI_COMPARTMENT Account_TypeId = 12 + Account_TYPE_ID_AZURE_SUBSCRIPTION Account_TypeId = 13 + Account_TYPE_ID_SALESFORCE_ACCOUNT Account_TypeId = 14 + Account_TYPE_ID_GOOGLE_WORKSPACE Account_TypeId = 15 + Account_TYPE_ID_SERVICENOW_INSTANCE Account_TypeId = 16 + Account_TYPE_ID_M365_TENANT Account_TypeId = 17 + Account_TYPE_ID_EMAIL_ACCOUNT Account_TypeId = 18 + Account_TYPE_ID_ACTIVEDIRECTORY_ACCOUNT Account_TypeId = 19 + Account_TYPE_ID_OTHER Account_TypeId = 99 ) -// Enum value maps for ApiActivity_ActionId. +// Enum value maps for Account_TypeId. var ( - ApiActivity_ActionId_name = map[int32]string{ - 0: "ACTION_ID_UNKNOWN", - 1: "ACTION_ID_ALLOWED", - 2: "ACTION_ID_DENIED", - 3: "ACTION_ID_OBSERVED", - 4: "ACTION_ID_MODIFIED", - 99: "ACTION_ID_OTHER", - } - ApiActivity_ActionId_value = map[string]int32{ - "ACTION_ID_UNKNOWN": 0, - "ACTION_ID_ALLOWED": 1, - "ACTION_ID_DENIED": 2, - "ACTION_ID_OBSERVED": 3, - "ACTION_ID_MODIFIED": 4, - "ACTION_ID_OTHER": 99, + Account_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_LDAP_ACCOUNT", + 2: "TYPE_ID_WINDOWS_ACCOUNT", + 3: "TYPE_ID_AWS_IAM_USER", + 4: "TYPE_ID_AWS_IAM_ROLE", + 5: "TYPE_ID_GCP_ACCOUNT", + 6: "TYPE_ID_AZURE_AD_ACCOUNT", + 7: "TYPE_ID_MAC_OS_ACCOUNT", + 8: "TYPE_ID_APPLE_ACCOUNT", + 9: "TYPE_ID_LINUX_ACCOUNT", + 10: "TYPE_ID_AWS_ACCOUNT", + 11: "TYPE_ID_GCP_PROJECT", + 12: "TYPE_ID_OCI_COMPARTMENT", + 13: "TYPE_ID_AZURE_SUBSCRIPTION", + 14: "TYPE_ID_SALESFORCE_ACCOUNT", + 15: "TYPE_ID_GOOGLE_WORKSPACE", + 16: "TYPE_ID_SERVICENOW_INSTANCE", + 17: "TYPE_ID_M365_TENANT", + 18: "TYPE_ID_EMAIL_ACCOUNT", + 19: "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT", + 99: "TYPE_ID_OTHER", + } + Account_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_LDAP_ACCOUNT": 1, + "TYPE_ID_WINDOWS_ACCOUNT": 2, + "TYPE_ID_AWS_IAM_USER": 3, + "TYPE_ID_AWS_IAM_ROLE": 4, + "TYPE_ID_GCP_ACCOUNT": 5, + "TYPE_ID_AZURE_AD_ACCOUNT": 6, + "TYPE_ID_MAC_OS_ACCOUNT": 7, + "TYPE_ID_APPLE_ACCOUNT": 8, + "TYPE_ID_LINUX_ACCOUNT": 9, + "TYPE_ID_AWS_ACCOUNT": 10, + "TYPE_ID_GCP_PROJECT": 11, + "TYPE_ID_OCI_COMPARTMENT": 12, + "TYPE_ID_AZURE_SUBSCRIPTION": 13, + "TYPE_ID_SALESFORCE_ACCOUNT": 14, + "TYPE_ID_GOOGLE_WORKSPACE": 15, + "TYPE_ID_SERVICENOW_INSTANCE": 16, + "TYPE_ID_M365_TENANT": 17, + "TYPE_ID_EMAIL_ACCOUNT": 18, + "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT": 19, + "TYPE_ID_OTHER": 99, } ) -func (x ApiActivity_ActionId) Enum() *ApiActivity_ActionId { - p := new(ApiActivity_ActionId) +func (x Account_TypeId) Enum() *Account_TypeId { + p := new(Account_TypeId) *p = x return p } -func (x ApiActivity_ActionId) String() string { +func (x Account_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_ActionId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[0].Descriptor() +func (Account_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[0].Descriptor() } -func (ApiActivity_ActionId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[0] +func (Account_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[0] } -func (x ApiActivity_ActionId) Number() protoreflect.EnumNumber { +func (x Account_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_ActionId.Descriptor instead. -func (ApiActivity_ActionId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 0} +// Deprecated: Use Account_TypeId.Descriptor instead. +func (Account_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{0, 0} } -type ApiActivity_ActivityId int32 +type Advisory_InstallStateId int32 const ( - ApiActivity_ACTIVITY_ID_UNKNOWN ApiActivity_ActivityId = 0 - ApiActivity_ACTIVITY_ID_CREATE ApiActivity_ActivityId = 1 - ApiActivity_ACTIVITY_ID_READ ApiActivity_ActivityId = 2 - ApiActivity_ACTIVITY_ID_UPDATE ApiActivity_ActivityId = 3 - ApiActivity_ACTIVITY_ID_DELETE ApiActivity_ActivityId = 4 - ApiActivity_ACTIVITY_ID_OTHER ApiActivity_ActivityId = 99 + Advisory_INSTALL_STATE_ID_UNKNOWN Advisory_InstallStateId = 0 + Advisory_INSTALL_STATE_ID_INSTALLED Advisory_InstallStateId = 1 + Advisory_INSTALL_STATE_ID_NOT_INSTALLED Advisory_InstallStateId = 2 + Advisory_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT Advisory_InstallStateId = 3 + Advisory_INSTALL_STATE_ID_OTHER Advisory_InstallStateId = 99 ) -// Enum value maps for ApiActivity_ActivityId. +// Enum value maps for Advisory_InstallStateId. var ( - ApiActivity_ActivityId_name = map[int32]string{ - 0: "ACTIVITY_ID_UNKNOWN", - 1: "ACTIVITY_ID_CREATE", - 2: "ACTIVITY_ID_READ", - 3: "ACTIVITY_ID_UPDATE", - 4: "ACTIVITY_ID_DELETE", - 99: "ACTIVITY_ID_OTHER", - } - ApiActivity_ActivityId_value = map[string]int32{ - "ACTIVITY_ID_UNKNOWN": 0, - "ACTIVITY_ID_CREATE": 1, - "ACTIVITY_ID_READ": 2, - "ACTIVITY_ID_UPDATE": 3, - "ACTIVITY_ID_DELETE": 4, - "ACTIVITY_ID_OTHER": 99, + Advisory_InstallStateId_name = map[int32]string{ + 0: "INSTALL_STATE_ID_UNKNOWN", + 1: "INSTALL_STATE_ID_INSTALLED", + 2: "INSTALL_STATE_ID_NOT_INSTALLED", + 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", + 99: "INSTALL_STATE_ID_OTHER", + } + Advisory_InstallStateId_value = map[string]int32{ + "INSTALL_STATE_ID_UNKNOWN": 0, + "INSTALL_STATE_ID_INSTALLED": 1, + "INSTALL_STATE_ID_NOT_INSTALLED": 2, + "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, + "INSTALL_STATE_ID_OTHER": 99, } ) -func (x ApiActivity_ActivityId) Enum() *ApiActivity_ActivityId { - p := new(ApiActivity_ActivityId) +func (x Advisory_InstallStateId) Enum() *Advisory_InstallStateId { + p := new(Advisory_InstallStateId) *p = x return p } -func (x ApiActivity_ActivityId) String() string { +func (x Advisory_InstallStateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_ActivityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[1].Descriptor() +func (Advisory_InstallStateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[1].Descriptor() } -func (ApiActivity_ActivityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[1] +func (Advisory_InstallStateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[1] } -func (x ApiActivity_ActivityId) Number() protoreflect.EnumNumber { +func (x Advisory_InstallStateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_ActivityId.Descriptor instead. -func (ApiActivity_ActivityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 1} +// Deprecated: Use Advisory_InstallStateId.Descriptor instead. +func (Advisory_InstallStateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{2, 0} } -type ApiActivity_CategoryUid int32 +type AffectedPackage_TypeId int32 const ( - ApiActivity_CATEGORY_UID_UNKNOWN ApiActivity_CategoryUid = 0 - ApiActivity_CATEGORY_UID_APPLICATION_ACTIVITY ApiActivity_CategoryUid = 6 + AffectedPackage_TYPE_ID_UNKNOWN AffectedPackage_TypeId = 0 + AffectedPackage_TYPE_ID_APPLICATION AffectedPackage_TypeId = 1 + AffectedPackage_TYPE_ID_OPERATING_SYSTEM AffectedPackage_TypeId = 2 + AffectedPackage_TYPE_ID_OTHER AffectedPackage_TypeId = 99 ) -// Enum value maps for ApiActivity_CategoryUid. +// Enum value maps for AffectedPackage_TypeId. var ( - ApiActivity_CategoryUid_name = map[int32]string{ - 0: "CATEGORY_UID_UNKNOWN", - 6: "CATEGORY_UID_APPLICATION_ACTIVITY", + AffectedPackage_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_APPLICATION", + 2: "TYPE_ID_OPERATING_SYSTEM", + 99: "TYPE_ID_OTHER", } - ApiActivity_CategoryUid_value = map[string]int32{ - "CATEGORY_UID_UNKNOWN": 0, - "CATEGORY_UID_APPLICATION_ACTIVITY": 6, + AffectedPackage_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_APPLICATION": 1, + "TYPE_ID_OPERATING_SYSTEM": 2, + "TYPE_ID_OTHER": 99, } ) -func (x ApiActivity_CategoryUid) Enum() *ApiActivity_CategoryUid { - p := new(ApiActivity_CategoryUid) +func (x AffectedPackage_TypeId) Enum() *AffectedPackage_TypeId { + p := new(AffectedPackage_TypeId) *p = x return p } -func (x ApiActivity_CategoryUid) String() string { +func (x AffectedPackage_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_CategoryUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[2].Descriptor() +func (AffectedPackage_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[2].Descriptor() } -func (ApiActivity_CategoryUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[2] +func (AffectedPackage_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[2] } -func (x ApiActivity_CategoryUid) Number() protoreflect.EnumNumber { +func (x AffectedPackage_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_CategoryUid.Descriptor instead. -func (ApiActivity_CategoryUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 2} +// Deprecated: Use AffectedPackage_TypeId.Descriptor instead. +func (AffectedPackage_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{4, 0} } -type ApiActivity_ClassUid int32 +type Agent_TypeId int32 const ( - ApiActivity_CLASS_UID_UNKNOWN ApiActivity_ClassUid = 0 - ApiActivity_CLASS_UID_API_ACTIVITY ApiActivity_ClassUid = 6003 + Agent_TYPE_ID_UNKNOWN Agent_TypeId = 0 + Agent_TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE Agent_TypeId = 1 + Agent_TYPE_ID_DATA_LOSS_PREVENTION Agent_TypeId = 2 + Agent_TYPE_ID_BACKUP_RECOVERY Agent_TypeId = 3 + Agent_TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY Agent_TypeId = 4 + Agent_TYPE_ID_VULNERABILITY_MANAGEMENT Agent_TypeId = 5 + Agent_TYPE_ID_LOG_FORWARDING Agent_TypeId = 6 + Agent_TYPE_ID_MOBILE_DEVICE_MANAGEMENT Agent_TypeId = 7 + Agent_TYPE_ID_CONFIGURATION_MANAGEMENT Agent_TypeId = 8 + Agent_TYPE_ID_REMOTE_ACCESS Agent_TypeId = 9 + Agent_TYPE_ID_OTHER Agent_TypeId = 99 ) -// Enum value maps for ApiActivity_ClassUid. +// Enum value maps for Agent_TypeId. var ( - ApiActivity_ClassUid_name = map[int32]string{ - 0: "CLASS_UID_UNKNOWN", - 6003: "CLASS_UID_API_ACTIVITY", + Agent_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE", + 2: "TYPE_ID_DATA_LOSS_PREVENTION", + 3: "TYPE_ID_BACKUP_RECOVERY", + 4: "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY", + 5: "TYPE_ID_VULNERABILITY_MANAGEMENT", + 6: "TYPE_ID_LOG_FORWARDING", + 7: "TYPE_ID_MOBILE_DEVICE_MANAGEMENT", + 8: "TYPE_ID_CONFIGURATION_MANAGEMENT", + 9: "TYPE_ID_REMOTE_ACCESS", + 99: "TYPE_ID_OTHER", } - ApiActivity_ClassUid_value = map[string]int32{ - "CLASS_UID_UNKNOWN": 0, - "CLASS_UID_API_ACTIVITY": 6003, + Agent_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE": 1, + "TYPE_ID_DATA_LOSS_PREVENTION": 2, + "TYPE_ID_BACKUP_RECOVERY": 3, + "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY": 4, + "TYPE_ID_VULNERABILITY_MANAGEMENT": 5, + "TYPE_ID_LOG_FORWARDING": 6, + "TYPE_ID_MOBILE_DEVICE_MANAGEMENT": 7, + "TYPE_ID_CONFIGURATION_MANAGEMENT": 8, + "TYPE_ID_REMOTE_ACCESS": 9, + "TYPE_ID_OTHER": 99, } ) -func (x ApiActivity_ClassUid) Enum() *ApiActivity_ClassUid { - p := new(ApiActivity_ClassUid) +func (x Agent_TypeId) Enum() *Agent_TypeId { + p := new(Agent_TypeId) *p = x return p } -func (x ApiActivity_ClassUid) String() string { +func (x Agent_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_ClassUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[3].Descriptor() +func (Agent_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[3].Descriptor() } -func (ApiActivity_ClassUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[3] +func (Agent_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[3] } -func (x ApiActivity_ClassUid) Number() protoreflect.EnumNumber { +func (x Agent_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_ClassUid.Descriptor instead. -func (ApiActivity_ClassUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 3} +// Deprecated: Use Agent_TypeId.Descriptor instead. +func (Agent_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{5, 0} } -type ApiActivity_ConfidenceId int32 +type Analytic_StateId int32 const ( - ApiActivity_CONFIDENCE_ID_UNKNOWN ApiActivity_ConfidenceId = 0 - ApiActivity_CONFIDENCE_ID_LOW ApiActivity_ConfidenceId = 1 - ApiActivity_CONFIDENCE_ID_MEDIUM ApiActivity_ConfidenceId = 2 - ApiActivity_CONFIDENCE_ID_HIGH ApiActivity_ConfidenceId = 3 - ApiActivity_CONFIDENCE_ID_OTHER ApiActivity_ConfidenceId = 99 + Analytic_STATE_ID_UNKNOWN Analytic_StateId = 0 + Analytic_STATE_ID_ACTIVE Analytic_StateId = 1 + Analytic_STATE_ID_SUPPRESSED Analytic_StateId = 2 + Analytic_STATE_ID_EXPERIMENTAL Analytic_StateId = 3 + Analytic_STATE_ID_OTHER Analytic_StateId = 99 ) -// Enum value maps for ApiActivity_ConfidenceId. +// Enum value maps for Analytic_StateId. var ( - ApiActivity_ConfidenceId_name = map[int32]string{ - 0: "CONFIDENCE_ID_UNKNOWN", - 1: "CONFIDENCE_ID_LOW", - 2: "CONFIDENCE_ID_MEDIUM", - 3: "CONFIDENCE_ID_HIGH", - 99: "CONFIDENCE_ID_OTHER", + Analytic_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_ACTIVE", + 2: "STATE_ID_SUPPRESSED", + 3: "STATE_ID_EXPERIMENTAL", + 99: "STATE_ID_OTHER", } - ApiActivity_ConfidenceId_value = map[string]int32{ - "CONFIDENCE_ID_UNKNOWN": 0, - "CONFIDENCE_ID_LOW": 1, - "CONFIDENCE_ID_MEDIUM": 2, - "CONFIDENCE_ID_HIGH": 3, - "CONFIDENCE_ID_OTHER": 99, + Analytic_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_ACTIVE": 1, + "STATE_ID_SUPPRESSED": 2, + "STATE_ID_EXPERIMENTAL": 3, + "STATE_ID_OTHER": 99, } ) -func (x ApiActivity_ConfidenceId) Enum() *ApiActivity_ConfidenceId { - p := new(ApiActivity_ConfidenceId) +func (x Analytic_StateId) Enum() *Analytic_StateId { + p := new(Analytic_StateId) *p = x return p } -func (x ApiActivity_ConfidenceId) String() string { +func (x Analytic_StateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[4].Descriptor() +func (Analytic_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[4].Descriptor() } -func (ApiActivity_ConfidenceId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[4] +func (Analytic_StateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[4] } -func (x ApiActivity_ConfidenceId) Number() protoreflect.EnumNumber { +func (x Analytic_StateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_ConfidenceId.Descriptor instead. -func (ApiActivity_ConfidenceId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 4} +// Deprecated: Use Analytic_StateId.Descriptor instead. +func (Analytic_StateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{7, 0} } -type ApiActivity_DispositionId int32 +type Analytic_TypeId int32 const ( - ApiActivity_DISPOSITION_ID_UNKNOWN ApiActivity_DispositionId = 0 - ApiActivity_DISPOSITION_ID_ALLOWED ApiActivity_DispositionId = 1 - ApiActivity_DISPOSITION_ID_BLOCKED ApiActivity_DispositionId = 2 - ApiActivity_DISPOSITION_ID_QUARANTINED ApiActivity_DispositionId = 3 - ApiActivity_DISPOSITION_ID_ISOLATED ApiActivity_DispositionId = 4 - ApiActivity_DISPOSITION_ID_DELETED ApiActivity_DispositionId = 5 - ApiActivity_DISPOSITION_ID_DROPPED ApiActivity_DispositionId = 6 - ApiActivity_DISPOSITION_ID_CUSTOM_ACTION ApiActivity_DispositionId = 7 - ApiActivity_DISPOSITION_ID_APPROVED ApiActivity_DispositionId = 8 - ApiActivity_DISPOSITION_ID_RESTORED ApiActivity_DispositionId = 9 - ApiActivity_DISPOSITION_ID_EXONERATED ApiActivity_DispositionId = 10 - ApiActivity_DISPOSITION_ID_CORRECTED ApiActivity_DispositionId = 11 - ApiActivity_DISPOSITION_ID_PARTIALLY_CORRECTED ApiActivity_DispositionId = 12 - ApiActivity_DISPOSITION_ID_UNCORRECTED ApiActivity_DispositionId = 13 - ApiActivity_DISPOSITION_ID_DELAYED ApiActivity_DispositionId = 14 - ApiActivity_DISPOSITION_ID_DETECTED ApiActivity_DispositionId = 15 - ApiActivity_DISPOSITION_ID_NO_ACTION ApiActivity_DispositionId = 16 - ApiActivity_DISPOSITION_ID_LOGGED ApiActivity_DispositionId = 17 - ApiActivity_DISPOSITION_ID_TAGGED ApiActivity_DispositionId = 18 - ApiActivity_DISPOSITION_ID_ALERT ApiActivity_DispositionId = 19 - ApiActivity_DISPOSITION_ID_COUNT ApiActivity_DispositionId = 20 - ApiActivity_DISPOSITION_ID_RESET ApiActivity_DispositionId = 21 - ApiActivity_DISPOSITION_ID_CAPTCHA ApiActivity_DispositionId = 22 - ApiActivity_DISPOSITION_ID_CHALLENGE ApiActivity_DispositionId = 23 - ApiActivity_DISPOSITION_ID_ACCESS_REVOKED ApiActivity_DispositionId = 24 - ApiActivity_DISPOSITION_ID_REJECTED ApiActivity_DispositionId = 25 - ApiActivity_DISPOSITION_ID_UNAUTHORIZED ApiActivity_DispositionId = 26 - ApiActivity_DISPOSITION_ID_ERROR ApiActivity_DispositionId = 27 - ApiActivity_DISPOSITION_ID_OTHER ApiActivity_DispositionId = 99 + Analytic_TYPE_ID_UNKNOWN Analytic_TypeId = 0 + Analytic_TYPE_ID_RULE Analytic_TypeId = 1 + Analytic_TYPE_ID_BEHAVIORAL Analytic_TypeId = 2 + Analytic_TYPE_ID_STATISTICAL Analytic_TypeId = 3 + Analytic_TYPE_ID_LEARNING_ML_DL Analytic_TypeId = 4 + Analytic_TYPE_ID_FINGERPRINTING Analytic_TypeId = 5 + Analytic_TYPE_ID_TAGGING Analytic_TypeId = 6 + Analytic_TYPE_ID_KEYWORD_MATCH Analytic_TypeId = 7 + Analytic_TYPE_ID_REGULAR_EXPRESSIONS Analytic_TypeId = 8 + Analytic_TYPE_ID_EXACT_DATA_MATCH Analytic_TypeId = 9 + Analytic_TYPE_ID_PARTIAL_DATA_MATCH Analytic_TypeId = 10 + Analytic_TYPE_ID_INDEXED_DATA_MATCH Analytic_TypeId = 11 + Analytic_TYPE_ID_OTHER Analytic_TypeId = 99 ) -// Enum value maps for ApiActivity_DispositionId. +// Enum value maps for Analytic_TypeId. var ( - ApiActivity_DispositionId_name = map[int32]string{ - 0: "DISPOSITION_ID_UNKNOWN", - 1: "DISPOSITION_ID_ALLOWED", - 2: "DISPOSITION_ID_BLOCKED", - 3: "DISPOSITION_ID_QUARANTINED", - 4: "DISPOSITION_ID_ISOLATED", - 5: "DISPOSITION_ID_DELETED", - 6: "DISPOSITION_ID_DROPPED", - 7: "DISPOSITION_ID_CUSTOM_ACTION", - 8: "DISPOSITION_ID_APPROVED", - 9: "DISPOSITION_ID_RESTORED", - 10: "DISPOSITION_ID_EXONERATED", - 11: "DISPOSITION_ID_CORRECTED", - 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", - 13: "DISPOSITION_ID_UNCORRECTED", - 14: "DISPOSITION_ID_DELAYED", - 15: "DISPOSITION_ID_DETECTED", - 16: "DISPOSITION_ID_NO_ACTION", - 17: "DISPOSITION_ID_LOGGED", - 18: "DISPOSITION_ID_TAGGED", - 19: "DISPOSITION_ID_ALERT", - 20: "DISPOSITION_ID_COUNT", - 21: "DISPOSITION_ID_RESET", - 22: "DISPOSITION_ID_CAPTCHA", - 23: "DISPOSITION_ID_CHALLENGE", - 24: "DISPOSITION_ID_ACCESS_REVOKED", - 25: "DISPOSITION_ID_REJECTED", - 26: "DISPOSITION_ID_UNAUTHORIZED", - 27: "DISPOSITION_ID_ERROR", - 99: "DISPOSITION_ID_OTHER", - } - ApiActivity_DispositionId_value = map[string]int32{ - "DISPOSITION_ID_UNKNOWN": 0, - "DISPOSITION_ID_ALLOWED": 1, - "DISPOSITION_ID_BLOCKED": 2, - "DISPOSITION_ID_QUARANTINED": 3, - "DISPOSITION_ID_ISOLATED": 4, - "DISPOSITION_ID_DELETED": 5, - "DISPOSITION_ID_DROPPED": 6, - "DISPOSITION_ID_CUSTOM_ACTION": 7, - "DISPOSITION_ID_APPROVED": 8, - "DISPOSITION_ID_RESTORED": 9, - "DISPOSITION_ID_EXONERATED": 10, - "DISPOSITION_ID_CORRECTED": 11, - "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, - "DISPOSITION_ID_UNCORRECTED": 13, - "DISPOSITION_ID_DELAYED": 14, - "DISPOSITION_ID_DETECTED": 15, - "DISPOSITION_ID_NO_ACTION": 16, - "DISPOSITION_ID_LOGGED": 17, - "DISPOSITION_ID_TAGGED": 18, - "DISPOSITION_ID_ALERT": 19, - "DISPOSITION_ID_COUNT": 20, - "DISPOSITION_ID_RESET": 21, - "DISPOSITION_ID_CAPTCHA": 22, - "DISPOSITION_ID_CHALLENGE": 23, - "DISPOSITION_ID_ACCESS_REVOKED": 24, - "DISPOSITION_ID_REJECTED": 25, - "DISPOSITION_ID_UNAUTHORIZED": 26, - "DISPOSITION_ID_ERROR": 27, - "DISPOSITION_ID_OTHER": 99, + Analytic_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_RULE", + 2: "TYPE_ID_BEHAVIORAL", + 3: "TYPE_ID_STATISTICAL", + 4: "TYPE_ID_LEARNING_ML_DL", + 5: "TYPE_ID_FINGERPRINTING", + 6: "TYPE_ID_TAGGING", + 7: "TYPE_ID_KEYWORD_MATCH", + 8: "TYPE_ID_REGULAR_EXPRESSIONS", + 9: "TYPE_ID_EXACT_DATA_MATCH", + 10: "TYPE_ID_PARTIAL_DATA_MATCH", + 11: "TYPE_ID_INDEXED_DATA_MATCH", + 99: "TYPE_ID_OTHER", + } + Analytic_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_RULE": 1, + "TYPE_ID_BEHAVIORAL": 2, + "TYPE_ID_STATISTICAL": 3, + "TYPE_ID_LEARNING_ML_DL": 4, + "TYPE_ID_FINGERPRINTING": 5, + "TYPE_ID_TAGGING": 6, + "TYPE_ID_KEYWORD_MATCH": 7, + "TYPE_ID_REGULAR_EXPRESSIONS": 8, + "TYPE_ID_EXACT_DATA_MATCH": 9, + "TYPE_ID_PARTIAL_DATA_MATCH": 10, + "TYPE_ID_INDEXED_DATA_MATCH": 11, + "TYPE_ID_OTHER": 99, } ) -func (x ApiActivity_DispositionId) Enum() *ApiActivity_DispositionId { - p := new(ApiActivity_DispositionId) +func (x Analytic_TypeId) Enum() *Analytic_TypeId { + p := new(Analytic_TypeId) *p = x return p } -func (x ApiActivity_DispositionId) String() string { +func (x Analytic_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_DispositionId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[5].Descriptor() +func (Analytic_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[5].Descriptor() } -func (ApiActivity_DispositionId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[5] +func (Analytic_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[5] } -func (x ApiActivity_DispositionId) Number() protoreflect.EnumNumber { +func (x Analytic_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_DispositionId.Descriptor instead. -func (ApiActivity_DispositionId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 5} +// Deprecated: Use Analytic_TypeId.Descriptor instead. +func (Analytic_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{7, 1} } -type ApiActivity_RiskLevelId int32 +type Application_RiskLevelId int32 const ( - ApiActivity_RISK_LEVEL_ID_INFO ApiActivity_RiskLevelId = 0 - ApiActivity_RISK_LEVEL_ID_LOW ApiActivity_RiskLevelId = 1 - ApiActivity_RISK_LEVEL_ID_MEDIUM ApiActivity_RiskLevelId = 2 - ApiActivity_RISK_LEVEL_ID_HIGH ApiActivity_RiskLevelId = 3 - ApiActivity_RISK_LEVEL_ID_CRITICAL ApiActivity_RiskLevelId = 4 - ApiActivity_RISK_LEVEL_ID_OTHER ApiActivity_RiskLevelId = 99 + Application_RISK_LEVEL_ID_INFO Application_RiskLevelId = 0 + Application_RISK_LEVEL_ID_LOW Application_RiskLevelId = 1 + Application_RISK_LEVEL_ID_MEDIUM Application_RiskLevelId = 2 + Application_RISK_LEVEL_ID_HIGH Application_RiskLevelId = 3 + Application_RISK_LEVEL_ID_CRITICAL Application_RiskLevelId = 4 + Application_RISK_LEVEL_ID_OTHER Application_RiskLevelId = 99 ) -// Enum value maps for ApiActivity_RiskLevelId. +// Enum value maps for Application_RiskLevelId. var ( - ApiActivity_RiskLevelId_name = map[int32]string{ + Application_RiskLevelId_name = map[int32]string{ 0: "RISK_LEVEL_ID_INFO", 1: "RISK_LEVEL_ID_LOW", 2: "RISK_LEVEL_ID_MEDIUM", @@ -447,7 +474,7 @@ var ( 4: "RISK_LEVEL_ID_CRITICAL", 99: "RISK_LEVEL_ID_OTHER", } - ApiActivity_RiskLevelId_value = map[string]int32{ + Application_RiskLevelId_value = map[string]int32{ "RISK_LEVEL_ID_INFO": 0, "RISK_LEVEL_ID_LOW": 1, "RISK_LEVEL_ID_MEDIUM": 2, @@ -457,6783 +484,4388 @@ var ( } ) -func (x ApiActivity_RiskLevelId) Enum() *ApiActivity_RiskLevelId { - p := new(ApiActivity_RiskLevelId) +func (x Application_RiskLevelId) Enum() *Application_RiskLevelId { + p := new(Application_RiskLevelId) *p = x return p } -func (x ApiActivity_RiskLevelId) String() string { +func (x Application_RiskLevelId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[6].Descriptor() +func (Application_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[6].Descriptor() } -func (ApiActivity_RiskLevelId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[6] +func (Application_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[6] } -func (x ApiActivity_RiskLevelId) Number() protoreflect.EnumNumber { +func (x Application_RiskLevelId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_RiskLevelId.Descriptor instead. -func (ApiActivity_RiskLevelId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 6} +// Deprecated: Use Application_RiskLevelId.Descriptor instead. +func (Application_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{9, 0} } -type ApiActivity_SeverityId int32 +type AuthFactor_FactorTypeId int32 const ( - ApiActivity_SEVERITY_ID_UNKNOWN ApiActivity_SeverityId = 0 - ApiActivity_SEVERITY_ID_INFORMATIONAL ApiActivity_SeverityId = 1 - ApiActivity_SEVERITY_ID_LOW ApiActivity_SeverityId = 2 - ApiActivity_SEVERITY_ID_MEDIUM ApiActivity_SeverityId = 3 - ApiActivity_SEVERITY_ID_HIGH ApiActivity_SeverityId = 4 - ApiActivity_SEVERITY_ID_CRITICAL ApiActivity_SeverityId = 5 - ApiActivity_SEVERITY_ID_FATAL ApiActivity_SeverityId = 6 - ApiActivity_SEVERITY_ID_OTHER ApiActivity_SeverityId = 99 + AuthFactor_FACTOR_TYPE_ID_UNKNOWN AuthFactor_FactorTypeId = 0 + AuthFactor_FACTOR_TYPE_ID_SMS AuthFactor_FactorTypeId = 1 + AuthFactor_FACTOR_TYPE_ID_SECURITY_QUESTION AuthFactor_FactorTypeId = 2 + AuthFactor_FACTOR_TYPE_ID_PHONE_CALL AuthFactor_FactorTypeId = 3 + AuthFactor_FACTOR_TYPE_ID_BIOMETRIC AuthFactor_FactorTypeId = 4 + AuthFactor_FACTOR_TYPE_ID_PUSH_NOTIFICATION AuthFactor_FactorTypeId = 5 + AuthFactor_FACTOR_TYPE_ID_HARDWARE_TOKEN AuthFactor_FactorTypeId = 6 + AuthFactor_FACTOR_TYPE_ID_OTP AuthFactor_FactorTypeId = 7 + AuthFactor_FACTOR_TYPE_ID_EMAIL AuthFactor_FactorTypeId = 8 + AuthFactor_FACTOR_TYPE_ID_U2F AuthFactor_FactorTypeId = 9 + AuthFactor_FACTOR_TYPE_ID_WEBAUTHN AuthFactor_FactorTypeId = 10 + AuthFactor_FACTOR_TYPE_ID_PASSWORD AuthFactor_FactorTypeId = 11 + AuthFactor_FACTOR_TYPE_ID_OTHER AuthFactor_FactorTypeId = 99 ) -// Enum value maps for ApiActivity_SeverityId. +// Enum value maps for AuthFactor_FactorTypeId. var ( - ApiActivity_SeverityId_name = map[int32]string{ - 0: "SEVERITY_ID_UNKNOWN", - 1: "SEVERITY_ID_INFORMATIONAL", - 2: "SEVERITY_ID_LOW", - 3: "SEVERITY_ID_MEDIUM", - 4: "SEVERITY_ID_HIGH", - 5: "SEVERITY_ID_CRITICAL", - 6: "SEVERITY_ID_FATAL", - 99: "SEVERITY_ID_OTHER", + AuthFactor_FactorTypeId_name = map[int32]string{ + 0: "FACTOR_TYPE_ID_UNKNOWN", + 1: "FACTOR_TYPE_ID_SMS", + 2: "FACTOR_TYPE_ID_SECURITY_QUESTION", + 3: "FACTOR_TYPE_ID_PHONE_CALL", + 4: "FACTOR_TYPE_ID_BIOMETRIC", + 5: "FACTOR_TYPE_ID_PUSH_NOTIFICATION", + 6: "FACTOR_TYPE_ID_HARDWARE_TOKEN", + 7: "FACTOR_TYPE_ID_OTP", + 8: "FACTOR_TYPE_ID_EMAIL", + 9: "FACTOR_TYPE_ID_U2F", + 10: "FACTOR_TYPE_ID_WEBAUTHN", + 11: "FACTOR_TYPE_ID_PASSWORD", + 99: "FACTOR_TYPE_ID_OTHER", } - ApiActivity_SeverityId_value = map[string]int32{ - "SEVERITY_ID_UNKNOWN": 0, - "SEVERITY_ID_INFORMATIONAL": 1, - "SEVERITY_ID_LOW": 2, - "SEVERITY_ID_MEDIUM": 3, - "SEVERITY_ID_HIGH": 4, - "SEVERITY_ID_CRITICAL": 5, - "SEVERITY_ID_FATAL": 6, - "SEVERITY_ID_OTHER": 99, + AuthFactor_FactorTypeId_value = map[string]int32{ + "FACTOR_TYPE_ID_UNKNOWN": 0, + "FACTOR_TYPE_ID_SMS": 1, + "FACTOR_TYPE_ID_SECURITY_QUESTION": 2, + "FACTOR_TYPE_ID_PHONE_CALL": 3, + "FACTOR_TYPE_ID_BIOMETRIC": 4, + "FACTOR_TYPE_ID_PUSH_NOTIFICATION": 5, + "FACTOR_TYPE_ID_HARDWARE_TOKEN": 6, + "FACTOR_TYPE_ID_OTP": 7, + "FACTOR_TYPE_ID_EMAIL": 8, + "FACTOR_TYPE_ID_U2F": 9, + "FACTOR_TYPE_ID_WEBAUTHN": 10, + "FACTOR_TYPE_ID_PASSWORD": 11, + "FACTOR_TYPE_ID_OTHER": 99, } ) -func (x ApiActivity_SeverityId) Enum() *ApiActivity_SeverityId { - p := new(ApiActivity_SeverityId) +func (x AuthFactor_FactorTypeId) Enum() *AuthFactor_FactorTypeId { + p := new(AuthFactor_FactorTypeId) *p = x return p } -func (x ApiActivity_SeverityId) String() string { +func (x AuthFactor_FactorTypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_SeverityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[7].Descriptor() +func (AuthFactor_FactorTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[7].Descriptor() } -func (ApiActivity_SeverityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[7] +func (AuthFactor_FactorTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[7] } -func (x ApiActivity_SeverityId) Number() protoreflect.EnumNumber { +func (x AuthFactor_FactorTypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_SeverityId.Descriptor instead. -func (ApiActivity_SeverityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 7} +// Deprecated: Use AuthFactor_FactorTypeId.Descriptor instead. +func (AuthFactor_FactorTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{11, 0} } -type ApiActivity_StatusId int32 +type DataClassification_CategoryId int32 const ( - ApiActivity_STATUS_ID_UNKNOWN ApiActivity_StatusId = 0 - ApiActivity_STATUS_ID_SUCCESS ApiActivity_StatusId = 1 - ApiActivity_STATUS_ID_FAILURE ApiActivity_StatusId = 2 - ApiActivity_STATUS_ID_OTHER ApiActivity_StatusId = 99 + DataClassification_CATEGORY_ID_UNKNOWN DataClassification_CategoryId = 0 + DataClassification_CATEGORY_ID_PERSONAL DataClassification_CategoryId = 1 + DataClassification_CATEGORY_ID_GOVERNMENTAL DataClassification_CategoryId = 2 + DataClassification_CATEGORY_ID_FINANCIAL DataClassification_CategoryId = 3 + DataClassification_CATEGORY_ID_BUSINESS DataClassification_CategoryId = 4 + DataClassification_CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT DataClassification_CategoryId = 5 + DataClassification_CATEGORY_ID_SECURITY DataClassification_CategoryId = 6 + DataClassification_CATEGORY_ID_OTHER DataClassification_CategoryId = 99 ) -// Enum value maps for ApiActivity_StatusId. +// Enum value maps for DataClassification_CategoryId. var ( - ApiActivity_StatusId_name = map[int32]string{ - 0: "STATUS_ID_UNKNOWN", - 1: "STATUS_ID_SUCCESS", - 2: "STATUS_ID_FAILURE", - 99: "STATUS_ID_OTHER", + DataClassification_CategoryId_name = map[int32]string{ + 0: "CATEGORY_ID_UNKNOWN", + 1: "CATEGORY_ID_PERSONAL", + 2: "CATEGORY_ID_GOVERNMENTAL", + 3: "CATEGORY_ID_FINANCIAL", + 4: "CATEGORY_ID_BUSINESS", + 5: "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT", + 6: "CATEGORY_ID_SECURITY", + 99: "CATEGORY_ID_OTHER", } - ApiActivity_StatusId_value = map[string]int32{ - "STATUS_ID_UNKNOWN": 0, - "STATUS_ID_SUCCESS": 1, - "STATUS_ID_FAILURE": 2, - "STATUS_ID_OTHER": 99, + DataClassification_CategoryId_value = map[string]int32{ + "CATEGORY_ID_UNKNOWN": 0, + "CATEGORY_ID_PERSONAL": 1, + "CATEGORY_ID_GOVERNMENTAL": 2, + "CATEGORY_ID_FINANCIAL": 3, + "CATEGORY_ID_BUSINESS": 4, + "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT": 5, + "CATEGORY_ID_SECURITY": 6, + "CATEGORY_ID_OTHER": 99, } ) -func (x ApiActivity_StatusId) Enum() *ApiActivity_StatusId { - p := new(ApiActivity_StatusId) +func (x DataClassification_CategoryId) Enum() *DataClassification_CategoryId { + p := new(DataClassification_CategoryId) *p = x return p } -func (x ApiActivity_StatusId) String() string { +func (x DataClassification_CategoryId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_StatusId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[8].Descriptor() +func (DataClassification_CategoryId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[8].Descriptor() } -func (ApiActivity_StatusId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[8] +func (DataClassification_CategoryId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[8] } -func (x ApiActivity_StatusId) Number() protoreflect.EnumNumber { +func (x DataClassification_CategoryId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_StatusId.Descriptor instead. -func (ApiActivity_StatusId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 8} +// Deprecated: Use DataClassification_CategoryId.Descriptor instead. +func (DataClassification_CategoryId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{26, 0} } -type ApiActivity_TypeUid int32 +type DataClassification_ConfidentialityId int32 const ( - ApiActivity_TYPE_UID_UNKNOWN ApiActivity_TypeUid = 0 - ApiActivity_TYPE_UID_API_ACTIVITY_UNKNOWN ApiActivity_TypeUid = 600300 - ApiActivity_TYPE_UID_API_ACTIVITY_CREATE ApiActivity_TypeUid = 600301 - ApiActivity_TYPE_UID_API_ACTIVITY_READ ApiActivity_TypeUid = 600302 - ApiActivity_TYPE_UID_API_ACTIVITY_UPDATE ApiActivity_TypeUid = 600303 - ApiActivity_TYPE_UID_API_ACTIVITY_DELETE ApiActivity_TypeUid = 600304 - ApiActivity_TYPE_UID_API_ACTIVITY_OTHER ApiActivity_TypeUid = 600399 + DataClassification_CONFIDENTIALITY_ID_UNKNOWN DataClassification_ConfidentialityId = 0 + DataClassification_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL DataClassification_ConfidentialityId = 1 + DataClassification_CONFIDENTIALITY_ID_CONFIDENTIAL DataClassification_ConfidentialityId = 2 + DataClassification_CONFIDENTIALITY_ID_SECRET DataClassification_ConfidentialityId = 3 + DataClassification_CONFIDENTIALITY_ID_TOP_SECRET DataClassification_ConfidentialityId = 4 + DataClassification_CONFIDENTIALITY_ID_PRIVATE DataClassification_ConfidentialityId = 5 + DataClassification_CONFIDENTIALITY_ID_RESTRICTED DataClassification_ConfidentialityId = 6 + DataClassification_CONFIDENTIALITY_ID_OTHER DataClassification_ConfidentialityId = 99 ) -// Enum value maps for ApiActivity_TypeUid. +// Enum value maps for DataClassification_ConfidentialityId. var ( - ApiActivity_TypeUid_name = map[int32]string{ - 0: "TYPE_UID_UNKNOWN", - 600300: "TYPE_UID_API_ACTIVITY_UNKNOWN", - 600301: "TYPE_UID_API_ACTIVITY_CREATE", - 600302: "TYPE_UID_API_ACTIVITY_READ", - 600303: "TYPE_UID_API_ACTIVITY_UPDATE", - 600304: "TYPE_UID_API_ACTIVITY_DELETE", - 600399: "TYPE_UID_API_ACTIVITY_OTHER", - } - ApiActivity_TypeUid_value = map[string]int32{ - "TYPE_UID_UNKNOWN": 0, - "TYPE_UID_API_ACTIVITY_UNKNOWN": 600300, - "TYPE_UID_API_ACTIVITY_CREATE": 600301, - "TYPE_UID_API_ACTIVITY_READ": 600302, - "TYPE_UID_API_ACTIVITY_UPDATE": 600303, - "TYPE_UID_API_ACTIVITY_DELETE": 600304, - "TYPE_UID_API_ACTIVITY_OTHER": 600399, + DataClassification_ConfidentialityId_name = map[int32]string{ + 0: "CONFIDENTIALITY_ID_UNKNOWN", + 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", + 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", + 3: "CONFIDENTIALITY_ID_SECRET", + 4: "CONFIDENTIALITY_ID_TOP_SECRET", + 5: "CONFIDENTIALITY_ID_PRIVATE", + 6: "CONFIDENTIALITY_ID_RESTRICTED", + 99: "CONFIDENTIALITY_ID_OTHER", + } + DataClassification_ConfidentialityId_value = map[string]int32{ + "CONFIDENTIALITY_ID_UNKNOWN": 0, + "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, + "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, + "CONFIDENTIALITY_ID_SECRET": 3, + "CONFIDENTIALITY_ID_TOP_SECRET": 4, + "CONFIDENTIALITY_ID_PRIVATE": 5, + "CONFIDENTIALITY_ID_RESTRICTED": 6, + "CONFIDENTIALITY_ID_OTHER": 99, } ) -func (x ApiActivity_TypeUid) Enum() *ApiActivity_TypeUid { - p := new(ApiActivity_TypeUid) +func (x DataClassification_ConfidentialityId) Enum() *DataClassification_ConfidentialityId { + p := new(DataClassification_ConfidentialityId) *p = x return p } -func (x ApiActivity_TypeUid) String() string { +func (x DataClassification_ConfidentialityId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ApiActivity_TypeUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[9].Descriptor() +func (DataClassification_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[9].Descriptor() } -func (ApiActivity_TypeUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[9] +func (DataClassification_ConfidentialityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[9] } -func (x ApiActivity_TypeUid) Number() protoreflect.EnumNumber { +func (x DataClassification_ConfidentialityId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ApiActivity_TypeUid.Descriptor instead. -func (ApiActivity_TypeUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0, 9} +// Deprecated: Use DataClassification_ConfidentialityId.Descriptor instead. +func (DataClassification_ConfidentialityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{26, 1} } -type EntityManagement_ActionId int32 +type DataClassification_StatusId int32 const ( - EntityManagement_ACTION_ID_UNKNOWN EntityManagement_ActionId = 0 - EntityManagement_ACTION_ID_ALLOWED EntityManagement_ActionId = 1 - EntityManagement_ACTION_ID_DENIED EntityManagement_ActionId = 2 - EntityManagement_ACTION_ID_OBSERVED EntityManagement_ActionId = 3 - EntityManagement_ACTION_ID_MODIFIED EntityManagement_ActionId = 4 - EntityManagement_ACTION_ID_OTHER EntityManagement_ActionId = 99 + DataClassification_STATUS_ID_UNKNOWN DataClassification_StatusId = 0 + DataClassification_STATUS_ID_COMPLETE DataClassification_StatusId = 1 + DataClassification_STATUS_ID_PARTIAL DataClassification_StatusId = 2 + DataClassification_STATUS_ID_FAIL DataClassification_StatusId = 3 + DataClassification_STATUS_ID_OTHER DataClassification_StatusId = 99 ) -// Enum value maps for EntityManagement_ActionId. +// Enum value maps for DataClassification_StatusId. var ( - EntityManagement_ActionId_name = map[int32]string{ - 0: "ACTION_ID_UNKNOWN", - 1: "ACTION_ID_ALLOWED", - 2: "ACTION_ID_DENIED", - 3: "ACTION_ID_OBSERVED", - 4: "ACTION_ID_MODIFIED", - 99: "ACTION_ID_OTHER", - } - EntityManagement_ActionId_value = map[string]int32{ - "ACTION_ID_UNKNOWN": 0, - "ACTION_ID_ALLOWED": 1, - "ACTION_ID_DENIED": 2, - "ACTION_ID_OBSERVED": 3, - "ACTION_ID_MODIFIED": 4, - "ACTION_ID_OTHER": 99, + DataClassification_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_COMPLETE", + 2: "STATUS_ID_PARTIAL", + 3: "STATUS_ID_FAIL", + 99: "STATUS_ID_OTHER", + } + DataClassification_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_COMPLETE": 1, + "STATUS_ID_PARTIAL": 2, + "STATUS_ID_FAIL": 3, + "STATUS_ID_OTHER": 99, } ) -func (x EntityManagement_ActionId) Enum() *EntityManagement_ActionId { - p := new(EntityManagement_ActionId) +func (x DataClassification_StatusId) Enum() *DataClassification_StatusId { + p := new(DataClassification_StatusId) *p = x return p } -func (x EntityManagement_ActionId) String() string { +func (x DataClassification_StatusId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_ActionId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[10].Descriptor() +func (DataClassification_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[10].Descriptor() } -func (EntityManagement_ActionId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[10] +func (DataClassification_StatusId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[10] } -func (x EntityManagement_ActionId) Number() protoreflect.EnumNumber { +func (x DataClassification_StatusId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_ActionId.Descriptor instead. -func (EntityManagement_ActionId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 0} +// Deprecated: Use DataClassification_StatusId.Descriptor instead. +func (DataClassification_StatusId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{26, 2} } -type EntityManagement_ActivityId int32 +type Device_RiskLevelId int32 const ( - EntityManagement_ACTIVITY_ID_UNKNOWN EntityManagement_ActivityId = 0 - EntityManagement_ACTIVITY_ID_CREATE EntityManagement_ActivityId = 1 - EntityManagement_ACTIVITY_ID_READ EntityManagement_ActivityId = 2 - EntityManagement_ACTIVITY_ID_UPDATE EntityManagement_ActivityId = 3 - EntityManagement_ACTIVITY_ID_DELETE EntityManagement_ActivityId = 4 - EntityManagement_ACTIVITY_ID_MOVE EntityManagement_ActivityId = 5 - EntityManagement_ACTIVITY_ID_ENROLL EntityManagement_ActivityId = 6 - EntityManagement_ACTIVITY_ID_UNENROLL EntityManagement_ActivityId = 7 - EntityManagement_ACTIVITY_ID_ENABLE EntityManagement_ActivityId = 8 - EntityManagement_ACTIVITY_ID_DISABLE EntityManagement_ActivityId = 9 - EntityManagement_ACTIVITY_ID_ACTIVATE EntityManagement_ActivityId = 10 - EntityManagement_ACTIVITY_ID_DEACTIVATE EntityManagement_ActivityId = 11 - EntityManagement_ACTIVITY_ID_SUSPEND EntityManagement_ActivityId = 12 - EntityManagement_ACTIVITY_ID_RESUME EntityManagement_ActivityId = 13 - EntityManagement_ACTIVITY_ID_OTHER EntityManagement_ActivityId = 99 + Device_RISK_LEVEL_ID_INFO Device_RiskLevelId = 0 + Device_RISK_LEVEL_ID_LOW Device_RiskLevelId = 1 + Device_RISK_LEVEL_ID_MEDIUM Device_RiskLevelId = 2 + Device_RISK_LEVEL_ID_HIGH Device_RiskLevelId = 3 + Device_RISK_LEVEL_ID_CRITICAL Device_RiskLevelId = 4 + Device_RISK_LEVEL_ID_OTHER Device_RiskLevelId = 99 ) -// Enum value maps for EntityManagement_ActivityId. +// Enum value maps for Device_RiskLevelId. var ( - EntityManagement_ActivityId_name = map[int32]string{ - 0: "ACTIVITY_ID_UNKNOWN", - 1: "ACTIVITY_ID_CREATE", - 2: "ACTIVITY_ID_READ", - 3: "ACTIVITY_ID_UPDATE", - 4: "ACTIVITY_ID_DELETE", - 5: "ACTIVITY_ID_MOVE", - 6: "ACTIVITY_ID_ENROLL", - 7: "ACTIVITY_ID_UNENROLL", - 8: "ACTIVITY_ID_ENABLE", - 9: "ACTIVITY_ID_DISABLE", - 10: "ACTIVITY_ID_ACTIVATE", - 11: "ACTIVITY_ID_DEACTIVATE", - 12: "ACTIVITY_ID_SUSPEND", - 13: "ACTIVITY_ID_RESUME", - 99: "ACTIVITY_ID_OTHER", - } - EntityManagement_ActivityId_value = map[string]int32{ - "ACTIVITY_ID_UNKNOWN": 0, - "ACTIVITY_ID_CREATE": 1, - "ACTIVITY_ID_READ": 2, - "ACTIVITY_ID_UPDATE": 3, - "ACTIVITY_ID_DELETE": 4, - "ACTIVITY_ID_MOVE": 5, - "ACTIVITY_ID_ENROLL": 6, - "ACTIVITY_ID_UNENROLL": 7, - "ACTIVITY_ID_ENABLE": 8, - "ACTIVITY_ID_DISABLE": 9, - "ACTIVITY_ID_ACTIVATE": 10, - "ACTIVITY_ID_DEACTIVATE": 11, - "ACTIVITY_ID_SUSPEND": 12, - "ACTIVITY_ID_RESUME": 13, - "ACTIVITY_ID_OTHER": 99, + Device_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + Device_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, } ) -func (x EntityManagement_ActivityId) Enum() *EntityManagement_ActivityId { - p := new(EntityManagement_ActivityId) +func (x Device_RiskLevelId) Enum() *Device_RiskLevelId { + p := new(Device_RiskLevelId) *p = x return p } -func (x EntityManagement_ActivityId) String() string { +func (x Device_RiskLevelId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_ActivityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[11].Descriptor() +func (Device_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[11].Descriptor() } -func (EntityManagement_ActivityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[11] +func (Device_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[11] } -func (x EntityManagement_ActivityId) Number() protoreflect.EnumNumber { +func (x Device_RiskLevelId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_ActivityId.Descriptor instead. -func (EntityManagement_ActivityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 1} +// Deprecated: Use Device_RiskLevelId.Descriptor instead. +func (Device_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{27, 0} } -type EntityManagement_CategoryUid int32 +type Device_TypeId int32 const ( - EntityManagement_CATEGORY_UID_UNKNOWN EntityManagement_CategoryUid = 0 - EntityManagement_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT EntityManagement_CategoryUid = 3 + Device_TYPE_ID_UNKNOWN Device_TypeId = 0 + Device_TYPE_ID_SERVER Device_TypeId = 1 + Device_TYPE_ID_DESKTOP Device_TypeId = 2 + Device_TYPE_ID_LAPTOP Device_TypeId = 3 + Device_TYPE_ID_TABLET Device_TypeId = 4 + Device_TYPE_ID_MOBILE Device_TypeId = 5 + Device_TYPE_ID_VIRTUAL Device_TypeId = 6 + Device_TYPE_ID_IOT Device_TypeId = 7 + Device_TYPE_ID_BROWSER Device_TypeId = 8 + Device_TYPE_ID_FIREWALL Device_TypeId = 9 + Device_TYPE_ID_SWITCH Device_TypeId = 10 + Device_TYPE_ID_HUB Device_TypeId = 11 + Device_TYPE_ID_ROUTER Device_TypeId = 12 + Device_TYPE_ID_IDS Device_TypeId = 13 + Device_TYPE_ID_IPS Device_TypeId = 14 + Device_TYPE_ID_LOAD_BALANCER Device_TypeId = 15 + Device_TYPE_ID_OTHER Device_TypeId = 99 ) -// Enum value maps for EntityManagement_CategoryUid. +// Enum value maps for Device_TypeId. var ( - EntityManagement_CategoryUid_name = map[int32]string{ - 0: "CATEGORY_UID_UNKNOWN", - 3: "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT", - } - EntityManagement_CategoryUid_value = map[string]int32{ - "CATEGORY_UID_UNKNOWN": 0, - "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT": 3, - } -) - -func (x EntityManagement_CategoryUid) Enum() *EntityManagement_CategoryUid { - p := new(EntityManagement_CategoryUid) - *p = x - return p -} - -func (x EntityManagement_CategoryUid) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (EntityManagement_CategoryUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[12].Descriptor() -} - -func (EntityManagement_CategoryUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[12] -} - -func (x EntityManagement_CategoryUid) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use EntityManagement_CategoryUid.Descriptor instead. -func (EntityManagement_CategoryUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 2} -} - -type EntityManagement_ClassUid int32 - -const ( - EntityManagement_CLASS_UID_UNKNOWN EntityManagement_ClassUid = 0 - EntityManagement_CLASS_UID_ENTITY_MANAGEMENT EntityManagement_ClassUid = 3004 -) - -// Enum value maps for EntityManagement_ClassUid. -var ( - EntityManagement_ClassUid_name = map[int32]string{ - 0: "CLASS_UID_UNKNOWN", - 3004: "CLASS_UID_ENTITY_MANAGEMENT", + Device_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", } - EntityManagement_ClassUid_value = map[string]int32{ - "CLASS_UID_UNKNOWN": 0, - "CLASS_UID_ENTITY_MANAGEMENT": 3004, + Device_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, } ) -func (x EntityManagement_ClassUid) Enum() *EntityManagement_ClassUid { - p := new(EntityManagement_ClassUid) +func (x Device_TypeId) Enum() *Device_TypeId { + p := new(Device_TypeId) *p = x return p } -func (x EntityManagement_ClassUid) String() string { +func (x Device_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_ClassUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[13].Descriptor() +func (Device_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[12].Descriptor() } -func (EntityManagement_ClassUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[13] +func (Device_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[12] } -func (x EntityManagement_ClassUid) Number() protoreflect.EnumNumber { +func (x Device_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_ClassUid.Descriptor instead. -func (EntityManagement_ClassUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 3} +// Deprecated: Use Device_TypeId.Descriptor instead. +func (Device_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{27, 1} } -type EntityManagement_ConfidenceId int32 +type DeviceHwInfo_CpuArchitectureId int32 const ( - EntityManagement_CONFIDENCE_ID_UNKNOWN EntityManagement_ConfidenceId = 0 - EntityManagement_CONFIDENCE_ID_LOW EntityManagement_ConfidenceId = 1 - EntityManagement_CONFIDENCE_ID_MEDIUM EntityManagement_ConfidenceId = 2 - EntityManagement_CONFIDENCE_ID_HIGH EntityManagement_ConfidenceId = 3 - EntityManagement_CONFIDENCE_ID_OTHER EntityManagement_ConfidenceId = 99 + DeviceHwInfo_CPU_ARCHITECTURE_ID_UNKNOWN DeviceHwInfo_CpuArchitectureId = 0 + DeviceHwInfo_CPU_ARCHITECTURE_ID_X86 DeviceHwInfo_CpuArchitectureId = 1 + DeviceHwInfo_CPU_ARCHITECTURE_ID_ARM DeviceHwInfo_CpuArchitectureId = 2 + DeviceHwInfo_CPU_ARCHITECTURE_ID_RISC_V DeviceHwInfo_CpuArchitectureId = 3 + DeviceHwInfo_CPU_ARCHITECTURE_ID_OTHER DeviceHwInfo_CpuArchitectureId = 99 ) -// Enum value maps for EntityManagement_ConfidenceId. +// Enum value maps for DeviceHwInfo_CpuArchitectureId. var ( - EntityManagement_ConfidenceId_name = map[int32]string{ - 0: "CONFIDENCE_ID_UNKNOWN", - 1: "CONFIDENCE_ID_LOW", - 2: "CONFIDENCE_ID_MEDIUM", - 3: "CONFIDENCE_ID_HIGH", - 99: "CONFIDENCE_ID_OTHER", + DeviceHwInfo_CpuArchitectureId_name = map[int32]string{ + 0: "CPU_ARCHITECTURE_ID_UNKNOWN", + 1: "CPU_ARCHITECTURE_ID_X86", + 2: "CPU_ARCHITECTURE_ID_ARM", + 3: "CPU_ARCHITECTURE_ID_RISC_V", + 99: "CPU_ARCHITECTURE_ID_OTHER", } - EntityManagement_ConfidenceId_value = map[string]int32{ - "CONFIDENCE_ID_UNKNOWN": 0, - "CONFIDENCE_ID_LOW": 1, - "CONFIDENCE_ID_MEDIUM": 2, - "CONFIDENCE_ID_HIGH": 3, - "CONFIDENCE_ID_OTHER": 99, + DeviceHwInfo_CpuArchitectureId_value = map[string]int32{ + "CPU_ARCHITECTURE_ID_UNKNOWN": 0, + "CPU_ARCHITECTURE_ID_X86": 1, + "CPU_ARCHITECTURE_ID_ARM": 2, + "CPU_ARCHITECTURE_ID_RISC_V": 3, + "CPU_ARCHITECTURE_ID_OTHER": 99, } ) -func (x EntityManagement_ConfidenceId) Enum() *EntityManagement_ConfidenceId { - p := new(EntityManagement_ConfidenceId) +func (x DeviceHwInfo_CpuArchitectureId) Enum() *DeviceHwInfo_CpuArchitectureId { + p := new(DeviceHwInfo_CpuArchitectureId) *p = x return p } -func (x EntityManagement_ConfidenceId) String() string { +func (x DeviceHwInfo_CpuArchitectureId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[14].Descriptor() +func (DeviceHwInfo_CpuArchitectureId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[13].Descriptor() } -func (EntityManagement_ConfidenceId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[14] +func (DeviceHwInfo_CpuArchitectureId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[13] } -func (x EntityManagement_ConfidenceId) Number() protoreflect.EnumNumber { +func (x DeviceHwInfo_CpuArchitectureId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_ConfidenceId.Descriptor instead. -func (EntityManagement_ConfidenceId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 4} +// Deprecated: Use DeviceHwInfo_CpuArchitectureId.Descriptor instead. +func (DeviceHwInfo_CpuArchitectureId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{28, 0} } -type EntityManagement_DispositionId int32 +type DigitalSignature_AlgorithmId int32 const ( - EntityManagement_DISPOSITION_ID_UNKNOWN EntityManagement_DispositionId = 0 - EntityManagement_DISPOSITION_ID_ALLOWED EntityManagement_DispositionId = 1 - EntityManagement_DISPOSITION_ID_BLOCKED EntityManagement_DispositionId = 2 - EntityManagement_DISPOSITION_ID_QUARANTINED EntityManagement_DispositionId = 3 - EntityManagement_DISPOSITION_ID_ISOLATED EntityManagement_DispositionId = 4 - EntityManagement_DISPOSITION_ID_DELETED EntityManagement_DispositionId = 5 - EntityManagement_DISPOSITION_ID_DROPPED EntityManagement_DispositionId = 6 - EntityManagement_DISPOSITION_ID_CUSTOM_ACTION EntityManagement_DispositionId = 7 - EntityManagement_DISPOSITION_ID_APPROVED EntityManagement_DispositionId = 8 - EntityManagement_DISPOSITION_ID_RESTORED EntityManagement_DispositionId = 9 - EntityManagement_DISPOSITION_ID_EXONERATED EntityManagement_DispositionId = 10 - EntityManagement_DISPOSITION_ID_CORRECTED EntityManagement_DispositionId = 11 - EntityManagement_DISPOSITION_ID_PARTIALLY_CORRECTED EntityManagement_DispositionId = 12 - EntityManagement_DISPOSITION_ID_UNCORRECTED EntityManagement_DispositionId = 13 - EntityManagement_DISPOSITION_ID_DELAYED EntityManagement_DispositionId = 14 - EntityManagement_DISPOSITION_ID_DETECTED EntityManagement_DispositionId = 15 - EntityManagement_DISPOSITION_ID_NO_ACTION EntityManagement_DispositionId = 16 - EntityManagement_DISPOSITION_ID_LOGGED EntityManagement_DispositionId = 17 - EntityManagement_DISPOSITION_ID_TAGGED EntityManagement_DispositionId = 18 - EntityManagement_DISPOSITION_ID_ALERT EntityManagement_DispositionId = 19 - EntityManagement_DISPOSITION_ID_COUNT EntityManagement_DispositionId = 20 - EntityManagement_DISPOSITION_ID_RESET EntityManagement_DispositionId = 21 - EntityManagement_DISPOSITION_ID_CAPTCHA EntityManagement_DispositionId = 22 - EntityManagement_DISPOSITION_ID_CHALLENGE EntityManagement_DispositionId = 23 - EntityManagement_DISPOSITION_ID_ACCESS_REVOKED EntityManagement_DispositionId = 24 - EntityManagement_DISPOSITION_ID_REJECTED EntityManagement_DispositionId = 25 - EntityManagement_DISPOSITION_ID_UNAUTHORIZED EntityManagement_DispositionId = 26 - EntityManagement_DISPOSITION_ID_ERROR EntityManagement_DispositionId = 27 - EntityManagement_DISPOSITION_ID_OTHER EntityManagement_DispositionId = 99 + DigitalSignature_ALGORITHM_ID_UNKNOWN DigitalSignature_AlgorithmId = 0 + DigitalSignature_ALGORITHM_ID_DSA DigitalSignature_AlgorithmId = 1 + DigitalSignature_ALGORITHM_ID_RSA DigitalSignature_AlgorithmId = 2 + DigitalSignature_ALGORITHM_ID_ECDSA DigitalSignature_AlgorithmId = 3 + DigitalSignature_ALGORITHM_ID_AUTHENTICODE DigitalSignature_AlgorithmId = 4 + DigitalSignature_ALGORITHM_ID_OTHER DigitalSignature_AlgorithmId = 99 ) -// Enum value maps for EntityManagement_DispositionId. +// Enum value maps for DigitalSignature_AlgorithmId. var ( - EntityManagement_DispositionId_name = map[int32]string{ - 0: "DISPOSITION_ID_UNKNOWN", - 1: "DISPOSITION_ID_ALLOWED", - 2: "DISPOSITION_ID_BLOCKED", - 3: "DISPOSITION_ID_QUARANTINED", - 4: "DISPOSITION_ID_ISOLATED", - 5: "DISPOSITION_ID_DELETED", - 6: "DISPOSITION_ID_DROPPED", - 7: "DISPOSITION_ID_CUSTOM_ACTION", - 8: "DISPOSITION_ID_APPROVED", - 9: "DISPOSITION_ID_RESTORED", - 10: "DISPOSITION_ID_EXONERATED", - 11: "DISPOSITION_ID_CORRECTED", - 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", - 13: "DISPOSITION_ID_UNCORRECTED", - 14: "DISPOSITION_ID_DELAYED", - 15: "DISPOSITION_ID_DETECTED", - 16: "DISPOSITION_ID_NO_ACTION", - 17: "DISPOSITION_ID_LOGGED", - 18: "DISPOSITION_ID_TAGGED", - 19: "DISPOSITION_ID_ALERT", - 20: "DISPOSITION_ID_COUNT", - 21: "DISPOSITION_ID_RESET", - 22: "DISPOSITION_ID_CAPTCHA", - 23: "DISPOSITION_ID_CHALLENGE", - 24: "DISPOSITION_ID_ACCESS_REVOKED", - 25: "DISPOSITION_ID_REJECTED", - 26: "DISPOSITION_ID_UNAUTHORIZED", - 27: "DISPOSITION_ID_ERROR", - 99: "DISPOSITION_ID_OTHER", - } - EntityManagement_DispositionId_value = map[string]int32{ - "DISPOSITION_ID_UNKNOWN": 0, - "DISPOSITION_ID_ALLOWED": 1, - "DISPOSITION_ID_BLOCKED": 2, - "DISPOSITION_ID_QUARANTINED": 3, - "DISPOSITION_ID_ISOLATED": 4, - "DISPOSITION_ID_DELETED": 5, - "DISPOSITION_ID_DROPPED": 6, - "DISPOSITION_ID_CUSTOM_ACTION": 7, - "DISPOSITION_ID_APPROVED": 8, - "DISPOSITION_ID_RESTORED": 9, - "DISPOSITION_ID_EXONERATED": 10, - "DISPOSITION_ID_CORRECTED": 11, - "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, - "DISPOSITION_ID_UNCORRECTED": 13, - "DISPOSITION_ID_DELAYED": 14, - "DISPOSITION_ID_DETECTED": 15, - "DISPOSITION_ID_NO_ACTION": 16, - "DISPOSITION_ID_LOGGED": 17, - "DISPOSITION_ID_TAGGED": 18, - "DISPOSITION_ID_ALERT": 19, - "DISPOSITION_ID_COUNT": 20, - "DISPOSITION_ID_RESET": 21, - "DISPOSITION_ID_CAPTCHA": 22, - "DISPOSITION_ID_CHALLENGE": 23, - "DISPOSITION_ID_ACCESS_REVOKED": 24, - "DISPOSITION_ID_REJECTED": 25, - "DISPOSITION_ID_UNAUTHORIZED": 26, - "DISPOSITION_ID_ERROR": 27, - "DISPOSITION_ID_OTHER": 99, + DigitalSignature_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_DSA", + 2: "ALGORITHM_ID_RSA", + 3: "ALGORITHM_ID_ECDSA", + 4: "ALGORITHM_ID_AUTHENTICODE", + 99: "ALGORITHM_ID_OTHER", + } + DigitalSignature_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_DSA": 1, + "ALGORITHM_ID_RSA": 2, + "ALGORITHM_ID_ECDSA": 3, + "ALGORITHM_ID_AUTHENTICODE": 4, + "ALGORITHM_ID_OTHER": 99, } ) -func (x EntityManagement_DispositionId) Enum() *EntityManagement_DispositionId { - p := new(EntityManagement_DispositionId) +func (x DigitalSignature_AlgorithmId) Enum() *DigitalSignature_AlgorithmId { + p := new(DigitalSignature_AlgorithmId) *p = x return p } -func (x EntityManagement_DispositionId) String() string { +func (x DigitalSignature_AlgorithmId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_DispositionId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[15].Descriptor() +func (DigitalSignature_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[14].Descriptor() } -func (EntityManagement_DispositionId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[15] +func (DigitalSignature_AlgorithmId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[14] } -func (x EntityManagement_DispositionId) Number() protoreflect.EnumNumber { +func (x DigitalSignature_AlgorithmId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_DispositionId.Descriptor instead. -func (EntityManagement_DispositionId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 5} +// Deprecated: Use DigitalSignature_AlgorithmId.Descriptor instead. +func (DigitalSignature_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{29, 0} } -type EntityManagement_RiskLevelId int32 +type DigitalSignature_StateId int32 const ( - EntityManagement_RISK_LEVEL_ID_INFO EntityManagement_RiskLevelId = 0 - EntityManagement_RISK_LEVEL_ID_LOW EntityManagement_RiskLevelId = 1 - EntityManagement_RISK_LEVEL_ID_MEDIUM EntityManagement_RiskLevelId = 2 - EntityManagement_RISK_LEVEL_ID_HIGH EntityManagement_RiskLevelId = 3 - EntityManagement_RISK_LEVEL_ID_CRITICAL EntityManagement_RiskLevelId = 4 - EntityManagement_RISK_LEVEL_ID_OTHER EntityManagement_RiskLevelId = 99 + DigitalSignature_STATE_ID_UNKNOWN DigitalSignature_StateId = 0 + DigitalSignature_STATE_ID_VALID DigitalSignature_StateId = 1 + DigitalSignature_STATE_ID_EXPIRED DigitalSignature_StateId = 2 + DigitalSignature_STATE_ID_REVOKED DigitalSignature_StateId = 3 + DigitalSignature_STATE_ID_SUSPENDED DigitalSignature_StateId = 4 + DigitalSignature_STATE_ID_PENDING DigitalSignature_StateId = 5 + DigitalSignature_STATE_ID_UNTRUSTED DigitalSignature_StateId = 6 + DigitalSignature_STATE_ID_DISTRUSTED DigitalSignature_StateId = 7 + DigitalSignature_STATE_ID_WRONGUSAGE DigitalSignature_StateId = 8 + DigitalSignature_STATE_ID_BAD DigitalSignature_StateId = 9 + DigitalSignature_STATE_ID_BROKEN DigitalSignature_StateId = 10 + DigitalSignature_STATE_ID_OTHER DigitalSignature_StateId = 99 ) -// Enum value maps for EntityManagement_RiskLevelId. +// Enum value maps for DigitalSignature_StateId. var ( - EntityManagement_RiskLevelId_name = map[int32]string{ - 0: "RISK_LEVEL_ID_INFO", - 1: "RISK_LEVEL_ID_LOW", - 2: "RISK_LEVEL_ID_MEDIUM", - 3: "RISK_LEVEL_ID_HIGH", - 4: "RISK_LEVEL_ID_CRITICAL", - 99: "RISK_LEVEL_ID_OTHER", + DigitalSignature_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_VALID", + 2: "STATE_ID_EXPIRED", + 3: "STATE_ID_REVOKED", + 4: "STATE_ID_SUSPENDED", + 5: "STATE_ID_PENDING", + 6: "STATE_ID_UNTRUSTED", + 7: "STATE_ID_DISTRUSTED", + 8: "STATE_ID_WRONGUSAGE", + 9: "STATE_ID_BAD", + 10: "STATE_ID_BROKEN", + 99: "STATE_ID_OTHER", } - EntityManagement_RiskLevelId_value = map[string]int32{ - "RISK_LEVEL_ID_INFO": 0, - "RISK_LEVEL_ID_LOW": 1, - "RISK_LEVEL_ID_MEDIUM": 2, - "RISK_LEVEL_ID_HIGH": 3, - "RISK_LEVEL_ID_CRITICAL": 4, - "RISK_LEVEL_ID_OTHER": 99, + DigitalSignature_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_VALID": 1, + "STATE_ID_EXPIRED": 2, + "STATE_ID_REVOKED": 3, + "STATE_ID_SUSPENDED": 4, + "STATE_ID_PENDING": 5, + "STATE_ID_UNTRUSTED": 6, + "STATE_ID_DISTRUSTED": 7, + "STATE_ID_WRONGUSAGE": 8, + "STATE_ID_BAD": 9, + "STATE_ID_BROKEN": 10, + "STATE_ID_OTHER": 99, } ) -func (x EntityManagement_RiskLevelId) Enum() *EntityManagement_RiskLevelId { - p := new(EntityManagement_RiskLevelId) +func (x DigitalSignature_StateId) Enum() *DigitalSignature_StateId { + p := new(DigitalSignature_StateId) *p = x return p } -func (x EntityManagement_RiskLevelId) String() string { +func (x DigitalSignature_StateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[16].Descriptor() +func (DigitalSignature_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[15].Descriptor() } -func (EntityManagement_RiskLevelId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[16] +func (DigitalSignature_StateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[15] } -func (x EntityManagement_RiskLevelId) Number() protoreflect.EnumNumber { +func (x DigitalSignature_StateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_RiskLevelId.Descriptor instead. -func (EntityManagement_RiskLevelId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 6} +// Deprecated: Use DigitalSignature_StateId.Descriptor instead. +func (DigitalSignature_StateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{29, 1} } -type EntityManagement_SeverityId int32 +type DnsAnswer_FlagIds int32 const ( - EntityManagement_SEVERITY_ID_UNKNOWN EntityManagement_SeverityId = 0 - EntityManagement_SEVERITY_ID_INFORMATIONAL EntityManagement_SeverityId = 1 - EntityManagement_SEVERITY_ID_LOW EntityManagement_SeverityId = 2 - EntityManagement_SEVERITY_ID_MEDIUM EntityManagement_SeverityId = 3 - EntityManagement_SEVERITY_ID_HIGH EntityManagement_SeverityId = 4 - EntityManagement_SEVERITY_ID_CRITICAL EntityManagement_SeverityId = 5 - EntityManagement_SEVERITY_ID_FATAL EntityManagement_SeverityId = 6 - EntityManagement_SEVERITY_ID_OTHER EntityManagement_SeverityId = 99 + DnsAnswer_FLAG_IDS_UNKNOWN DnsAnswer_FlagIds = 0 + DnsAnswer_FLAG_IDS_AUTHORITATIVE_ANSWER DnsAnswer_FlagIds = 1 + DnsAnswer_FLAG_IDS_TRUNCATED_RESPONSE DnsAnswer_FlagIds = 2 + DnsAnswer_FLAG_IDS_RECURSION_DESIRED DnsAnswer_FlagIds = 3 + DnsAnswer_FLAG_IDS_RECURSION_AVAILABLE DnsAnswer_FlagIds = 4 + DnsAnswer_FLAG_IDS_AUTHENTIC_DATA DnsAnswer_FlagIds = 5 + DnsAnswer_FLAG_IDS_CHECKING_DISABLED DnsAnswer_FlagIds = 6 + DnsAnswer_FLAG_IDS_OTHER DnsAnswer_FlagIds = 99 ) -// Enum value maps for EntityManagement_SeverityId. +// Enum value maps for DnsAnswer_FlagIds. var ( - EntityManagement_SeverityId_name = map[int32]string{ - 0: "SEVERITY_ID_UNKNOWN", - 1: "SEVERITY_ID_INFORMATIONAL", - 2: "SEVERITY_ID_LOW", - 3: "SEVERITY_ID_MEDIUM", - 4: "SEVERITY_ID_HIGH", - 5: "SEVERITY_ID_CRITICAL", - 6: "SEVERITY_ID_FATAL", - 99: "SEVERITY_ID_OTHER", + DnsAnswer_FlagIds_name = map[int32]string{ + 0: "FLAG_IDS_UNKNOWN", + 1: "FLAG_IDS_AUTHORITATIVE_ANSWER", + 2: "FLAG_IDS_TRUNCATED_RESPONSE", + 3: "FLAG_IDS_RECURSION_DESIRED", + 4: "FLAG_IDS_RECURSION_AVAILABLE", + 5: "FLAG_IDS_AUTHENTIC_DATA", + 6: "FLAG_IDS_CHECKING_DISABLED", + 99: "FLAG_IDS_OTHER", } - EntityManagement_SeverityId_value = map[string]int32{ - "SEVERITY_ID_UNKNOWN": 0, - "SEVERITY_ID_INFORMATIONAL": 1, - "SEVERITY_ID_LOW": 2, - "SEVERITY_ID_MEDIUM": 3, - "SEVERITY_ID_HIGH": 4, - "SEVERITY_ID_CRITICAL": 5, - "SEVERITY_ID_FATAL": 6, - "SEVERITY_ID_OTHER": 99, + DnsAnswer_FlagIds_value = map[string]int32{ + "FLAG_IDS_UNKNOWN": 0, + "FLAG_IDS_AUTHORITATIVE_ANSWER": 1, + "FLAG_IDS_TRUNCATED_RESPONSE": 2, + "FLAG_IDS_RECURSION_DESIRED": 3, + "FLAG_IDS_RECURSION_AVAILABLE": 4, + "FLAG_IDS_AUTHENTIC_DATA": 5, + "FLAG_IDS_CHECKING_DISABLED": 6, + "FLAG_IDS_OTHER": 99, } ) -func (x EntityManagement_SeverityId) Enum() *EntityManagement_SeverityId { - p := new(EntityManagement_SeverityId) +func (x DnsAnswer_FlagIds) Enum() *DnsAnswer_FlagIds { + p := new(DnsAnswer_FlagIds) *p = x return p } -func (x EntityManagement_SeverityId) String() string { +func (x DnsAnswer_FlagIds) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_SeverityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[17].Descriptor() +func (DnsAnswer_FlagIds) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[16].Descriptor() } -func (EntityManagement_SeverityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[17] +func (DnsAnswer_FlagIds) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[16] } -func (x EntityManagement_SeverityId) Number() protoreflect.EnumNumber { +func (x DnsAnswer_FlagIds) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_SeverityId.Descriptor instead. -func (EntityManagement_SeverityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 7} +// Deprecated: Use DnsAnswer_FlagIds.Descriptor instead. +func (DnsAnswer_FlagIds) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{32, 0} } -type EntityManagement_StatusId int32 +type DomainContact_TypeId int32 const ( - EntityManagement_STATUS_ID_UNKNOWN EntityManagement_StatusId = 0 - EntityManagement_STATUS_ID_SUCCESS EntityManagement_StatusId = 1 - EntityManagement_STATUS_ID_FAILURE EntityManagement_StatusId = 2 - EntityManagement_STATUS_ID_OTHER EntityManagement_StatusId = 99 + DomainContact_TYPE_ID_UNKNOWN DomainContact_TypeId = 0 + DomainContact_TYPE_ID_REGISTRANT DomainContact_TypeId = 1 + DomainContact_TYPE_ID_ADMINISTRATIVE DomainContact_TypeId = 2 + DomainContact_TYPE_ID_TECHNICAL DomainContact_TypeId = 3 + DomainContact_TYPE_ID_BILLING DomainContact_TypeId = 4 + DomainContact_TYPE_ID_ABUSE DomainContact_TypeId = 5 + DomainContact_TYPE_ID_OTHER DomainContact_TypeId = 99 ) -// Enum value maps for EntityManagement_StatusId. +// Enum value maps for DomainContact_TypeId. var ( - EntityManagement_StatusId_name = map[int32]string{ - 0: "STATUS_ID_UNKNOWN", - 1: "STATUS_ID_SUCCESS", - 2: "STATUS_ID_FAILURE", - 99: "STATUS_ID_OTHER", + DomainContact_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_REGISTRANT", + 2: "TYPE_ID_ADMINISTRATIVE", + 3: "TYPE_ID_TECHNICAL", + 4: "TYPE_ID_BILLING", + 5: "TYPE_ID_ABUSE", + 99: "TYPE_ID_OTHER", } - EntityManagement_StatusId_value = map[string]int32{ - "STATUS_ID_UNKNOWN": 0, - "STATUS_ID_SUCCESS": 1, - "STATUS_ID_FAILURE": 2, - "STATUS_ID_OTHER": 99, + DomainContact_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_REGISTRANT": 1, + "TYPE_ID_ADMINISTRATIVE": 2, + "TYPE_ID_TECHNICAL": 3, + "TYPE_ID_BILLING": 4, + "TYPE_ID_ABUSE": 5, + "TYPE_ID_OTHER": 99, } ) -func (x EntityManagement_StatusId) Enum() *EntityManagement_StatusId { - p := new(EntityManagement_StatusId) +func (x DomainContact_TypeId) Enum() *DomainContact_TypeId { + p := new(DomainContact_TypeId) *p = x return p } -func (x EntityManagement_StatusId) String() string { +func (x DomainContact_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_StatusId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[18].Descriptor() +func (DomainContact_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[17].Descriptor() } -func (EntityManagement_StatusId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[18] +func (DomainContact_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[17] } -func (x EntityManagement_StatusId) Number() protoreflect.EnumNumber { +func (x DomainContact_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_StatusId.Descriptor instead. -func (EntityManagement_StatusId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 8} +// Deprecated: Use DomainContact_TypeId.Descriptor instead. +func (DomainContact_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{33, 0} } -type EntityManagement_TypeUid int32 +type EncryptionDetails_AlgorithmId int32 const ( - EntityManagement_TYPE_UID_UNKNOWN EntityManagement_TypeUid = 0 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN EntityManagement_TypeUid = 300400 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_CREATE EntityManagement_TypeUid = 300401 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_READ EntityManagement_TypeUid = 300402 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UPDATE EntityManagement_TypeUid = 300403 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DELETE EntityManagement_TypeUid = 300404 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_MOVE EntityManagement_TypeUid = 300405 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENROLL EntityManagement_TypeUid = 300406 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_UNENROLL EntityManagement_TypeUid = 300407 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ENABLE EntityManagement_TypeUid = 300408 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DISABLE EntityManagement_TypeUid = 300409 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE EntityManagement_TypeUid = 300410 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE EntityManagement_TypeUid = 300411 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_SUSPEND EntityManagement_TypeUid = 300412 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_RESUME EntityManagement_TypeUid = 300413 - EntityManagement_TYPE_UID_ENTITY_MANAGEMENT_OTHER EntityManagement_TypeUid = 300499 + EncryptionDetails_ALGORITHM_ID_UNKNOWN EncryptionDetails_AlgorithmId = 0 + EncryptionDetails_ALGORITHM_ID_DES EncryptionDetails_AlgorithmId = 1 + EncryptionDetails_ALGORITHM_ID_TRIPLEDES EncryptionDetails_AlgorithmId = 2 + EncryptionDetails_ALGORITHM_ID_AES EncryptionDetails_AlgorithmId = 3 + EncryptionDetails_ALGORITHM_ID_RSA EncryptionDetails_AlgorithmId = 4 + EncryptionDetails_ALGORITHM_ID_ECC EncryptionDetails_AlgorithmId = 5 + EncryptionDetails_ALGORITHM_ID_SM2 EncryptionDetails_AlgorithmId = 6 + EncryptionDetails_ALGORITHM_ID_OTHER EncryptionDetails_AlgorithmId = 99 ) -// Enum value maps for EntityManagement_TypeUid. +// Enum value maps for EncryptionDetails_AlgorithmId. var ( - EntityManagement_TypeUid_name = map[int32]string{ - 0: "TYPE_UID_UNKNOWN", - 300400: "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN", - 300401: "TYPE_UID_ENTITY_MANAGEMENT_CREATE", - 300402: "TYPE_UID_ENTITY_MANAGEMENT_READ", - 300403: "TYPE_UID_ENTITY_MANAGEMENT_UPDATE", - 300404: "TYPE_UID_ENTITY_MANAGEMENT_DELETE", - 300405: "TYPE_UID_ENTITY_MANAGEMENT_MOVE", - 300406: "TYPE_UID_ENTITY_MANAGEMENT_ENROLL", - 300407: "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL", - 300408: "TYPE_UID_ENTITY_MANAGEMENT_ENABLE", - 300409: "TYPE_UID_ENTITY_MANAGEMENT_DISABLE", - 300410: "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE", - 300411: "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE", - 300412: "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND", - 300413: "TYPE_UID_ENTITY_MANAGEMENT_RESUME", - 300499: "TYPE_UID_ENTITY_MANAGEMENT_OTHER", - } - EntityManagement_TypeUid_value = map[string]int32{ - "TYPE_UID_UNKNOWN": 0, - "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN": 300400, - "TYPE_UID_ENTITY_MANAGEMENT_CREATE": 300401, - "TYPE_UID_ENTITY_MANAGEMENT_READ": 300402, - "TYPE_UID_ENTITY_MANAGEMENT_UPDATE": 300403, - "TYPE_UID_ENTITY_MANAGEMENT_DELETE": 300404, - "TYPE_UID_ENTITY_MANAGEMENT_MOVE": 300405, - "TYPE_UID_ENTITY_MANAGEMENT_ENROLL": 300406, - "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL": 300407, - "TYPE_UID_ENTITY_MANAGEMENT_ENABLE": 300408, - "TYPE_UID_ENTITY_MANAGEMENT_DISABLE": 300409, - "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE": 300410, - "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE": 300411, - "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND": 300412, - "TYPE_UID_ENTITY_MANAGEMENT_RESUME": 300413, - "TYPE_UID_ENTITY_MANAGEMENT_OTHER": 300499, + EncryptionDetails_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_DES", + 2: "ALGORITHM_ID_TRIPLEDES", + 3: "ALGORITHM_ID_AES", + 4: "ALGORITHM_ID_RSA", + 5: "ALGORITHM_ID_ECC", + 6: "ALGORITHM_ID_SM2", + 99: "ALGORITHM_ID_OTHER", + } + EncryptionDetails_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_DES": 1, + "ALGORITHM_ID_TRIPLEDES": 2, + "ALGORITHM_ID_AES": 3, + "ALGORITHM_ID_RSA": 4, + "ALGORITHM_ID_ECC": 5, + "ALGORITHM_ID_SM2": 6, + "ALGORITHM_ID_OTHER": 99, } ) -func (x EntityManagement_TypeUid) Enum() *EntityManagement_TypeUid { - p := new(EntityManagement_TypeUid) +func (x EncryptionDetails_AlgorithmId) Enum() *EncryptionDetails_AlgorithmId { + p := new(EncryptionDetails_AlgorithmId) *p = x return p } -func (x EntityManagement_TypeUid) String() string { +func (x EncryptionDetails_AlgorithmId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EntityManagement_TypeUid) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[19].Descriptor() +func (EncryptionDetails_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[18].Descriptor() } -func (EntityManagement_TypeUid) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[19] +func (EncryptionDetails_AlgorithmId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[18] } -func (x EntityManagement_TypeUid) Number() protoreflect.EnumNumber { +func (x EncryptionDetails_AlgorithmId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EntityManagement_TypeUid.Descriptor instead. -func (EntityManagement_TypeUid) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1, 9} +// Deprecated: Use EncryptionDetails_AlgorithmId.Descriptor instead. +func (EncryptionDetails_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{37, 0} } -type Account_TypeId int32 +type File_ConfidentialityId int32 const ( - Account_TYPE_ID_UNKNOWN Account_TypeId = 0 - Account_TYPE_ID_LDAP_ACCOUNT Account_TypeId = 1 - Account_TYPE_ID_WINDOWS_ACCOUNT Account_TypeId = 2 - Account_TYPE_ID_AWS_IAM_USER Account_TypeId = 3 - Account_TYPE_ID_AWS_IAM_ROLE Account_TypeId = 4 - Account_TYPE_ID_GCP_ACCOUNT Account_TypeId = 5 - Account_TYPE_ID_AZURE_AD_ACCOUNT Account_TypeId = 6 - Account_TYPE_ID_MAC_OS_ACCOUNT Account_TypeId = 7 - Account_TYPE_ID_APPLE_ACCOUNT Account_TypeId = 8 - Account_TYPE_ID_LINUX_ACCOUNT Account_TypeId = 9 - Account_TYPE_ID_AWS_ACCOUNT Account_TypeId = 10 - Account_TYPE_ID_GCP_PROJECT Account_TypeId = 11 - Account_TYPE_ID_OCI_COMPARTMENT Account_TypeId = 12 - Account_TYPE_ID_AZURE_SUBSCRIPTION Account_TypeId = 13 - Account_TYPE_ID_SALESFORCE_ACCOUNT Account_TypeId = 14 - Account_TYPE_ID_GOOGLE_WORKSPACE Account_TypeId = 15 - Account_TYPE_ID_SERVICENOW_INSTANCE Account_TypeId = 16 - Account_TYPE_ID_M365_TENANT Account_TypeId = 17 - Account_TYPE_ID_EMAIL_ACCOUNT Account_TypeId = 18 - Account_TYPE_ID_ACTIVEDIRECTORY_ACCOUNT Account_TypeId = 19 - Account_TYPE_ID_OTHER Account_TypeId = 99 + File_CONFIDENTIALITY_ID_UNKNOWN File_ConfidentialityId = 0 + File_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL File_ConfidentialityId = 1 + File_CONFIDENTIALITY_ID_CONFIDENTIAL File_ConfidentialityId = 2 + File_CONFIDENTIALITY_ID_SECRET File_ConfidentialityId = 3 + File_CONFIDENTIALITY_ID_TOP_SECRET File_ConfidentialityId = 4 + File_CONFIDENTIALITY_ID_PRIVATE File_ConfidentialityId = 5 + File_CONFIDENTIALITY_ID_RESTRICTED File_ConfidentialityId = 6 + File_CONFIDENTIALITY_ID_OTHER File_ConfidentialityId = 99 ) -// Enum value maps for Account_TypeId. +// Enum value maps for File_ConfidentialityId. var ( - Account_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_LDAP_ACCOUNT", - 2: "TYPE_ID_WINDOWS_ACCOUNT", - 3: "TYPE_ID_AWS_IAM_USER", - 4: "TYPE_ID_AWS_IAM_ROLE", - 5: "TYPE_ID_GCP_ACCOUNT", - 6: "TYPE_ID_AZURE_AD_ACCOUNT", - 7: "TYPE_ID_MAC_OS_ACCOUNT", - 8: "TYPE_ID_APPLE_ACCOUNT", - 9: "TYPE_ID_LINUX_ACCOUNT", - 10: "TYPE_ID_AWS_ACCOUNT", - 11: "TYPE_ID_GCP_PROJECT", - 12: "TYPE_ID_OCI_COMPARTMENT", - 13: "TYPE_ID_AZURE_SUBSCRIPTION", - 14: "TYPE_ID_SALESFORCE_ACCOUNT", - 15: "TYPE_ID_GOOGLE_WORKSPACE", - 16: "TYPE_ID_SERVICENOW_INSTANCE", - 17: "TYPE_ID_M365_TENANT", - 18: "TYPE_ID_EMAIL_ACCOUNT", - 19: "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT", - 99: "TYPE_ID_OTHER", + File_ConfidentialityId_name = map[int32]string{ + 0: "CONFIDENTIALITY_ID_UNKNOWN", + 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", + 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", + 3: "CONFIDENTIALITY_ID_SECRET", + 4: "CONFIDENTIALITY_ID_TOP_SECRET", + 5: "CONFIDENTIALITY_ID_PRIVATE", + 6: "CONFIDENTIALITY_ID_RESTRICTED", + 99: "CONFIDENTIALITY_ID_OTHER", } - Account_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_LDAP_ACCOUNT": 1, - "TYPE_ID_WINDOWS_ACCOUNT": 2, - "TYPE_ID_AWS_IAM_USER": 3, - "TYPE_ID_AWS_IAM_ROLE": 4, - "TYPE_ID_GCP_ACCOUNT": 5, - "TYPE_ID_AZURE_AD_ACCOUNT": 6, - "TYPE_ID_MAC_OS_ACCOUNT": 7, - "TYPE_ID_APPLE_ACCOUNT": 8, - "TYPE_ID_LINUX_ACCOUNT": 9, - "TYPE_ID_AWS_ACCOUNT": 10, - "TYPE_ID_GCP_PROJECT": 11, - "TYPE_ID_OCI_COMPARTMENT": 12, - "TYPE_ID_AZURE_SUBSCRIPTION": 13, - "TYPE_ID_SALESFORCE_ACCOUNT": 14, - "TYPE_ID_GOOGLE_WORKSPACE": 15, - "TYPE_ID_SERVICENOW_INSTANCE": 16, - "TYPE_ID_M365_TENANT": 17, - "TYPE_ID_EMAIL_ACCOUNT": 18, - "TYPE_ID_ACTIVEDIRECTORY_ACCOUNT": 19, - "TYPE_ID_OTHER": 99, + File_ConfidentialityId_value = map[string]int32{ + "CONFIDENTIALITY_ID_UNKNOWN": 0, + "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, + "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, + "CONFIDENTIALITY_ID_SECRET": 3, + "CONFIDENTIALITY_ID_TOP_SECRET": 4, + "CONFIDENTIALITY_ID_PRIVATE": 5, + "CONFIDENTIALITY_ID_RESTRICTED": 6, + "CONFIDENTIALITY_ID_OTHER": 99, } ) -func (x Account_TypeId) Enum() *Account_TypeId { - p := new(Account_TypeId) +func (x File_ConfidentialityId) Enum() *File_ConfidentialityId { + p := new(File_ConfidentialityId) *p = x return p } -func (x Account_TypeId) String() string { +func (x File_ConfidentialityId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Account_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[20].Descriptor() +func (File_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[19].Descriptor() } -func (Account_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[20] +func (File_ConfidentialityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[19] } -func (x Account_TypeId) Number() protoreflect.EnumNumber { +func (x File_ConfidentialityId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Account_TypeId.Descriptor instead. -func (Account_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{2, 0} +// Deprecated: Use File_ConfidentialityId.Descriptor instead. +func (File_ConfidentialityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{43, 0} } -type Advisory_InstallStateId int32 +type File_DriveTypeId int32 const ( - Advisory_INSTALL_STATE_ID_UNKNOWN Advisory_InstallStateId = 0 - Advisory_INSTALL_STATE_ID_INSTALLED Advisory_InstallStateId = 1 - Advisory_INSTALL_STATE_ID_NOT_INSTALLED Advisory_InstallStateId = 2 - Advisory_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT Advisory_InstallStateId = 3 - Advisory_INSTALL_STATE_ID_OTHER Advisory_InstallStateId = 99 + File_DRIVE_TYPE_ID_UNKNOWN File_DriveTypeId = 0 + File_DRIVE_TYPE_ID_REMOVABLE File_DriveTypeId = 1 + File_DRIVE_TYPE_ID_FIXED File_DriveTypeId = 2 + File_DRIVE_TYPE_ID_REMOTE File_DriveTypeId = 3 + File_DRIVE_TYPE_ID_CD_ROM File_DriveTypeId = 4 + File_DRIVE_TYPE_ID_RAM_DISK File_DriveTypeId = 5 + File_DRIVE_TYPE_ID_OTHER File_DriveTypeId = 99 ) -// Enum value maps for Advisory_InstallStateId. +// Enum value maps for File_DriveTypeId. var ( - Advisory_InstallStateId_name = map[int32]string{ - 0: "INSTALL_STATE_ID_UNKNOWN", - 1: "INSTALL_STATE_ID_INSTALLED", - 2: "INSTALL_STATE_ID_NOT_INSTALLED", - 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", - 99: "INSTALL_STATE_ID_OTHER", + File_DriveTypeId_name = map[int32]string{ + 0: "DRIVE_TYPE_ID_UNKNOWN", + 1: "DRIVE_TYPE_ID_REMOVABLE", + 2: "DRIVE_TYPE_ID_FIXED", + 3: "DRIVE_TYPE_ID_REMOTE", + 4: "DRIVE_TYPE_ID_CD_ROM", + 5: "DRIVE_TYPE_ID_RAM_DISK", + 99: "DRIVE_TYPE_ID_OTHER", } - Advisory_InstallStateId_value = map[string]int32{ - "INSTALL_STATE_ID_UNKNOWN": 0, - "INSTALL_STATE_ID_INSTALLED": 1, - "INSTALL_STATE_ID_NOT_INSTALLED": 2, - "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, - "INSTALL_STATE_ID_OTHER": 99, + File_DriveTypeId_value = map[string]int32{ + "DRIVE_TYPE_ID_UNKNOWN": 0, + "DRIVE_TYPE_ID_REMOVABLE": 1, + "DRIVE_TYPE_ID_FIXED": 2, + "DRIVE_TYPE_ID_REMOTE": 3, + "DRIVE_TYPE_ID_CD_ROM": 4, + "DRIVE_TYPE_ID_RAM_DISK": 5, + "DRIVE_TYPE_ID_OTHER": 99, } ) -func (x Advisory_InstallStateId) Enum() *Advisory_InstallStateId { - p := new(Advisory_InstallStateId) +func (x File_DriveTypeId) Enum() *File_DriveTypeId { + p := new(File_DriveTypeId) *p = x return p } -func (x Advisory_InstallStateId) String() string { +func (x File_DriveTypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Advisory_InstallStateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[21].Descriptor() +func (File_DriveTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[20].Descriptor() } -func (Advisory_InstallStateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[21] +func (File_DriveTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[20] } -func (x Advisory_InstallStateId) Number() protoreflect.EnumNumber { +func (x File_DriveTypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Advisory_InstallStateId.Descriptor instead. -func (Advisory_InstallStateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{4, 0} +// Deprecated: Use File_DriveTypeId.Descriptor instead. +func (File_DriveTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{43, 1} } -type AffectedPackage_TypeId int32 +type File_TypeId int32 const ( - AffectedPackage_TYPE_ID_UNKNOWN AffectedPackage_TypeId = 0 - AffectedPackage_TYPE_ID_APPLICATION AffectedPackage_TypeId = 1 - AffectedPackage_TYPE_ID_OPERATING_SYSTEM AffectedPackage_TypeId = 2 - AffectedPackage_TYPE_ID_OTHER AffectedPackage_TypeId = 99 + File_TYPE_ID_UNKNOWN File_TypeId = 0 + File_TYPE_ID_REGULAR_FILE File_TypeId = 1 + File_TYPE_ID_FOLDER File_TypeId = 2 + File_TYPE_ID_CHARACTER_DEVICE File_TypeId = 3 + File_TYPE_ID_BLOCK_DEVICE File_TypeId = 4 + File_TYPE_ID_LOCAL_SOCKET File_TypeId = 5 + File_TYPE_ID_NAMED_PIPE File_TypeId = 6 + File_TYPE_ID_SYMBOLIC_LINK File_TypeId = 7 + File_TYPE_ID_EXECUTABLE_FILE File_TypeId = 8 + File_TYPE_ID_OTHER File_TypeId = 99 ) -// Enum value maps for AffectedPackage_TypeId. +// Enum value maps for File_TypeId. var ( - AffectedPackage_TypeId_name = map[int32]string{ + File_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_APPLICATION", - 2: "TYPE_ID_OPERATING_SYSTEM", + 1: "TYPE_ID_REGULAR_FILE", + 2: "TYPE_ID_FOLDER", + 3: "TYPE_ID_CHARACTER_DEVICE", + 4: "TYPE_ID_BLOCK_DEVICE", + 5: "TYPE_ID_LOCAL_SOCKET", + 6: "TYPE_ID_NAMED_PIPE", + 7: "TYPE_ID_SYMBOLIC_LINK", + 8: "TYPE_ID_EXECUTABLE_FILE", 99: "TYPE_ID_OTHER", } - AffectedPackage_TypeId_value = map[string]int32{ + File_TypeId_value = map[string]int32{ "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_APPLICATION": 1, - "TYPE_ID_OPERATING_SYSTEM": 2, + "TYPE_ID_REGULAR_FILE": 1, + "TYPE_ID_FOLDER": 2, + "TYPE_ID_CHARACTER_DEVICE": 3, + "TYPE_ID_BLOCK_DEVICE": 4, + "TYPE_ID_LOCAL_SOCKET": 5, + "TYPE_ID_NAMED_PIPE": 6, + "TYPE_ID_SYMBOLIC_LINK": 7, + "TYPE_ID_EXECUTABLE_FILE": 8, "TYPE_ID_OTHER": 99, } ) -func (x AffectedPackage_TypeId) Enum() *AffectedPackage_TypeId { - p := new(AffectedPackage_TypeId) +func (x File_TypeId) Enum() *File_TypeId { + p := new(File_TypeId) *p = x return p } -func (x AffectedPackage_TypeId) String() string { +func (x File_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (AffectedPackage_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[22].Descriptor() +func (File_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[21].Descriptor() } -func (AffectedPackage_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[22] +func (File_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[21] } -func (x AffectedPackage_TypeId) Number() protoreflect.EnumNumber { +func (x File_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use AffectedPackage_TypeId.Descriptor instead. -func (AffectedPackage_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{6, 0} +// Deprecated: Use File_TypeId.Descriptor instead. +func (File_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{43, 2} } -type Agent_TypeId int32 +type Fingerprint_AlgorithmId int32 const ( - Agent_TYPE_ID_UNKNOWN Agent_TypeId = 0 - Agent_TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE Agent_TypeId = 1 - Agent_TYPE_ID_DATA_LOSS_PREVENTION Agent_TypeId = 2 - Agent_TYPE_ID_BACKUP_RECOVERY Agent_TypeId = 3 - Agent_TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY Agent_TypeId = 4 - Agent_TYPE_ID_VULNERABILITY_MANAGEMENT Agent_TypeId = 5 - Agent_TYPE_ID_LOG_FORWARDING Agent_TypeId = 6 - Agent_TYPE_ID_MOBILE_DEVICE_MANAGEMENT Agent_TypeId = 7 - Agent_TYPE_ID_CONFIGURATION_MANAGEMENT Agent_TypeId = 8 - Agent_TYPE_ID_REMOTE_ACCESS Agent_TypeId = 9 - Agent_TYPE_ID_OTHER Agent_TypeId = 99 + Fingerprint_ALGORITHM_ID_UNKNOWN Fingerprint_AlgorithmId = 0 + Fingerprint_ALGORITHM_ID_MD5 Fingerprint_AlgorithmId = 1 + Fingerprint_ALGORITHM_ID_SHA_1 Fingerprint_AlgorithmId = 2 + Fingerprint_ALGORITHM_ID_SHA_256 Fingerprint_AlgorithmId = 3 + Fingerprint_ALGORITHM_ID_SHA_512 Fingerprint_AlgorithmId = 4 + Fingerprint_ALGORITHM_ID_CTPH Fingerprint_AlgorithmId = 5 + Fingerprint_ALGORITHM_ID_TLSH Fingerprint_AlgorithmId = 6 + Fingerprint_ALGORITHM_ID_QUICKXORHASH Fingerprint_AlgorithmId = 7 + Fingerprint_ALGORITHM_ID_SHA_224 Fingerprint_AlgorithmId = 8 + Fingerprint_ALGORITHM_ID_SHA_384 Fingerprint_AlgorithmId = 9 + Fingerprint_ALGORITHM_ID_SHA_512_224 Fingerprint_AlgorithmId = 10 + Fingerprint_ALGORITHM_ID_SHA_512_256 Fingerprint_AlgorithmId = 11 + Fingerprint_ALGORITHM_ID_SHA3_224 Fingerprint_AlgorithmId = 12 + Fingerprint_ALGORITHM_ID_SHA3_256 Fingerprint_AlgorithmId = 13 + Fingerprint_ALGORITHM_ID_SHA3_384 Fingerprint_AlgorithmId = 14 + Fingerprint_ALGORITHM_ID_SHA3_512 Fingerprint_AlgorithmId = 15 + Fingerprint_ALGORITHM_ID_XXHASH_H3_64_BIT Fingerprint_AlgorithmId = 16 + Fingerprint_ALGORITHM_ID_XXHASH_H3_128_BIT Fingerprint_AlgorithmId = 17 + Fingerprint_ALGORITHM_ID_IMPHASH Fingerprint_AlgorithmId = 18 + Fingerprint_ALGORITHM_ID_NPF Fingerprint_AlgorithmId = 19 + Fingerprint_ALGORITHM_ID_HASSH Fingerprint_AlgorithmId = 20 + Fingerprint_ALGORITHM_ID_OTHER Fingerprint_AlgorithmId = 99 ) -// Enum value maps for Agent_TypeId. +// Enum value maps for Fingerprint_AlgorithmId. var ( - Agent_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE", - 2: "TYPE_ID_DATA_LOSS_PREVENTION", - 3: "TYPE_ID_BACKUP_RECOVERY", - 4: "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY", - 5: "TYPE_ID_VULNERABILITY_MANAGEMENT", - 6: "TYPE_ID_LOG_FORWARDING", - 7: "TYPE_ID_MOBILE_DEVICE_MANAGEMENT", - 8: "TYPE_ID_CONFIGURATION_MANAGEMENT", - 9: "TYPE_ID_REMOTE_ACCESS", - 99: "TYPE_ID_OTHER", + Fingerprint_AlgorithmId_name = map[int32]string{ + 0: "ALGORITHM_ID_UNKNOWN", + 1: "ALGORITHM_ID_MD5", + 2: "ALGORITHM_ID_SHA_1", + 3: "ALGORITHM_ID_SHA_256", + 4: "ALGORITHM_ID_SHA_512", + 5: "ALGORITHM_ID_CTPH", + 6: "ALGORITHM_ID_TLSH", + 7: "ALGORITHM_ID_QUICKXORHASH", + 8: "ALGORITHM_ID_SHA_224", + 9: "ALGORITHM_ID_SHA_384", + 10: "ALGORITHM_ID_SHA_512_224", + 11: "ALGORITHM_ID_SHA_512_256", + 12: "ALGORITHM_ID_SHA3_224", + 13: "ALGORITHM_ID_SHA3_256", + 14: "ALGORITHM_ID_SHA3_384", + 15: "ALGORITHM_ID_SHA3_512", + 16: "ALGORITHM_ID_XXHASH_H3_64_BIT", + 17: "ALGORITHM_ID_XXHASH_H3_128_BIT", + 18: "ALGORITHM_ID_IMPHASH", + 19: "ALGORITHM_ID_NPF", + 20: "ALGORITHM_ID_HASSH", + 99: "ALGORITHM_ID_OTHER", } - Agent_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE": 1, - "TYPE_ID_DATA_LOSS_PREVENTION": 2, - "TYPE_ID_BACKUP_RECOVERY": 3, - "TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY": 4, - "TYPE_ID_VULNERABILITY_MANAGEMENT": 5, - "TYPE_ID_LOG_FORWARDING": 6, - "TYPE_ID_MOBILE_DEVICE_MANAGEMENT": 7, - "TYPE_ID_CONFIGURATION_MANAGEMENT": 8, - "TYPE_ID_REMOTE_ACCESS": 9, - "TYPE_ID_OTHER": 99, + Fingerprint_AlgorithmId_value = map[string]int32{ + "ALGORITHM_ID_UNKNOWN": 0, + "ALGORITHM_ID_MD5": 1, + "ALGORITHM_ID_SHA_1": 2, + "ALGORITHM_ID_SHA_256": 3, + "ALGORITHM_ID_SHA_512": 4, + "ALGORITHM_ID_CTPH": 5, + "ALGORITHM_ID_TLSH": 6, + "ALGORITHM_ID_QUICKXORHASH": 7, + "ALGORITHM_ID_SHA_224": 8, + "ALGORITHM_ID_SHA_384": 9, + "ALGORITHM_ID_SHA_512_224": 10, + "ALGORITHM_ID_SHA_512_256": 11, + "ALGORITHM_ID_SHA3_224": 12, + "ALGORITHM_ID_SHA3_256": 13, + "ALGORITHM_ID_SHA3_384": 14, + "ALGORITHM_ID_SHA3_512": 15, + "ALGORITHM_ID_XXHASH_H3_64_BIT": 16, + "ALGORITHM_ID_XXHASH_H3_128_BIT": 17, + "ALGORITHM_ID_IMPHASH": 18, + "ALGORITHM_ID_NPF": 19, + "ALGORITHM_ID_HASSH": 20, + "ALGORITHM_ID_OTHER": 99, } ) -func (x Agent_TypeId) Enum() *Agent_TypeId { - p := new(Agent_TypeId) +func (x Fingerprint_AlgorithmId) Enum() *Fingerprint_AlgorithmId { + p := new(Fingerprint_AlgorithmId) *p = x return p } -func (x Agent_TypeId) String() string { +func (x Fingerprint_AlgorithmId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Agent_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[23].Descriptor() +func (Fingerprint_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[22].Descriptor() } -func (Agent_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[23] +func (Fingerprint_AlgorithmId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[22] } -func (x Agent_TypeId) Number() protoreflect.EnumNumber { +func (x Fingerprint_AlgorithmId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Agent_TypeId.Descriptor instead. -func (Agent_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{7, 0} +// Deprecated: Use Fingerprint_AlgorithmId.Descriptor instead. +func (Fingerprint_AlgorithmId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{44, 0} } -type Analytic_StateId int32 +type GpuInfo_BusTypeId int32 const ( - Analytic_STATE_ID_UNKNOWN Analytic_StateId = 0 - Analytic_STATE_ID_ACTIVE Analytic_StateId = 1 - Analytic_STATE_ID_SUPPRESSED Analytic_StateId = 2 - Analytic_STATE_ID_EXPERIMENTAL Analytic_StateId = 3 - Analytic_STATE_ID_OTHER Analytic_StateId = 99 + GpuInfo_BUS_TYPE_ID_UNKNOWN GpuInfo_BusTypeId = 0 + GpuInfo_BUS_TYPE_ID_ONBOARD GpuInfo_BusTypeId = 1 + GpuInfo_BUS_TYPE_ID_PCIE_X16 GpuInfo_BusTypeId = 2 + GpuInfo_BUS_TYPE_ID_PCIE_X8 GpuInfo_BusTypeId = 3 + GpuInfo_BUS_TYPE_ID_MXM_TYPE_A GpuInfo_BusTypeId = 4 + GpuInfo_BUS_TYPE_ID_MXM_TYPE_B GpuInfo_BusTypeId = 5 + GpuInfo_BUS_TYPE_ID_M_2 GpuInfo_BusTypeId = 6 + GpuInfo_BUS_TYPE_ID_CXL GpuInfo_BusTypeId = 7 + GpuInfo_BUS_TYPE_ID_OTHER GpuInfo_BusTypeId = 99 ) -// Enum value maps for Analytic_StateId. +// Enum value maps for GpuInfo_BusTypeId. var ( - Analytic_StateId_name = map[int32]string{ - 0: "STATE_ID_UNKNOWN", - 1: "STATE_ID_ACTIVE", - 2: "STATE_ID_SUPPRESSED", - 3: "STATE_ID_EXPERIMENTAL", - 99: "STATE_ID_OTHER", + GpuInfo_BusTypeId_name = map[int32]string{ + 0: "BUS_TYPE_ID_UNKNOWN", + 1: "BUS_TYPE_ID_ONBOARD", + 2: "BUS_TYPE_ID_PCIE_X16", + 3: "BUS_TYPE_ID_PCIE_X8", + 4: "BUS_TYPE_ID_MXM_TYPE_A", + 5: "BUS_TYPE_ID_MXM_TYPE_B", + 6: "BUS_TYPE_ID_M_2", + 7: "BUS_TYPE_ID_CXL", + 99: "BUS_TYPE_ID_OTHER", } - Analytic_StateId_value = map[string]int32{ - "STATE_ID_UNKNOWN": 0, - "STATE_ID_ACTIVE": 1, - "STATE_ID_SUPPRESSED": 2, - "STATE_ID_EXPERIMENTAL": 3, - "STATE_ID_OTHER": 99, + GpuInfo_BusTypeId_value = map[string]int32{ + "BUS_TYPE_ID_UNKNOWN": 0, + "BUS_TYPE_ID_ONBOARD": 1, + "BUS_TYPE_ID_PCIE_X16": 2, + "BUS_TYPE_ID_PCIE_X8": 3, + "BUS_TYPE_ID_MXM_TYPE_A": 4, + "BUS_TYPE_ID_MXM_TYPE_B": 5, + "BUS_TYPE_ID_M_2": 6, + "BUS_TYPE_ID_CXL": 7, + "BUS_TYPE_ID_OTHER": 99, } ) -func (x Analytic_StateId) Enum() *Analytic_StateId { - p := new(Analytic_StateId) +func (x GpuInfo_BusTypeId) Enum() *GpuInfo_BusTypeId { + p := new(GpuInfo_BusTypeId) *p = x return p } -func (x Analytic_StateId) String() string { +func (x GpuInfo_BusTypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Analytic_StateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[24].Descriptor() +func (GpuInfo_BusTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[23].Descriptor() } -func (Analytic_StateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[24] +func (GpuInfo_BusTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[23] } -func (x Analytic_StateId) Number() protoreflect.EnumNumber { +func (x GpuInfo_BusTypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Analytic_StateId.Descriptor instead. -func (Analytic_StateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{9, 0} +// Deprecated: Use GpuInfo_BusTypeId.Descriptor instead. +func (GpuInfo_BusTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{46, 0} } -type Analytic_TypeId int32 +type GpuInfo_VramModeId int32 const ( - Analytic_TYPE_ID_UNKNOWN Analytic_TypeId = 0 - Analytic_TYPE_ID_RULE Analytic_TypeId = 1 - Analytic_TYPE_ID_BEHAVIORAL Analytic_TypeId = 2 - Analytic_TYPE_ID_STATISTICAL Analytic_TypeId = 3 - Analytic_TYPE_ID_LEARNING_ML_DL Analytic_TypeId = 4 - Analytic_TYPE_ID_FINGERPRINTING Analytic_TypeId = 5 - Analytic_TYPE_ID_TAGGING Analytic_TypeId = 6 - Analytic_TYPE_ID_KEYWORD_MATCH Analytic_TypeId = 7 - Analytic_TYPE_ID_REGULAR_EXPRESSIONS Analytic_TypeId = 8 - Analytic_TYPE_ID_EXACT_DATA_MATCH Analytic_TypeId = 9 - Analytic_TYPE_ID_PARTIAL_DATA_MATCH Analytic_TypeId = 10 - Analytic_TYPE_ID_INDEXED_DATA_MATCH Analytic_TypeId = 11 - Analytic_TYPE_ID_OTHER Analytic_TypeId = 99 + GpuInfo_VRAM_MODE_ID_UNKNOWN GpuInfo_VramModeId = 0 + GpuInfo_VRAM_MODE_ID_SHARED GpuInfo_VramModeId = 1 + GpuInfo_VRAM_MODE_ID_DEDICATED GpuInfo_VramModeId = 2 + GpuInfo_VRAM_MODE_ID_OTHER GpuInfo_VramModeId = 99 ) -// Enum value maps for Analytic_TypeId. +// Enum value maps for GpuInfo_VramModeId. var ( - Analytic_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_RULE", - 2: "TYPE_ID_BEHAVIORAL", - 3: "TYPE_ID_STATISTICAL", - 4: "TYPE_ID_LEARNING_ML_DL", - 5: "TYPE_ID_FINGERPRINTING", - 6: "TYPE_ID_TAGGING", - 7: "TYPE_ID_KEYWORD_MATCH", - 8: "TYPE_ID_REGULAR_EXPRESSIONS", - 9: "TYPE_ID_EXACT_DATA_MATCH", - 10: "TYPE_ID_PARTIAL_DATA_MATCH", - 11: "TYPE_ID_INDEXED_DATA_MATCH", - 99: "TYPE_ID_OTHER", + GpuInfo_VramModeId_name = map[int32]string{ + 0: "VRAM_MODE_ID_UNKNOWN", + 1: "VRAM_MODE_ID_SHARED", + 2: "VRAM_MODE_ID_DEDICATED", + 99: "VRAM_MODE_ID_OTHER", } - Analytic_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_RULE": 1, - "TYPE_ID_BEHAVIORAL": 2, - "TYPE_ID_STATISTICAL": 3, - "TYPE_ID_LEARNING_ML_DL": 4, - "TYPE_ID_FINGERPRINTING": 5, - "TYPE_ID_TAGGING": 6, - "TYPE_ID_KEYWORD_MATCH": 7, - "TYPE_ID_REGULAR_EXPRESSIONS": 8, - "TYPE_ID_EXACT_DATA_MATCH": 9, - "TYPE_ID_PARTIAL_DATA_MATCH": 10, - "TYPE_ID_INDEXED_DATA_MATCH": 11, - "TYPE_ID_OTHER": 99, + GpuInfo_VramModeId_value = map[string]int32{ + "VRAM_MODE_ID_UNKNOWN": 0, + "VRAM_MODE_ID_SHARED": 1, + "VRAM_MODE_ID_DEDICATED": 2, + "VRAM_MODE_ID_OTHER": 99, } ) -func (x Analytic_TypeId) Enum() *Analytic_TypeId { - p := new(Analytic_TypeId) +func (x GpuInfo_VramModeId) Enum() *GpuInfo_VramModeId { + p := new(GpuInfo_VramModeId) *p = x return p } -func (x Analytic_TypeId) String() string { +func (x GpuInfo_VramModeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Analytic_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[25].Descriptor() +func (GpuInfo_VramModeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[24].Descriptor() } -func (Analytic_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[25] +func (GpuInfo_VramModeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[24] } -func (x Analytic_TypeId) Number() protoreflect.EnumNumber { +func (x GpuInfo_VramModeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Analytic_TypeId.Descriptor instead. -func (Analytic_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{9, 1} +// Deprecated: Use GpuInfo_VramModeId.Descriptor instead. +func (GpuInfo_VramModeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{46, 1} } -type Application_RiskLevelId int32 +type Graph_QueryLanguageId int32 const ( - Application_RISK_LEVEL_ID_INFO Application_RiskLevelId = 0 - Application_RISK_LEVEL_ID_LOW Application_RiskLevelId = 1 - Application_RISK_LEVEL_ID_MEDIUM Application_RiskLevelId = 2 - Application_RISK_LEVEL_ID_HIGH Application_RiskLevelId = 3 - Application_RISK_LEVEL_ID_CRITICAL Application_RiskLevelId = 4 - Application_RISK_LEVEL_ID_OTHER Application_RiskLevelId = 99 + Graph_QUERY_LANGUAGE_ID_UNKNOWN Graph_QueryLanguageId = 0 + Graph_QUERY_LANGUAGE_ID_CYPHER Graph_QueryLanguageId = 1 + Graph_QUERY_LANGUAGE_ID_GRAPHQL Graph_QueryLanguageId = 2 + Graph_QUERY_LANGUAGE_ID_GREMLIN Graph_QueryLanguageId = 3 + Graph_QUERY_LANGUAGE_ID_GQL Graph_QueryLanguageId = 4 + Graph_QUERY_LANGUAGE_ID_G_CORE Graph_QueryLanguageId = 5 + Graph_QUERY_LANGUAGE_ID_PGQL Graph_QueryLanguageId = 6 + Graph_QUERY_LANGUAGE_ID_SPARQL Graph_QueryLanguageId = 7 + Graph_QUERY_LANGUAGE_ID_OTHER Graph_QueryLanguageId = 99 ) -// Enum value maps for Application_RiskLevelId. +// Enum value maps for Graph_QueryLanguageId. var ( - Application_RiskLevelId_name = map[int32]string{ - 0: "RISK_LEVEL_ID_INFO", - 1: "RISK_LEVEL_ID_LOW", - 2: "RISK_LEVEL_ID_MEDIUM", - 3: "RISK_LEVEL_ID_HIGH", - 4: "RISK_LEVEL_ID_CRITICAL", - 99: "RISK_LEVEL_ID_OTHER", + Graph_QueryLanguageId_name = map[int32]string{ + 0: "QUERY_LANGUAGE_ID_UNKNOWN", + 1: "QUERY_LANGUAGE_ID_CYPHER", + 2: "QUERY_LANGUAGE_ID_GRAPHQL", + 3: "QUERY_LANGUAGE_ID_GREMLIN", + 4: "QUERY_LANGUAGE_ID_GQL", + 5: "QUERY_LANGUAGE_ID_G_CORE", + 6: "QUERY_LANGUAGE_ID_PGQL", + 7: "QUERY_LANGUAGE_ID_SPARQL", + 99: "QUERY_LANGUAGE_ID_OTHER", } - Application_RiskLevelId_value = map[string]int32{ - "RISK_LEVEL_ID_INFO": 0, - "RISK_LEVEL_ID_LOW": 1, - "RISK_LEVEL_ID_MEDIUM": 2, - "RISK_LEVEL_ID_HIGH": 3, - "RISK_LEVEL_ID_CRITICAL": 4, - "RISK_LEVEL_ID_OTHER": 99, + Graph_QueryLanguageId_value = map[string]int32{ + "QUERY_LANGUAGE_ID_UNKNOWN": 0, + "QUERY_LANGUAGE_ID_CYPHER": 1, + "QUERY_LANGUAGE_ID_GRAPHQL": 2, + "QUERY_LANGUAGE_ID_GREMLIN": 3, + "QUERY_LANGUAGE_ID_GQL": 4, + "QUERY_LANGUAGE_ID_G_CORE": 5, + "QUERY_LANGUAGE_ID_PGQL": 6, + "QUERY_LANGUAGE_ID_SPARQL": 7, + "QUERY_LANGUAGE_ID_OTHER": 99, } ) -func (x Application_RiskLevelId) Enum() *Application_RiskLevelId { - p := new(Application_RiskLevelId) +func (x Graph_QueryLanguageId) Enum() *Graph_QueryLanguageId { + p := new(Graph_QueryLanguageId) *p = x return p } -func (x Application_RiskLevelId) String() string { +func (x Graph_QueryLanguageId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Application_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[26].Descriptor() +func (Graph_QueryLanguageId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[25].Descriptor() } -func (Application_RiskLevelId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[26] +func (Graph_QueryLanguageId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[25] } -func (x Application_RiskLevelId) Number() protoreflect.EnumNumber { +func (x Graph_QueryLanguageId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Application_RiskLevelId.Descriptor instead. -func (Application_RiskLevelId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{11, 0} +// Deprecated: Use Graph_QueryLanguageId.Descriptor instead. +func (Graph_QueryLanguageId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{47, 0} } -type AuthFactor_FactorTypeId int32 +type Idp_StateId int32 const ( - AuthFactor_FACTOR_TYPE_ID_UNKNOWN AuthFactor_FactorTypeId = 0 - AuthFactor_FACTOR_TYPE_ID_SMS AuthFactor_FactorTypeId = 1 - AuthFactor_FACTOR_TYPE_ID_SECURITY_QUESTION AuthFactor_FactorTypeId = 2 - AuthFactor_FACTOR_TYPE_ID_PHONE_CALL AuthFactor_FactorTypeId = 3 - AuthFactor_FACTOR_TYPE_ID_BIOMETRIC AuthFactor_FactorTypeId = 4 - AuthFactor_FACTOR_TYPE_ID_PUSH_NOTIFICATION AuthFactor_FactorTypeId = 5 - AuthFactor_FACTOR_TYPE_ID_HARDWARE_TOKEN AuthFactor_FactorTypeId = 6 - AuthFactor_FACTOR_TYPE_ID_OTP AuthFactor_FactorTypeId = 7 - AuthFactor_FACTOR_TYPE_ID_EMAIL AuthFactor_FactorTypeId = 8 - AuthFactor_FACTOR_TYPE_ID_U2F AuthFactor_FactorTypeId = 9 - AuthFactor_FACTOR_TYPE_ID_WEBAUTHN AuthFactor_FactorTypeId = 10 - AuthFactor_FACTOR_TYPE_ID_PASSWORD AuthFactor_FactorTypeId = 11 - AuthFactor_FACTOR_TYPE_ID_OTHER AuthFactor_FactorTypeId = 99 + Idp_STATE_ID_UNKNOWN Idp_StateId = 0 + Idp_STATE_ID_ACTIVE Idp_StateId = 1 + Idp_STATE_ID_SUSPENDED Idp_StateId = 2 + Idp_STATE_ID_DEPRECATED Idp_StateId = 3 + Idp_STATE_ID_DELETED Idp_StateId = 4 + Idp_STATE_ID_OTHER Idp_StateId = 99 ) -// Enum value maps for AuthFactor_FactorTypeId. +// Enum value maps for Idp_StateId. var ( - AuthFactor_FactorTypeId_name = map[int32]string{ - 0: "FACTOR_TYPE_ID_UNKNOWN", - 1: "FACTOR_TYPE_ID_SMS", - 2: "FACTOR_TYPE_ID_SECURITY_QUESTION", - 3: "FACTOR_TYPE_ID_PHONE_CALL", - 4: "FACTOR_TYPE_ID_BIOMETRIC", - 5: "FACTOR_TYPE_ID_PUSH_NOTIFICATION", - 6: "FACTOR_TYPE_ID_HARDWARE_TOKEN", - 7: "FACTOR_TYPE_ID_OTP", - 8: "FACTOR_TYPE_ID_EMAIL", - 9: "FACTOR_TYPE_ID_U2F", - 10: "FACTOR_TYPE_ID_WEBAUTHN", - 11: "FACTOR_TYPE_ID_PASSWORD", - 99: "FACTOR_TYPE_ID_OTHER", + Idp_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_ACTIVE", + 2: "STATE_ID_SUSPENDED", + 3: "STATE_ID_DEPRECATED", + 4: "STATE_ID_DELETED", + 99: "STATE_ID_OTHER", } - AuthFactor_FactorTypeId_value = map[string]int32{ - "FACTOR_TYPE_ID_UNKNOWN": 0, - "FACTOR_TYPE_ID_SMS": 1, - "FACTOR_TYPE_ID_SECURITY_QUESTION": 2, - "FACTOR_TYPE_ID_PHONE_CALL": 3, - "FACTOR_TYPE_ID_BIOMETRIC": 4, - "FACTOR_TYPE_ID_PUSH_NOTIFICATION": 5, - "FACTOR_TYPE_ID_HARDWARE_TOKEN": 6, - "FACTOR_TYPE_ID_OTP": 7, - "FACTOR_TYPE_ID_EMAIL": 8, - "FACTOR_TYPE_ID_U2F": 9, - "FACTOR_TYPE_ID_WEBAUTHN": 10, - "FACTOR_TYPE_ID_PASSWORD": 11, - "FACTOR_TYPE_ID_OTHER": 99, + Idp_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_ACTIVE": 1, + "STATE_ID_SUSPENDED": 2, + "STATE_ID_DEPRECATED": 3, + "STATE_ID_DELETED": 4, + "STATE_ID_OTHER": 99, } ) -func (x AuthFactor_FactorTypeId) Enum() *AuthFactor_FactorTypeId { - p := new(AuthFactor_FactorTypeId) +func (x Idp_StateId) Enum() *Idp_StateId { + p := new(Idp_StateId) *p = x return p } -func (x AuthFactor_FactorTypeId) String() string { +func (x Idp_StateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (AuthFactor_FactorTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[27].Descriptor() +func (Idp_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[26].Descriptor() } -func (AuthFactor_FactorTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[27] +func (Idp_StateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[26] } -func (x AuthFactor_FactorTypeId) Number() protoreflect.EnumNumber { +func (x Idp_StateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use AuthFactor_FactorTypeId.Descriptor instead. -func (AuthFactor_FactorTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{13, 0} +// Deprecated: Use Idp_StateId.Descriptor instead. +func (Idp_StateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{52, 0} } -type DataClassification_CategoryId int32 +type KbArticle_InstallStateId int32 const ( - DataClassification_CATEGORY_ID_UNKNOWN DataClassification_CategoryId = 0 - DataClassification_CATEGORY_ID_PERSONAL DataClassification_CategoryId = 1 - DataClassification_CATEGORY_ID_GOVERNMENTAL DataClassification_CategoryId = 2 - DataClassification_CATEGORY_ID_FINANCIAL DataClassification_CategoryId = 3 - DataClassification_CATEGORY_ID_BUSINESS DataClassification_CategoryId = 4 - DataClassification_CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT DataClassification_CategoryId = 5 - DataClassification_CATEGORY_ID_SECURITY DataClassification_CategoryId = 6 - DataClassification_CATEGORY_ID_OTHER DataClassification_CategoryId = 99 + KbArticle_INSTALL_STATE_ID_UNKNOWN KbArticle_InstallStateId = 0 + KbArticle_INSTALL_STATE_ID_INSTALLED KbArticle_InstallStateId = 1 + KbArticle_INSTALL_STATE_ID_NOT_INSTALLED KbArticle_InstallStateId = 2 + KbArticle_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT KbArticle_InstallStateId = 3 + KbArticle_INSTALL_STATE_ID_OTHER KbArticle_InstallStateId = 99 ) -// Enum value maps for DataClassification_CategoryId. +// Enum value maps for KbArticle_InstallStateId. var ( - DataClassification_CategoryId_name = map[int32]string{ - 0: "CATEGORY_ID_UNKNOWN", - 1: "CATEGORY_ID_PERSONAL", - 2: "CATEGORY_ID_GOVERNMENTAL", - 3: "CATEGORY_ID_FINANCIAL", - 4: "CATEGORY_ID_BUSINESS", - 5: "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT", - 6: "CATEGORY_ID_SECURITY", - 99: "CATEGORY_ID_OTHER", + KbArticle_InstallStateId_name = map[int32]string{ + 0: "INSTALL_STATE_ID_UNKNOWN", + 1: "INSTALL_STATE_ID_INSTALLED", + 2: "INSTALL_STATE_ID_NOT_INSTALLED", + 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", + 99: "INSTALL_STATE_ID_OTHER", } - DataClassification_CategoryId_value = map[string]int32{ - "CATEGORY_ID_UNKNOWN": 0, - "CATEGORY_ID_PERSONAL": 1, - "CATEGORY_ID_GOVERNMENTAL": 2, - "CATEGORY_ID_FINANCIAL": 3, - "CATEGORY_ID_BUSINESS": 4, - "CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT": 5, - "CATEGORY_ID_SECURITY": 6, - "CATEGORY_ID_OTHER": 99, + KbArticle_InstallStateId_value = map[string]int32{ + "INSTALL_STATE_ID_UNKNOWN": 0, + "INSTALL_STATE_ID_INSTALLED": 1, + "INSTALL_STATE_ID_NOT_INSTALLED": 2, + "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, + "INSTALL_STATE_ID_OTHER": 99, } ) -func (x DataClassification_CategoryId) Enum() *DataClassification_CategoryId { - p := new(DataClassification_CategoryId) +func (x KbArticle_InstallStateId) Enum() *KbArticle_InstallStateId { + p := new(KbArticle_InstallStateId) *p = x return p } -func (x DataClassification_CategoryId) String() string { +func (x KbArticle_InstallStateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DataClassification_CategoryId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[28].Descriptor() +func (KbArticle_InstallStateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[27].Descriptor() } -func (DataClassification_CategoryId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[28] +func (KbArticle_InstallStateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[27] } -func (x DataClassification_CategoryId) Number() protoreflect.EnumNumber { +func (x KbArticle_InstallStateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DataClassification_CategoryId.Descriptor instead. -func (DataClassification_CategoryId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{28, 0} +// Deprecated: Use KbArticle_InstallStateId.Descriptor instead. +func (KbArticle_InstallStateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{54, 0} } -type DataClassification_ConfidentialityId int32 +type KillChainPhase_PhaseId int32 const ( - DataClassification_CONFIDENTIALITY_ID_UNKNOWN DataClassification_ConfidentialityId = 0 - DataClassification_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL DataClassification_ConfidentialityId = 1 - DataClassification_CONFIDENTIALITY_ID_CONFIDENTIAL DataClassification_ConfidentialityId = 2 - DataClassification_CONFIDENTIALITY_ID_SECRET DataClassification_ConfidentialityId = 3 - DataClassification_CONFIDENTIALITY_ID_TOP_SECRET DataClassification_ConfidentialityId = 4 - DataClassification_CONFIDENTIALITY_ID_PRIVATE DataClassification_ConfidentialityId = 5 - DataClassification_CONFIDENTIALITY_ID_RESTRICTED DataClassification_ConfidentialityId = 6 - DataClassification_CONFIDENTIALITY_ID_OTHER DataClassification_ConfidentialityId = 99 + KillChainPhase_PHASE_ID_UNKNOWN KillChainPhase_PhaseId = 0 + KillChainPhase_PHASE_ID_RECONNAISSANCE KillChainPhase_PhaseId = 1 + KillChainPhase_PHASE_ID_WEAPONIZATION KillChainPhase_PhaseId = 2 + KillChainPhase_PHASE_ID_DELIVERY KillChainPhase_PhaseId = 3 + KillChainPhase_PHASE_ID_EXPLOITATION KillChainPhase_PhaseId = 4 + KillChainPhase_PHASE_ID_INSTALLATION KillChainPhase_PhaseId = 5 + KillChainPhase_PHASE_ID_COMMAND_CONTROL KillChainPhase_PhaseId = 6 + KillChainPhase_PHASE_ID_ACTIONS_ON_OBJECTIVES KillChainPhase_PhaseId = 7 + KillChainPhase_PHASE_ID_OTHER KillChainPhase_PhaseId = 99 ) -// Enum value maps for DataClassification_ConfidentialityId. +// Enum value maps for KillChainPhase_PhaseId. var ( - DataClassification_ConfidentialityId_name = map[int32]string{ - 0: "CONFIDENTIALITY_ID_UNKNOWN", - 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", - 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", - 3: "CONFIDENTIALITY_ID_SECRET", - 4: "CONFIDENTIALITY_ID_TOP_SECRET", - 5: "CONFIDENTIALITY_ID_PRIVATE", - 6: "CONFIDENTIALITY_ID_RESTRICTED", - 99: "CONFIDENTIALITY_ID_OTHER", + KillChainPhase_PhaseId_name = map[int32]string{ + 0: "PHASE_ID_UNKNOWN", + 1: "PHASE_ID_RECONNAISSANCE", + 2: "PHASE_ID_WEAPONIZATION", + 3: "PHASE_ID_DELIVERY", + 4: "PHASE_ID_EXPLOITATION", + 5: "PHASE_ID_INSTALLATION", + 6: "PHASE_ID_COMMAND_CONTROL", + 7: "PHASE_ID_ACTIONS_ON_OBJECTIVES", + 99: "PHASE_ID_OTHER", } - DataClassification_ConfidentialityId_value = map[string]int32{ - "CONFIDENTIALITY_ID_UNKNOWN": 0, - "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, - "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, - "CONFIDENTIALITY_ID_SECRET": 3, - "CONFIDENTIALITY_ID_TOP_SECRET": 4, - "CONFIDENTIALITY_ID_PRIVATE": 5, - "CONFIDENTIALITY_ID_RESTRICTED": 6, - "CONFIDENTIALITY_ID_OTHER": 99, + KillChainPhase_PhaseId_value = map[string]int32{ + "PHASE_ID_UNKNOWN": 0, + "PHASE_ID_RECONNAISSANCE": 1, + "PHASE_ID_WEAPONIZATION": 2, + "PHASE_ID_DELIVERY": 3, + "PHASE_ID_EXPLOITATION": 4, + "PHASE_ID_INSTALLATION": 5, + "PHASE_ID_COMMAND_CONTROL": 6, + "PHASE_ID_ACTIONS_ON_OBJECTIVES": 7, + "PHASE_ID_OTHER": 99, } ) -func (x DataClassification_ConfidentialityId) Enum() *DataClassification_ConfidentialityId { - p := new(DataClassification_ConfidentialityId) +func (x KillChainPhase_PhaseId) Enum() *KillChainPhase_PhaseId { + p := new(KillChainPhase_PhaseId) *p = x return p } -func (x DataClassification_ConfidentialityId) String() string { +func (x KillChainPhase_PhaseId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DataClassification_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[29].Descriptor() +func (KillChainPhase_PhaseId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[28].Descriptor() } -func (DataClassification_ConfidentialityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[29] +func (KillChainPhase_PhaseId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[28] } -func (x DataClassification_ConfidentialityId) Number() protoreflect.EnumNumber { +func (x KillChainPhase_PhaseId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DataClassification_ConfidentialityId.Descriptor instead. -func (DataClassification_ConfidentialityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{28, 1} +// Deprecated: Use KillChainPhase_PhaseId.Descriptor instead. +func (KillChainPhase_PhaseId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{57, 0} } -type DataClassification_StatusId int32 +type Malware_ClassificationIds int32 const ( - DataClassification_STATUS_ID_UNKNOWN DataClassification_StatusId = 0 - DataClassification_STATUS_ID_COMPLETE DataClassification_StatusId = 1 - DataClassification_STATUS_ID_PARTIAL DataClassification_StatusId = 2 - DataClassification_STATUS_ID_FAIL DataClassification_StatusId = 3 - DataClassification_STATUS_ID_OTHER DataClassification_StatusId = 99 + Malware_CLASSIFICATION_IDS_UNKNOWN Malware_ClassificationIds = 0 + Malware_CLASSIFICATION_IDS_ADWARE Malware_ClassificationIds = 1 + Malware_CLASSIFICATION_IDS_BACKDOOR Malware_ClassificationIds = 2 + Malware_CLASSIFICATION_IDS_BOT Malware_ClassificationIds = 3 + Malware_CLASSIFICATION_IDS_BOOTKIT Malware_ClassificationIds = 4 + Malware_CLASSIFICATION_IDS_DDOS Malware_ClassificationIds = 5 + Malware_CLASSIFICATION_IDS_DOWNLOADER Malware_ClassificationIds = 6 + Malware_CLASSIFICATION_IDS_DROPPER Malware_ClassificationIds = 7 + Malware_CLASSIFICATION_IDS_EXPLOIT_KIT Malware_ClassificationIds = 8 + Malware_CLASSIFICATION_IDS_KEYLOGGER Malware_ClassificationIds = 9 + Malware_CLASSIFICATION_IDS_RANSOMWARE Malware_ClassificationIds = 10 + Malware_CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN Malware_ClassificationIds = 11 + Malware_CLASSIFICATION_IDS_RESOURCE_EXPLOITATION Malware_ClassificationIds = 13 + Malware_CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE Malware_ClassificationIds = 14 + Malware_CLASSIFICATION_IDS_ROOTKIT Malware_ClassificationIds = 15 + Malware_CLASSIFICATION_IDS_SCREEN_CAPTURE Malware_ClassificationIds = 16 + Malware_CLASSIFICATION_IDS_SPYWARE Malware_ClassificationIds = 17 + Malware_CLASSIFICATION_IDS_TROJAN Malware_ClassificationIds = 18 + Malware_CLASSIFICATION_IDS_VIRUS Malware_ClassificationIds = 19 + Malware_CLASSIFICATION_IDS_WEBSHELL Malware_ClassificationIds = 20 + Malware_CLASSIFICATION_IDS_WIPER Malware_ClassificationIds = 21 + Malware_CLASSIFICATION_IDS_WORM Malware_ClassificationIds = 22 + Malware_CLASSIFICATION_IDS_OTHER Malware_ClassificationIds = 99 ) -// Enum value maps for DataClassification_StatusId. +// Enum value maps for Malware_ClassificationIds. var ( - DataClassification_StatusId_name = map[int32]string{ - 0: "STATUS_ID_UNKNOWN", - 1: "STATUS_ID_COMPLETE", - 2: "STATUS_ID_PARTIAL", - 3: "STATUS_ID_FAIL", - 99: "STATUS_ID_OTHER", + Malware_ClassificationIds_name = map[int32]string{ + 0: "CLASSIFICATION_IDS_UNKNOWN", + 1: "CLASSIFICATION_IDS_ADWARE", + 2: "CLASSIFICATION_IDS_BACKDOOR", + 3: "CLASSIFICATION_IDS_BOT", + 4: "CLASSIFICATION_IDS_BOOTKIT", + 5: "CLASSIFICATION_IDS_DDOS", + 6: "CLASSIFICATION_IDS_DOWNLOADER", + 7: "CLASSIFICATION_IDS_DROPPER", + 8: "CLASSIFICATION_IDS_EXPLOIT_KIT", + 9: "CLASSIFICATION_IDS_KEYLOGGER", + 10: "CLASSIFICATION_IDS_RANSOMWARE", + 11: "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN", + 13: "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION", + 14: "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE", + 15: "CLASSIFICATION_IDS_ROOTKIT", + 16: "CLASSIFICATION_IDS_SCREEN_CAPTURE", + 17: "CLASSIFICATION_IDS_SPYWARE", + 18: "CLASSIFICATION_IDS_TROJAN", + 19: "CLASSIFICATION_IDS_VIRUS", + 20: "CLASSIFICATION_IDS_WEBSHELL", + 21: "CLASSIFICATION_IDS_WIPER", + 22: "CLASSIFICATION_IDS_WORM", + 99: "CLASSIFICATION_IDS_OTHER", } - DataClassification_StatusId_value = map[string]int32{ - "STATUS_ID_UNKNOWN": 0, - "STATUS_ID_COMPLETE": 1, - "STATUS_ID_PARTIAL": 2, - "STATUS_ID_FAIL": 3, - "STATUS_ID_OTHER": 99, + Malware_ClassificationIds_value = map[string]int32{ + "CLASSIFICATION_IDS_UNKNOWN": 0, + "CLASSIFICATION_IDS_ADWARE": 1, + "CLASSIFICATION_IDS_BACKDOOR": 2, + "CLASSIFICATION_IDS_BOT": 3, + "CLASSIFICATION_IDS_BOOTKIT": 4, + "CLASSIFICATION_IDS_DDOS": 5, + "CLASSIFICATION_IDS_DOWNLOADER": 6, + "CLASSIFICATION_IDS_DROPPER": 7, + "CLASSIFICATION_IDS_EXPLOIT_KIT": 8, + "CLASSIFICATION_IDS_KEYLOGGER": 9, + "CLASSIFICATION_IDS_RANSOMWARE": 10, + "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN": 11, + "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION": 13, + "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE": 14, + "CLASSIFICATION_IDS_ROOTKIT": 15, + "CLASSIFICATION_IDS_SCREEN_CAPTURE": 16, + "CLASSIFICATION_IDS_SPYWARE": 17, + "CLASSIFICATION_IDS_TROJAN": 18, + "CLASSIFICATION_IDS_VIRUS": 19, + "CLASSIFICATION_IDS_WEBSHELL": 20, + "CLASSIFICATION_IDS_WIPER": 21, + "CLASSIFICATION_IDS_WORM": 22, + "CLASSIFICATION_IDS_OTHER": 99, } ) -func (x DataClassification_StatusId) Enum() *DataClassification_StatusId { - p := new(DataClassification_StatusId) +func (x Malware_ClassificationIds) Enum() *Malware_ClassificationIds { + p := new(Malware_ClassificationIds) *p = x return p } -func (x DataClassification_StatusId) String() string { +func (x Malware_ClassificationIds) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DataClassification_StatusId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[30].Descriptor() +func (Malware_ClassificationIds) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[29].Descriptor() } -func (DataClassification_StatusId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[30] +func (Malware_ClassificationIds) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[29] } -func (x DataClassification_StatusId) Number() protoreflect.EnumNumber { +func (x Malware_ClassificationIds) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DataClassification_StatusId.Descriptor instead. -func (DataClassification_StatusId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{28, 2} +// Deprecated: Use Malware_ClassificationIds.Descriptor instead. +func (Malware_ClassificationIds) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{62, 0} } -type Device_RiskLevelId int32 +type Malware_SeverityId int32 const ( - Device_RISK_LEVEL_ID_INFO Device_RiskLevelId = 0 - Device_RISK_LEVEL_ID_LOW Device_RiskLevelId = 1 - Device_RISK_LEVEL_ID_MEDIUM Device_RiskLevelId = 2 - Device_RISK_LEVEL_ID_HIGH Device_RiskLevelId = 3 - Device_RISK_LEVEL_ID_CRITICAL Device_RiskLevelId = 4 - Device_RISK_LEVEL_ID_OTHER Device_RiskLevelId = 99 + Malware_SEVERITY_ID_UNKNOWN Malware_SeverityId = 0 + Malware_SEVERITY_ID_INFORMATIONAL Malware_SeverityId = 1 + Malware_SEVERITY_ID_LOW Malware_SeverityId = 2 + Malware_SEVERITY_ID_MEDIUM Malware_SeverityId = 3 + Malware_SEVERITY_ID_HIGH Malware_SeverityId = 4 + Malware_SEVERITY_ID_CRITICAL Malware_SeverityId = 5 + Malware_SEVERITY_ID_FATAL Malware_SeverityId = 6 + Malware_SEVERITY_ID_OTHER Malware_SeverityId = 99 ) -// Enum value maps for Device_RiskLevelId. +// Enum value maps for Malware_SeverityId. var ( - Device_RiskLevelId_name = map[int32]string{ - 0: "RISK_LEVEL_ID_INFO", - 1: "RISK_LEVEL_ID_LOW", - 2: "RISK_LEVEL_ID_MEDIUM", - 3: "RISK_LEVEL_ID_HIGH", - 4: "RISK_LEVEL_ID_CRITICAL", - 99: "RISK_LEVEL_ID_OTHER", + Malware_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", } - Device_RiskLevelId_value = map[string]int32{ - "RISK_LEVEL_ID_INFO": 0, - "RISK_LEVEL_ID_LOW": 1, - "RISK_LEVEL_ID_MEDIUM": 2, - "RISK_LEVEL_ID_HIGH": 3, - "RISK_LEVEL_ID_CRITICAL": 4, - "RISK_LEVEL_ID_OTHER": 99, + Malware_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, } ) -func (x Device_RiskLevelId) Enum() *Device_RiskLevelId { - p := new(Device_RiskLevelId) +func (x Malware_SeverityId) Enum() *Malware_SeverityId { + p := new(Malware_SeverityId) *p = x return p } -func (x Device_RiskLevelId) String() string { +func (x Malware_SeverityId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Device_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[31].Descriptor() +func (Malware_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[30].Descriptor() } -func (Device_RiskLevelId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[31] +func (Malware_SeverityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[30] } -func (x Device_RiskLevelId) Number() protoreflect.EnumNumber { +func (x Malware_SeverityId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Device_RiskLevelId.Descriptor instead. -func (Device_RiskLevelId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{29, 0} +// Deprecated: Use Malware_SeverityId.Descriptor instead. +func (Malware_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{62, 1} } -type Device_TypeId int32 +type MalwareScanInfo_TypeId int32 const ( - Device_TYPE_ID_UNKNOWN Device_TypeId = 0 - Device_TYPE_ID_SERVER Device_TypeId = 1 - Device_TYPE_ID_DESKTOP Device_TypeId = 2 - Device_TYPE_ID_LAPTOP Device_TypeId = 3 - Device_TYPE_ID_TABLET Device_TypeId = 4 - Device_TYPE_ID_MOBILE Device_TypeId = 5 - Device_TYPE_ID_VIRTUAL Device_TypeId = 6 - Device_TYPE_ID_IOT Device_TypeId = 7 - Device_TYPE_ID_BROWSER Device_TypeId = 8 - Device_TYPE_ID_FIREWALL Device_TypeId = 9 - Device_TYPE_ID_SWITCH Device_TypeId = 10 - Device_TYPE_ID_HUB Device_TypeId = 11 - Device_TYPE_ID_ROUTER Device_TypeId = 12 - Device_TYPE_ID_IDS Device_TypeId = 13 - Device_TYPE_ID_IPS Device_TypeId = 14 - Device_TYPE_ID_LOAD_BALANCER Device_TypeId = 15 - Device_TYPE_ID_OTHER Device_TypeId = 99 + MalwareScanInfo_TYPE_ID_UNKNOWN MalwareScanInfo_TypeId = 0 + MalwareScanInfo_TYPE_ID_MANUAL MalwareScanInfo_TypeId = 1 + MalwareScanInfo_TYPE_ID_SCHEDULED MalwareScanInfo_TypeId = 2 + MalwareScanInfo_TYPE_ID_UPDATED_CONTENT MalwareScanInfo_TypeId = 3 + MalwareScanInfo_TYPE_ID_QUARANTINED_ITEMS MalwareScanInfo_TypeId = 4 + MalwareScanInfo_TYPE_ID_ATTACHED_MEDIA MalwareScanInfo_TypeId = 5 + MalwareScanInfo_TYPE_ID_USER_LOGON MalwareScanInfo_TypeId = 6 + MalwareScanInfo_TYPE_ID_ELAM MalwareScanInfo_TypeId = 7 + MalwareScanInfo_TYPE_ID_OTHER MalwareScanInfo_TypeId = 99 ) -// Enum value maps for Device_TypeId. +// Enum value maps for MalwareScanInfo_TypeId. var ( - Device_TypeId_name = map[int32]string{ + MalwareScanInfo_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_SERVER", - 2: "TYPE_ID_DESKTOP", - 3: "TYPE_ID_LAPTOP", - 4: "TYPE_ID_TABLET", - 5: "TYPE_ID_MOBILE", - 6: "TYPE_ID_VIRTUAL", - 7: "TYPE_ID_IOT", - 8: "TYPE_ID_BROWSER", - 9: "TYPE_ID_FIREWALL", - 10: "TYPE_ID_SWITCH", - 11: "TYPE_ID_HUB", - 12: "TYPE_ID_ROUTER", - 13: "TYPE_ID_IDS", - 14: "TYPE_ID_IPS", - 15: "TYPE_ID_LOAD_BALANCER", + 1: "TYPE_ID_MANUAL", + 2: "TYPE_ID_SCHEDULED", + 3: "TYPE_ID_UPDATED_CONTENT", + 4: "TYPE_ID_QUARANTINED_ITEMS", + 5: "TYPE_ID_ATTACHED_MEDIA", + 6: "TYPE_ID_USER_LOGON", + 7: "TYPE_ID_ELAM", 99: "TYPE_ID_OTHER", } - Device_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_SERVER": 1, - "TYPE_ID_DESKTOP": 2, - "TYPE_ID_LAPTOP": 3, - "TYPE_ID_TABLET": 4, - "TYPE_ID_MOBILE": 5, - "TYPE_ID_VIRTUAL": 6, - "TYPE_ID_IOT": 7, - "TYPE_ID_BROWSER": 8, - "TYPE_ID_FIREWALL": 9, - "TYPE_ID_SWITCH": 10, - "TYPE_ID_HUB": 11, - "TYPE_ID_ROUTER": 12, - "TYPE_ID_IDS": 13, - "TYPE_ID_IPS": 14, - "TYPE_ID_LOAD_BALANCER": 15, - "TYPE_ID_OTHER": 99, + MalwareScanInfo_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_MANUAL": 1, + "TYPE_ID_SCHEDULED": 2, + "TYPE_ID_UPDATED_CONTENT": 3, + "TYPE_ID_QUARANTINED_ITEMS": 4, + "TYPE_ID_ATTACHED_MEDIA": 5, + "TYPE_ID_USER_LOGON": 6, + "TYPE_ID_ELAM": 7, + "TYPE_ID_OTHER": 99, } ) -func (x Device_TypeId) Enum() *Device_TypeId { - p := new(Device_TypeId) +func (x MalwareScanInfo_TypeId) Enum() *MalwareScanInfo_TypeId { + p := new(MalwareScanInfo_TypeId) *p = x return p } -func (x Device_TypeId) String() string { +func (x MalwareScanInfo_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Device_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[32].Descriptor() +func (MalwareScanInfo_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[31].Descriptor() } -func (Device_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[32] +func (MalwareScanInfo_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[31] } -func (x Device_TypeId) Number() protoreflect.EnumNumber { +func (x MalwareScanInfo_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Device_TypeId.Descriptor instead. -func (Device_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{29, 1} +// Deprecated: Use MalwareScanInfo_TypeId.Descriptor instead. +func (MalwareScanInfo_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{63, 0} } -type DeviceHwInfo_CpuArchitectureId int32 +type ManagedEntity_TypeId int32 const ( - DeviceHwInfo_CPU_ARCHITECTURE_ID_UNKNOWN DeviceHwInfo_CpuArchitectureId = 0 - DeviceHwInfo_CPU_ARCHITECTURE_ID_X86 DeviceHwInfo_CpuArchitectureId = 1 - DeviceHwInfo_CPU_ARCHITECTURE_ID_ARM DeviceHwInfo_CpuArchitectureId = 2 - DeviceHwInfo_CPU_ARCHITECTURE_ID_RISC_V DeviceHwInfo_CpuArchitectureId = 3 - DeviceHwInfo_CPU_ARCHITECTURE_ID_OTHER DeviceHwInfo_CpuArchitectureId = 99 + ManagedEntity_TYPE_ID_UNKNOWN ManagedEntity_TypeId = 0 + ManagedEntity_TYPE_ID_DEVICE ManagedEntity_TypeId = 1 + ManagedEntity_TYPE_ID_USER ManagedEntity_TypeId = 2 + ManagedEntity_TYPE_ID_GROUP ManagedEntity_TypeId = 3 + ManagedEntity_TYPE_ID_ORGANIZATION ManagedEntity_TypeId = 4 + ManagedEntity_TYPE_ID_POLICY ManagedEntity_TypeId = 5 + ManagedEntity_TYPE_ID_EMAIL ManagedEntity_TypeId = 6 + ManagedEntity_TYPE_ID_NETWORK_ZONE ManagedEntity_TypeId = 7 + ManagedEntity_TYPE_ID_OTHER ManagedEntity_TypeId = 99 ) -// Enum value maps for DeviceHwInfo_CpuArchitectureId. +// Enum value maps for ManagedEntity_TypeId. var ( - DeviceHwInfo_CpuArchitectureId_name = map[int32]string{ - 0: "CPU_ARCHITECTURE_ID_UNKNOWN", - 1: "CPU_ARCHITECTURE_ID_X86", - 2: "CPU_ARCHITECTURE_ID_ARM", - 3: "CPU_ARCHITECTURE_ID_RISC_V", - 99: "CPU_ARCHITECTURE_ID_OTHER", + ManagedEntity_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_DEVICE", + 2: "TYPE_ID_USER", + 3: "TYPE_ID_GROUP", + 4: "TYPE_ID_ORGANIZATION", + 5: "TYPE_ID_POLICY", + 6: "TYPE_ID_EMAIL", + 7: "TYPE_ID_NETWORK_ZONE", + 99: "TYPE_ID_OTHER", } - DeviceHwInfo_CpuArchitectureId_value = map[string]int32{ - "CPU_ARCHITECTURE_ID_UNKNOWN": 0, - "CPU_ARCHITECTURE_ID_X86": 1, - "CPU_ARCHITECTURE_ID_ARM": 2, - "CPU_ARCHITECTURE_ID_RISC_V": 3, - "CPU_ARCHITECTURE_ID_OTHER": 99, + ManagedEntity_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_DEVICE": 1, + "TYPE_ID_USER": 2, + "TYPE_ID_GROUP": 3, + "TYPE_ID_ORGANIZATION": 4, + "TYPE_ID_POLICY": 5, + "TYPE_ID_EMAIL": 6, + "TYPE_ID_NETWORK_ZONE": 7, + "TYPE_ID_OTHER": 99, } ) -func (x DeviceHwInfo_CpuArchitectureId) Enum() *DeviceHwInfo_CpuArchitectureId { - p := new(DeviceHwInfo_CpuArchitectureId) +func (x ManagedEntity_TypeId) Enum() *ManagedEntity_TypeId { + p := new(ManagedEntity_TypeId) *p = x return p } -func (x DeviceHwInfo_CpuArchitectureId) String() string { +func (x ManagedEntity_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DeviceHwInfo_CpuArchitectureId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[33].Descriptor() +func (ManagedEntity_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[32].Descriptor() } -func (DeviceHwInfo_CpuArchitectureId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[33] +func (ManagedEntity_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[32] } -func (x DeviceHwInfo_CpuArchitectureId) Number() protoreflect.EnumNumber { +func (x ManagedEntity_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DeviceHwInfo_CpuArchitectureId.Descriptor instead. -func (DeviceHwInfo_CpuArchitectureId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{30, 0} +// Deprecated: Use ManagedEntity_TypeId.Descriptor instead. +func (ManagedEntity_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{64, 0} } -type DigitalSignature_AlgorithmId int32 +type MessageContext_AiRoleId int32 const ( - DigitalSignature_ALGORITHM_ID_UNKNOWN DigitalSignature_AlgorithmId = 0 - DigitalSignature_ALGORITHM_ID_DSA DigitalSignature_AlgorithmId = 1 - DigitalSignature_ALGORITHM_ID_RSA DigitalSignature_AlgorithmId = 2 - DigitalSignature_ALGORITHM_ID_ECDSA DigitalSignature_AlgorithmId = 3 - DigitalSignature_ALGORITHM_ID_AUTHENTICODE DigitalSignature_AlgorithmId = 4 - DigitalSignature_ALGORITHM_ID_OTHER DigitalSignature_AlgorithmId = 99 + MessageContext_AI_ROLE_ID_UNKNOWN MessageContext_AiRoleId = 0 + MessageContext_AI_ROLE_ID_USER MessageContext_AiRoleId = 1 + MessageContext_AI_ROLE_ID_ASSISTANT MessageContext_AiRoleId = 2 + MessageContext_AI_ROLE_ID_TOOL MessageContext_AiRoleId = 3 + MessageContext_AI_ROLE_ID_AGENT MessageContext_AiRoleId = 4 + MessageContext_AI_ROLE_ID_ORCHESTRATOR MessageContext_AiRoleId = 5 + MessageContext_AI_ROLE_ID_RETRIEVER MessageContext_AiRoleId = 6 + MessageContext_AI_ROLE_ID_OTHER MessageContext_AiRoleId = 99 ) -// Enum value maps for DigitalSignature_AlgorithmId. +// Enum value maps for MessageContext_AiRoleId. var ( - DigitalSignature_AlgorithmId_name = map[int32]string{ - 0: "ALGORITHM_ID_UNKNOWN", - 1: "ALGORITHM_ID_DSA", - 2: "ALGORITHM_ID_RSA", - 3: "ALGORITHM_ID_ECDSA", - 4: "ALGORITHM_ID_AUTHENTICODE", - 99: "ALGORITHM_ID_OTHER", + MessageContext_AiRoleId_name = map[int32]string{ + 0: "AI_ROLE_ID_UNKNOWN", + 1: "AI_ROLE_ID_USER", + 2: "AI_ROLE_ID_ASSISTANT", + 3: "AI_ROLE_ID_TOOL", + 4: "AI_ROLE_ID_AGENT", + 5: "AI_ROLE_ID_ORCHESTRATOR", + 6: "AI_ROLE_ID_RETRIEVER", + 99: "AI_ROLE_ID_OTHER", } - DigitalSignature_AlgorithmId_value = map[string]int32{ - "ALGORITHM_ID_UNKNOWN": 0, - "ALGORITHM_ID_DSA": 1, - "ALGORITHM_ID_RSA": 2, - "ALGORITHM_ID_ECDSA": 3, - "ALGORITHM_ID_AUTHENTICODE": 4, - "ALGORITHM_ID_OTHER": 99, + MessageContext_AiRoleId_value = map[string]int32{ + "AI_ROLE_ID_UNKNOWN": 0, + "AI_ROLE_ID_USER": 1, + "AI_ROLE_ID_ASSISTANT": 2, + "AI_ROLE_ID_TOOL": 3, + "AI_ROLE_ID_AGENT": 4, + "AI_ROLE_ID_ORCHESTRATOR": 5, + "AI_ROLE_ID_RETRIEVER": 6, + "AI_ROLE_ID_OTHER": 99, } ) -func (x DigitalSignature_AlgorithmId) Enum() *DigitalSignature_AlgorithmId { - p := new(DigitalSignature_AlgorithmId) +func (x MessageContext_AiRoleId) Enum() *MessageContext_AiRoleId { + p := new(MessageContext_AiRoleId) *p = x return p } -func (x DigitalSignature_AlgorithmId) String() string { +func (x MessageContext_AiRoleId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DigitalSignature_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[34].Descriptor() +func (MessageContext_AiRoleId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[33].Descriptor() } -func (DigitalSignature_AlgorithmId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[34] +func (MessageContext_AiRoleId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[33] } -func (x DigitalSignature_AlgorithmId) Number() protoreflect.EnumNumber { +func (x MessageContext_AiRoleId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DigitalSignature_AlgorithmId.Descriptor instead. -func (DigitalSignature_AlgorithmId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{31, 0} +// Deprecated: Use MessageContext_AiRoleId.Descriptor instead. +func (MessageContext_AiRoleId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{65, 0} } -type DigitalSignature_StateId int32 +type NetworkEndpoint_NetworkScopeId int32 const ( - DigitalSignature_STATE_ID_UNKNOWN DigitalSignature_StateId = 0 - DigitalSignature_STATE_ID_VALID DigitalSignature_StateId = 1 - DigitalSignature_STATE_ID_EXPIRED DigitalSignature_StateId = 2 - DigitalSignature_STATE_ID_REVOKED DigitalSignature_StateId = 3 - DigitalSignature_STATE_ID_SUSPENDED DigitalSignature_StateId = 4 - DigitalSignature_STATE_ID_PENDING DigitalSignature_StateId = 5 - DigitalSignature_STATE_ID_UNTRUSTED DigitalSignature_StateId = 6 - DigitalSignature_STATE_ID_DISTRUSTED DigitalSignature_StateId = 7 - DigitalSignature_STATE_ID_WRONGUSAGE DigitalSignature_StateId = 8 - DigitalSignature_STATE_ID_BAD DigitalSignature_StateId = 9 - DigitalSignature_STATE_ID_BROKEN DigitalSignature_StateId = 10 - DigitalSignature_STATE_ID_OTHER DigitalSignature_StateId = 99 + NetworkEndpoint_NETWORK_SCOPE_ID_UNKNOWN NetworkEndpoint_NetworkScopeId = 0 + NetworkEndpoint_NETWORK_SCOPE_ID_INTERNAL NetworkEndpoint_NetworkScopeId = 1 + NetworkEndpoint_NETWORK_SCOPE_ID_EXTERNAL NetworkEndpoint_NetworkScopeId = 2 + NetworkEndpoint_NETWORK_SCOPE_ID_OTHER NetworkEndpoint_NetworkScopeId = 99 ) -// Enum value maps for DigitalSignature_StateId. +// Enum value maps for NetworkEndpoint_NetworkScopeId. var ( - DigitalSignature_StateId_name = map[int32]string{ - 0: "STATE_ID_UNKNOWN", - 1: "STATE_ID_VALID", - 2: "STATE_ID_EXPIRED", - 3: "STATE_ID_REVOKED", - 4: "STATE_ID_SUSPENDED", - 5: "STATE_ID_PENDING", - 6: "STATE_ID_UNTRUSTED", - 7: "STATE_ID_DISTRUSTED", - 8: "STATE_ID_WRONGUSAGE", - 9: "STATE_ID_BAD", - 10: "STATE_ID_BROKEN", - 99: "STATE_ID_OTHER", + NetworkEndpoint_NetworkScopeId_name = map[int32]string{ + 0: "NETWORK_SCOPE_ID_UNKNOWN", + 1: "NETWORK_SCOPE_ID_INTERNAL", + 2: "NETWORK_SCOPE_ID_EXTERNAL", + 99: "NETWORK_SCOPE_ID_OTHER", } - DigitalSignature_StateId_value = map[string]int32{ - "STATE_ID_UNKNOWN": 0, - "STATE_ID_VALID": 1, - "STATE_ID_EXPIRED": 2, - "STATE_ID_REVOKED": 3, - "STATE_ID_SUSPENDED": 4, - "STATE_ID_PENDING": 5, - "STATE_ID_UNTRUSTED": 6, - "STATE_ID_DISTRUSTED": 7, - "STATE_ID_WRONGUSAGE": 8, - "STATE_ID_BAD": 9, - "STATE_ID_BROKEN": 10, - "STATE_ID_OTHER": 99, + NetworkEndpoint_NetworkScopeId_value = map[string]int32{ + "NETWORK_SCOPE_ID_UNKNOWN": 0, + "NETWORK_SCOPE_ID_INTERNAL": 1, + "NETWORK_SCOPE_ID_EXTERNAL": 2, + "NETWORK_SCOPE_ID_OTHER": 99, } ) -func (x DigitalSignature_StateId) Enum() *DigitalSignature_StateId { - p := new(DigitalSignature_StateId) +func (x NetworkEndpoint_NetworkScopeId) Enum() *NetworkEndpoint_NetworkScopeId { + p := new(NetworkEndpoint_NetworkScopeId) *p = x return p } -func (x DigitalSignature_StateId) String() string { +func (x NetworkEndpoint_NetworkScopeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DigitalSignature_StateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[35].Descriptor() +func (NetworkEndpoint_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[34].Descriptor() } -func (DigitalSignature_StateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[35] +func (NetworkEndpoint_NetworkScopeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[34] } -func (x DigitalSignature_StateId) Number() protoreflect.EnumNumber { +func (x NetworkEndpoint_NetworkScopeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DigitalSignature_StateId.Descriptor instead. -func (DigitalSignature_StateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{31, 1} +// Deprecated: Use NetworkEndpoint_NetworkScopeId.Descriptor instead. +func (NetworkEndpoint_NetworkScopeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{69, 0} } -type DnsAnswer_FlagIds int32 +type NetworkEndpoint_TypeId int32 const ( - DnsAnswer_FLAG_IDS_UNKNOWN DnsAnswer_FlagIds = 0 - DnsAnswer_FLAG_IDS_AUTHORITATIVE_ANSWER DnsAnswer_FlagIds = 1 - DnsAnswer_FLAG_IDS_TRUNCATED_RESPONSE DnsAnswer_FlagIds = 2 - DnsAnswer_FLAG_IDS_RECURSION_DESIRED DnsAnswer_FlagIds = 3 - DnsAnswer_FLAG_IDS_RECURSION_AVAILABLE DnsAnswer_FlagIds = 4 - DnsAnswer_FLAG_IDS_AUTHENTIC_DATA DnsAnswer_FlagIds = 5 - DnsAnswer_FLAG_IDS_CHECKING_DISABLED DnsAnswer_FlagIds = 6 - DnsAnswer_FLAG_IDS_OTHER DnsAnswer_FlagIds = 99 + NetworkEndpoint_TYPE_ID_UNKNOWN NetworkEndpoint_TypeId = 0 + NetworkEndpoint_TYPE_ID_SERVER NetworkEndpoint_TypeId = 1 + NetworkEndpoint_TYPE_ID_DESKTOP NetworkEndpoint_TypeId = 2 + NetworkEndpoint_TYPE_ID_LAPTOP NetworkEndpoint_TypeId = 3 + NetworkEndpoint_TYPE_ID_TABLET NetworkEndpoint_TypeId = 4 + NetworkEndpoint_TYPE_ID_MOBILE NetworkEndpoint_TypeId = 5 + NetworkEndpoint_TYPE_ID_VIRTUAL NetworkEndpoint_TypeId = 6 + NetworkEndpoint_TYPE_ID_IOT NetworkEndpoint_TypeId = 7 + NetworkEndpoint_TYPE_ID_BROWSER NetworkEndpoint_TypeId = 8 + NetworkEndpoint_TYPE_ID_FIREWALL NetworkEndpoint_TypeId = 9 + NetworkEndpoint_TYPE_ID_SWITCH NetworkEndpoint_TypeId = 10 + NetworkEndpoint_TYPE_ID_HUB NetworkEndpoint_TypeId = 11 + NetworkEndpoint_TYPE_ID_ROUTER NetworkEndpoint_TypeId = 12 + NetworkEndpoint_TYPE_ID_IDS NetworkEndpoint_TypeId = 13 + NetworkEndpoint_TYPE_ID_IPS NetworkEndpoint_TypeId = 14 + NetworkEndpoint_TYPE_ID_LOAD_BALANCER NetworkEndpoint_TypeId = 15 + NetworkEndpoint_TYPE_ID_OTHER NetworkEndpoint_TypeId = 99 ) -// Enum value maps for DnsAnswer_FlagIds. +// Enum value maps for NetworkEndpoint_TypeId. var ( - DnsAnswer_FlagIds_name = map[int32]string{ - 0: "FLAG_IDS_UNKNOWN", - 1: "FLAG_IDS_AUTHORITATIVE_ANSWER", - 2: "FLAG_IDS_TRUNCATED_RESPONSE", - 3: "FLAG_IDS_RECURSION_DESIRED", - 4: "FLAG_IDS_RECURSION_AVAILABLE", - 5: "FLAG_IDS_AUTHENTIC_DATA", - 6: "FLAG_IDS_CHECKING_DISABLED", - 99: "FLAG_IDS_OTHER", + NetworkEndpoint_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", } - DnsAnswer_FlagIds_value = map[string]int32{ - "FLAG_IDS_UNKNOWN": 0, - "FLAG_IDS_AUTHORITATIVE_ANSWER": 1, - "FLAG_IDS_TRUNCATED_RESPONSE": 2, - "FLAG_IDS_RECURSION_DESIRED": 3, - "FLAG_IDS_RECURSION_AVAILABLE": 4, - "FLAG_IDS_AUTHENTIC_DATA": 5, - "FLAG_IDS_CHECKING_DISABLED": 6, - "FLAG_IDS_OTHER": 99, + NetworkEndpoint_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, } ) -func (x DnsAnswer_FlagIds) Enum() *DnsAnswer_FlagIds { - p := new(DnsAnswer_FlagIds) +func (x NetworkEndpoint_TypeId) Enum() *NetworkEndpoint_TypeId { + p := new(NetworkEndpoint_TypeId) *p = x return p } -func (x DnsAnswer_FlagIds) String() string { +func (x NetworkEndpoint_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DnsAnswer_FlagIds) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[36].Descriptor() +func (NetworkEndpoint_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[35].Descriptor() } -func (DnsAnswer_FlagIds) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[36] +func (NetworkEndpoint_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[35] } -func (x DnsAnswer_FlagIds) Number() protoreflect.EnumNumber { +func (x NetworkEndpoint_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DnsAnswer_FlagIds.Descriptor instead. -func (DnsAnswer_FlagIds) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{34, 0} +// Deprecated: Use NetworkEndpoint_TypeId.Descriptor instead. +func (NetworkEndpoint_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{69, 1} } -type DomainContact_TypeId int32 +type NetworkInterface_TypeId int32 const ( - DomainContact_TYPE_ID_UNKNOWN DomainContact_TypeId = 0 - DomainContact_TYPE_ID_REGISTRANT DomainContact_TypeId = 1 - DomainContact_TYPE_ID_ADMINISTRATIVE DomainContact_TypeId = 2 - DomainContact_TYPE_ID_TECHNICAL DomainContact_TypeId = 3 - DomainContact_TYPE_ID_BILLING DomainContact_TypeId = 4 - DomainContact_TYPE_ID_ABUSE DomainContact_TypeId = 5 - DomainContact_TYPE_ID_OTHER DomainContact_TypeId = 99 + NetworkInterface_TYPE_ID_UNKNOWN NetworkInterface_TypeId = 0 + NetworkInterface_TYPE_ID_WIRED NetworkInterface_TypeId = 1 + NetworkInterface_TYPE_ID_WIRELESS NetworkInterface_TypeId = 2 + NetworkInterface_TYPE_ID_MOBILE NetworkInterface_TypeId = 3 + NetworkInterface_TYPE_ID_TUNNEL NetworkInterface_TypeId = 4 + NetworkInterface_TYPE_ID_OTHER NetworkInterface_TypeId = 99 ) -// Enum value maps for DomainContact_TypeId. +// Enum value maps for NetworkInterface_TypeId. var ( - DomainContact_TypeId_name = map[int32]string{ + NetworkInterface_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_REGISTRANT", - 2: "TYPE_ID_ADMINISTRATIVE", - 3: "TYPE_ID_TECHNICAL", - 4: "TYPE_ID_BILLING", - 5: "TYPE_ID_ABUSE", + 1: "TYPE_ID_WIRED", + 2: "TYPE_ID_WIRELESS", + 3: "TYPE_ID_MOBILE", + 4: "TYPE_ID_TUNNEL", 99: "TYPE_ID_OTHER", } - DomainContact_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_REGISTRANT": 1, - "TYPE_ID_ADMINISTRATIVE": 2, - "TYPE_ID_TECHNICAL": 3, - "TYPE_ID_BILLING": 4, - "TYPE_ID_ABUSE": 5, - "TYPE_ID_OTHER": 99, + NetworkInterface_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_WIRED": 1, + "TYPE_ID_WIRELESS": 2, + "TYPE_ID_MOBILE": 3, + "TYPE_ID_TUNNEL": 4, + "TYPE_ID_OTHER": 99, } ) -func (x DomainContact_TypeId) Enum() *DomainContact_TypeId { - p := new(DomainContact_TypeId) +func (x NetworkInterface_TypeId) Enum() *NetworkInterface_TypeId { + p := new(NetworkInterface_TypeId) *p = x return p } -func (x DomainContact_TypeId) String() string { +func (x NetworkInterface_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (DomainContact_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[37].Descriptor() +func (NetworkInterface_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[36].Descriptor() } -func (DomainContact_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[37] +func (NetworkInterface_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[36] } -func (x DomainContact_TypeId) Number() protoreflect.EnumNumber { +func (x NetworkInterface_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use DomainContact_TypeId.Descriptor instead. -func (DomainContact_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{35, 0} +// Deprecated: Use NetworkInterface_TypeId.Descriptor instead. +func (NetworkInterface_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{70, 0} } -type EncryptionDetails_AlgorithmId int32 +type NetworkProxy_NetworkScopeId int32 const ( - EncryptionDetails_ALGORITHM_ID_UNKNOWN EncryptionDetails_AlgorithmId = 0 - EncryptionDetails_ALGORITHM_ID_DES EncryptionDetails_AlgorithmId = 1 - EncryptionDetails_ALGORITHM_ID_TRIPLEDES EncryptionDetails_AlgorithmId = 2 - EncryptionDetails_ALGORITHM_ID_AES EncryptionDetails_AlgorithmId = 3 - EncryptionDetails_ALGORITHM_ID_RSA EncryptionDetails_AlgorithmId = 4 - EncryptionDetails_ALGORITHM_ID_ECC EncryptionDetails_AlgorithmId = 5 - EncryptionDetails_ALGORITHM_ID_SM2 EncryptionDetails_AlgorithmId = 6 - EncryptionDetails_ALGORITHM_ID_OTHER EncryptionDetails_AlgorithmId = 99 + NetworkProxy_NETWORK_SCOPE_ID_UNKNOWN NetworkProxy_NetworkScopeId = 0 + NetworkProxy_NETWORK_SCOPE_ID_INTERNAL NetworkProxy_NetworkScopeId = 1 + NetworkProxy_NETWORK_SCOPE_ID_EXTERNAL NetworkProxy_NetworkScopeId = 2 + NetworkProxy_NETWORK_SCOPE_ID_OTHER NetworkProxy_NetworkScopeId = 99 ) -// Enum value maps for EncryptionDetails_AlgorithmId. +// Enum value maps for NetworkProxy_NetworkScopeId. var ( - EncryptionDetails_AlgorithmId_name = map[int32]string{ - 0: "ALGORITHM_ID_UNKNOWN", - 1: "ALGORITHM_ID_DES", - 2: "ALGORITHM_ID_TRIPLEDES", - 3: "ALGORITHM_ID_AES", - 4: "ALGORITHM_ID_RSA", - 5: "ALGORITHM_ID_ECC", - 6: "ALGORITHM_ID_SM2", - 99: "ALGORITHM_ID_OTHER", + NetworkProxy_NetworkScopeId_name = map[int32]string{ + 0: "NETWORK_SCOPE_ID_UNKNOWN", + 1: "NETWORK_SCOPE_ID_INTERNAL", + 2: "NETWORK_SCOPE_ID_EXTERNAL", + 99: "NETWORK_SCOPE_ID_OTHER", } - EncryptionDetails_AlgorithmId_value = map[string]int32{ - "ALGORITHM_ID_UNKNOWN": 0, - "ALGORITHM_ID_DES": 1, - "ALGORITHM_ID_TRIPLEDES": 2, - "ALGORITHM_ID_AES": 3, - "ALGORITHM_ID_RSA": 4, - "ALGORITHM_ID_ECC": 5, - "ALGORITHM_ID_SM2": 6, - "ALGORITHM_ID_OTHER": 99, + NetworkProxy_NetworkScopeId_value = map[string]int32{ + "NETWORK_SCOPE_ID_UNKNOWN": 0, + "NETWORK_SCOPE_ID_INTERNAL": 1, + "NETWORK_SCOPE_ID_EXTERNAL": 2, + "NETWORK_SCOPE_ID_OTHER": 99, } ) -func (x EncryptionDetails_AlgorithmId) Enum() *EncryptionDetails_AlgorithmId { - p := new(EncryptionDetails_AlgorithmId) +func (x NetworkProxy_NetworkScopeId) Enum() *NetworkProxy_NetworkScopeId { + p := new(NetworkProxy_NetworkScopeId) *p = x return p } -func (x EncryptionDetails_AlgorithmId) String() string { +func (x NetworkProxy_NetworkScopeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (EncryptionDetails_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[38].Descriptor() +func (NetworkProxy_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[37].Descriptor() } -func (EncryptionDetails_AlgorithmId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[38] +func (NetworkProxy_NetworkScopeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[37] } -func (x EncryptionDetails_AlgorithmId) Number() protoreflect.EnumNumber { +func (x NetworkProxy_NetworkScopeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use EncryptionDetails_AlgorithmId.Descriptor instead. -func (EncryptionDetails_AlgorithmId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{39, 0} +// Deprecated: Use NetworkProxy_NetworkScopeId.Descriptor instead. +func (NetworkProxy_NetworkScopeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{71, 0} } -type File_ConfidentialityId int32 +type NetworkProxy_TypeId int32 const ( - File_CONFIDENTIALITY_ID_UNKNOWN File_ConfidentialityId = 0 - File_CONFIDENTIALITY_ID_NOT_CONFIDENTIAL File_ConfidentialityId = 1 - File_CONFIDENTIALITY_ID_CONFIDENTIAL File_ConfidentialityId = 2 - File_CONFIDENTIALITY_ID_SECRET File_ConfidentialityId = 3 - File_CONFIDENTIALITY_ID_TOP_SECRET File_ConfidentialityId = 4 - File_CONFIDENTIALITY_ID_PRIVATE File_ConfidentialityId = 5 - File_CONFIDENTIALITY_ID_RESTRICTED File_ConfidentialityId = 6 - File_CONFIDENTIALITY_ID_OTHER File_ConfidentialityId = 99 -) - -// Enum value maps for File_ConfidentialityId. -var ( - File_ConfidentialityId_name = map[int32]string{ - 0: "CONFIDENTIALITY_ID_UNKNOWN", - 1: "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL", - 2: "CONFIDENTIALITY_ID_CONFIDENTIAL", - 3: "CONFIDENTIALITY_ID_SECRET", - 4: "CONFIDENTIALITY_ID_TOP_SECRET", - 5: "CONFIDENTIALITY_ID_PRIVATE", - 6: "CONFIDENTIALITY_ID_RESTRICTED", - 99: "CONFIDENTIALITY_ID_OTHER", - } - File_ConfidentialityId_value = map[string]int32{ - "CONFIDENTIALITY_ID_UNKNOWN": 0, - "CONFIDENTIALITY_ID_NOT_CONFIDENTIAL": 1, - "CONFIDENTIALITY_ID_CONFIDENTIAL": 2, - "CONFIDENTIALITY_ID_SECRET": 3, - "CONFIDENTIALITY_ID_TOP_SECRET": 4, - "CONFIDENTIALITY_ID_PRIVATE": 5, - "CONFIDENTIALITY_ID_RESTRICTED": 6, - "CONFIDENTIALITY_ID_OTHER": 99, - } -) - -func (x File_ConfidentialityId) Enum() *File_ConfidentialityId { - p := new(File_ConfidentialityId) - *p = x - return p -} - -func (x File_ConfidentialityId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (File_ConfidentialityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[39].Descriptor() -} - -func (File_ConfidentialityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[39] -} - -func (x File_ConfidentialityId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use File_ConfidentialityId.Descriptor instead. -func (File_ConfidentialityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{45, 0} -} - -type File_DriveTypeId int32 - -const ( - File_DRIVE_TYPE_ID_UNKNOWN File_DriveTypeId = 0 - File_DRIVE_TYPE_ID_REMOVABLE File_DriveTypeId = 1 - File_DRIVE_TYPE_ID_FIXED File_DriveTypeId = 2 - File_DRIVE_TYPE_ID_REMOTE File_DriveTypeId = 3 - File_DRIVE_TYPE_ID_CD_ROM File_DriveTypeId = 4 - File_DRIVE_TYPE_ID_RAM_DISK File_DriveTypeId = 5 - File_DRIVE_TYPE_ID_OTHER File_DriveTypeId = 99 + NetworkProxy_TYPE_ID_UNKNOWN NetworkProxy_TypeId = 0 + NetworkProxy_TYPE_ID_SERVER NetworkProxy_TypeId = 1 + NetworkProxy_TYPE_ID_DESKTOP NetworkProxy_TypeId = 2 + NetworkProxy_TYPE_ID_LAPTOP NetworkProxy_TypeId = 3 + NetworkProxy_TYPE_ID_TABLET NetworkProxy_TypeId = 4 + NetworkProxy_TYPE_ID_MOBILE NetworkProxy_TypeId = 5 + NetworkProxy_TYPE_ID_VIRTUAL NetworkProxy_TypeId = 6 + NetworkProxy_TYPE_ID_IOT NetworkProxy_TypeId = 7 + NetworkProxy_TYPE_ID_BROWSER NetworkProxy_TypeId = 8 + NetworkProxy_TYPE_ID_FIREWALL NetworkProxy_TypeId = 9 + NetworkProxy_TYPE_ID_SWITCH NetworkProxy_TypeId = 10 + NetworkProxy_TYPE_ID_HUB NetworkProxy_TypeId = 11 + NetworkProxy_TYPE_ID_ROUTER NetworkProxy_TypeId = 12 + NetworkProxy_TYPE_ID_IDS NetworkProxy_TypeId = 13 + NetworkProxy_TYPE_ID_IPS NetworkProxy_TypeId = 14 + NetworkProxy_TYPE_ID_LOAD_BALANCER NetworkProxy_TypeId = 15 + NetworkProxy_TYPE_ID_OTHER NetworkProxy_TypeId = 99 ) -// Enum value maps for File_DriveTypeId. +// Enum value maps for NetworkProxy_TypeId. var ( - File_DriveTypeId_name = map[int32]string{ - 0: "DRIVE_TYPE_ID_UNKNOWN", - 1: "DRIVE_TYPE_ID_REMOVABLE", - 2: "DRIVE_TYPE_ID_FIXED", - 3: "DRIVE_TYPE_ID_REMOTE", - 4: "DRIVE_TYPE_ID_CD_ROM", - 5: "DRIVE_TYPE_ID_RAM_DISK", - 99: "DRIVE_TYPE_ID_OTHER", + NetworkProxy_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_SERVER", + 2: "TYPE_ID_DESKTOP", + 3: "TYPE_ID_LAPTOP", + 4: "TYPE_ID_TABLET", + 5: "TYPE_ID_MOBILE", + 6: "TYPE_ID_VIRTUAL", + 7: "TYPE_ID_IOT", + 8: "TYPE_ID_BROWSER", + 9: "TYPE_ID_FIREWALL", + 10: "TYPE_ID_SWITCH", + 11: "TYPE_ID_HUB", + 12: "TYPE_ID_ROUTER", + 13: "TYPE_ID_IDS", + 14: "TYPE_ID_IPS", + 15: "TYPE_ID_LOAD_BALANCER", + 99: "TYPE_ID_OTHER", } - File_DriveTypeId_value = map[string]int32{ - "DRIVE_TYPE_ID_UNKNOWN": 0, - "DRIVE_TYPE_ID_REMOVABLE": 1, - "DRIVE_TYPE_ID_FIXED": 2, - "DRIVE_TYPE_ID_REMOTE": 3, - "DRIVE_TYPE_ID_CD_ROM": 4, - "DRIVE_TYPE_ID_RAM_DISK": 5, - "DRIVE_TYPE_ID_OTHER": 99, + NetworkProxy_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SERVER": 1, + "TYPE_ID_DESKTOP": 2, + "TYPE_ID_LAPTOP": 3, + "TYPE_ID_TABLET": 4, + "TYPE_ID_MOBILE": 5, + "TYPE_ID_VIRTUAL": 6, + "TYPE_ID_IOT": 7, + "TYPE_ID_BROWSER": 8, + "TYPE_ID_FIREWALL": 9, + "TYPE_ID_SWITCH": 10, + "TYPE_ID_HUB": 11, + "TYPE_ID_ROUTER": 12, + "TYPE_ID_IDS": 13, + "TYPE_ID_IPS": 14, + "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_OTHER": 99, } ) -func (x File_DriveTypeId) Enum() *File_DriveTypeId { - p := new(File_DriveTypeId) +func (x NetworkProxy_TypeId) Enum() *NetworkProxy_TypeId { + p := new(NetworkProxy_TypeId) *p = x return p } -func (x File_DriveTypeId) String() string { +func (x NetworkProxy_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (File_DriveTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[40].Descriptor() +func (NetworkProxy_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[38].Descriptor() } -func (File_DriveTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[40] +func (NetworkProxy_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[38] } -func (x File_DriveTypeId) Number() protoreflect.EnumNumber { +func (x NetworkProxy_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use File_DriveTypeId.Descriptor instead. -func (File_DriveTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{45, 1} +// Deprecated: Use NetworkProxy_TypeId.Descriptor instead. +func (NetworkProxy_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{71, 1} } -type File_TypeId int32 +type Observable_TypeId int32 const ( - File_TYPE_ID_UNKNOWN File_TypeId = 0 - File_TYPE_ID_REGULAR_FILE File_TypeId = 1 - File_TYPE_ID_FOLDER File_TypeId = 2 - File_TYPE_ID_CHARACTER_DEVICE File_TypeId = 3 - File_TYPE_ID_BLOCK_DEVICE File_TypeId = 4 - File_TYPE_ID_LOCAL_SOCKET File_TypeId = 5 - File_TYPE_ID_NAMED_PIPE File_TypeId = 6 - File_TYPE_ID_SYMBOLIC_LINK File_TypeId = 7 - File_TYPE_ID_EXECUTABLE_FILE File_TypeId = 8 - File_TYPE_ID_OTHER File_TypeId = 99 + Observable_TYPE_ID_UNKNOWN Observable_TypeId = 0 + Observable_TYPE_ID_HOSTNAME Observable_TypeId = 1 + Observable_TYPE_ID_IP_ADDRESS Observable_TypeId = 2 + Observable_TYPE_ID_MAC_ADDRESS Observable_TypeId = 3 + Observable_TYPE_ID_USER_NAME Observable_TypeId = 4 + Observable_TYPE_ID_EMAIL_ADDRESS Observable_TypeId = 5 + Observable_TYPE_ID_URL_STRING Observable_TypeId = 6 + Observable_TYPE_ID_FILE_NAME Observable_TypeId = 7 + Observable_TYPE_ID_HASH Observable_TypeId = 8 + Observable_TYPE_ID_PROCESS_NAME Observable_TypeId = 9 + Observable_TYPE_ID_RESOURCE_UID Observable_TypeId = 10 + Observable_TYPE_ID_PORT Observable_TypeId = 11 + Observable_TYPE_ID_SUBNET Observable_TypeId = 12 + Observable_TYPE_ID_COMMAND_LINE Observable_TypeId = 13 + Observable_TYPE_ID_COUNTRY Observable_TypeId = 14 + Observable_TYPE_ID_PROCESS_ID Observable_TypeId = 15 + Observable_TYPE_ID_HTTP_USER_AGENT Observable_TypeId = 16 + Observable_TYPE_ID_CWE_OBJECT_UID Observable_TypeId = 17 + Observable_TYPE_ID_CVE_OBJECT_UID Observable_TypeId = 18 + Observable_TYPE_ID_USER_CREDENTIAL_ID Observable_TypeId = 19 + Observable_TYPE_ID_ENDPOINT Observable_TypeId = 20 + Observable_TYPE_ID_USER Observable_TypeId = 21 + Observable_TYPE_ID_EMAIL Observable_TypeId = 22 + Observable_TYPE_ID_UNIFORM_RESOURCE_LOCATOR Observable_TypeId = 23 + Observable_TYPE_ID_FILE Observable_TypeId = 24 + Observable_TYPE_ID_PROCESS Observable_TypeId = 25 + Observable_TYPE_ID_GEO_LOCATION Observable_TypeId = 26 + Observable_TYPE_ID_CONTAINER Observable_TypeId = 27 + Observable_TYPE_ID_REGISTRY_KEY Observable_TypeId = 28 + Observable_TYPE_ID_REGISTRY_VALUE Observable_TypeId = 29 + Observable_TYPE_ID_FINGERPRINT Observable_TypeId = 30 + Observable_TYPE_ID_USER_OBJECT_UID Observable_TypeId = 31 + Observable_TYPE_ID_GROUP_OBJECT_NAME Observable_TypeId = 32 + Observable_TYPE_ID_GROUP_OBJECT_UID Observable_TypeId = 33 + Observable_TYPE_ID_ACCOUNT_OBJECT_NAME Observable_TypeId = 34 + Observable_TYPE_ID_ACCOUNT_OBJECT_UID Observable_TypeId = 35 + Observable_TYPE_ID_SCRIPT_CONTENT Observable_TypeId = 36 + Observable_TYPE_ID_SERIAL_NUMBER Observable_TypeId = 37 + Observable_TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME Observable_TypeId = 38 + Observable_TYPE_ID_PROCESS_ENTITY_OBJECT_UID Observable_TypeId = 39 + Observable_TYPE_ID_EMAIL_OBJECT_SUBJECT Observable_TypeId = 40 + Observable_TYPE_ID_EMAIL_OBJECT_UID Observable_TypeId = 41 + Observable_TYPE_ID_MESSAGE_UID Observable_TypeId = 42 + Observable_TYPE_ID_REGISTRY_VALUE_OBJECT_NAME Observable_TypeId = 43 + Observable_TYPE_ID_ADVISORY_OBJECT_UID Observable_TypeId = 44 + Observable_TYPE_ID_FILE_PATH Observable_TypeId = 45 + Observable_TYPE_ID_REGISTRY_KEY_PATH Observable_TypeId = 46 + Observable_TYPE_ID_DEVICE_OBJECT_UID Observable_TypeId = 47 + Observable_TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID Observable_TypeId = 48 + Observable_TYPE_ID_OTHER Observable_TypeId = 99 ) -// Enum value maps for File_TypeId. +// Enum value maps for Observable_TypeId. var ( - File_TypeId_name = map[int32]string{ + Observable_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_REGULAR_FILE", - 2: "TYPE_ID_FOLDER", - 3: "TYPE_ID_CHARACTER_DEVICE", - 4: "TYPE_ID_BLOCK_DEVICE", - 5: "TYPE_ID_LOCAL_SOCKET", - 6: "TYPE_ID_NAMED_PIPE", - 7: "TYPE_ID_SYMBOLIC_LINK", - 8: "TYPE_ID_EXECUTABLE_FILE", - 99: "TYPE_ID_OTHER", - } - File_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_REGULAR_FILE": 1, - "TYPE_ID_FOLDER": 2, - "TYPE_ID_CHARACTER_DEVICE": 3, - "TYPE_ID_BLOCK_DEVICE": 4, - "TYPE_ID_LOCAL_SOCKET": 5, - "TYPE_ID_NAMED_PIPE": 6, - "TYPE_ID_SYMBOLIC_LINK": 7, - "TYPE_ID_EXECUTABLE_FILE": 8, - "TYPE_ID_OTHER": 99, - } -) - -func (x File_TypeId) Enum() *File_TypeId { - p := new(File_TypeId) - *p = x - return p -} - -func (x File_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (File_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[41].Descriptor() -} - -func (File_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[41] -} - -func (x File_TypeId) Number() protoreflect.EnumNumber { + 1: "TYPE_ID_HOSTNAME", + 2: "TYPE_ID_IP_ADDRESS", + 3: "TYPE_ID_MAC_ADDRESS", + 4: "TYPE_ID_USER_NAME", + 5: "TYPE_ID_EMAIL_ADDRESS", + 6: "TYPE_ID_URL_STRING", + 7: "TYPE_ID_FILE_NAME", + 8: "TYPE_ID_HASH", + 9: "TYPE_ID_PROCESS_NAME", + 10: "TYPE_ID_RESOURCE_UID", + 11: "TYPE_ID_PORT", + 12: "TYPE_ID_SUBNET", + 13: "TYPE_ID_COMMAND_LINE", + 14: "TYPE_ID_COUNTRY", + 15: "TYPE_ID_PROCESS_ID", + 16: "TYPE_ID_HTTP_USER_AGENT", + 17: "TYPE_ID_CWE_OBJECT_UID", + 18: "TYPE_ID_CVE_OBJECT_UID", + 19: "TYPE_ID_USER_CREDENTIAL_ID", + 20: "TYPE_ID_ENDPOINT", + 21: "TYPE_ID_USER", + 22: "TYPE_ID_EMAIL", + 23: "TYPE_ID_UNIFORM_RESOURCE_LOCATOR", + 24: "TYPE_ID_FILE", + 25: "TYPE_ID_PROCESS", + 26: "TYPE_ID_GEO_LOCATION", + 27: "TYPE_ID_CONTAINER", + 28: "TYPE_ID_REGISTRY_KEY", + 29: "TYPE_ID_REGISTRY_VALUE", + 30: "TYPE_ID_FINGERPRINT", + 31: "TYPE_ID_USER_OBJECT_UID", + 32: "TYPE_ID_GROUP_OBJECT_NAME", + 33: "TYPE_ID_GROUP_OBJECT_UID", + 34: "TYPE_ID_ACCOUNT_OBJECT_NAME", + 35: "TYPE_ID_ACCOUNT_OBJECT_UID", + 36: "TYPE_ID_SCRIPT_CONTENT", + 37: "TYPE_ID_SERIAL_NUMBER", + 38: "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME", + 39: "TYPE_ID_PROCESS_ENTITY_OBJECT_UID", + 40: "TYPE_ID_EMAIL_OBJECT_SUBJECT", + 41: "TYPE_ID_EMAIL_OBJECT_UID", + 42: "TYPE_ID_MESSAGE_UID", + 43: "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME", + 44: "TYPE_ID_ADVISORY_OBJECT_UID", + 45: "TYPE_ID_FILE_PATH", + 46: "TYPE_ID_REGISTRY_KEY_PATH", + 47: "TYPE_ID_DEVICE_OBJECT_UID", + 48: "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID", + 99: "TYPE_ID_OTHER", + } + Observable_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_HOSTNAME": 1, + "TYPE_ID_IP_ADDRESS": 2, + "TYPE_ID_MAC_ADDRESS": 3, + "TYPE_ID_USER_NAME": 4, + "TYPE_ID_EMAIL_ADDRESS": 5, + "TYPE_ID_URL_STRING": 6, + "TYPE_ID_FILE_NAME": 7, + "TYPE_ID_HASH": 8, + "TYPE_ID_PROCESS_NAME": 9, + "TYPE_ID_RESOURCE_UID": 10, + "TYPE_ID_PORT": 11, + "TYPE_ID_SUBNET": 12, + "TYPE_ID_COMMAND_LINE": 13, + "TYPE_ID_COUNTRY": 14, + "TYPE_ID_PROCESS_ID": 15, + "TYPE_ID_HTTP_USER_AGENT": 16, + "TYPE_ID_CWE_OBJECT_UID": 17, + "TYPE_ID_CVE_OBJECT_UID": 18, + "TYPE_ID_USER_CREDENTIAL_ID": 19, + "TYPE_ID_ENDPOINT": 20, + "TYPE_ID_USER": 21, + "TYPE_ID_EMAIL": 22, + "TYPE_ID_UNIFORM_RESOURCE_LOCATOR": 23, + "TYPE_ID_FILE": 24, + "TYPE_ID_PROCESS": 25, + "TYPE_ID_GEO_LOCATION": 26, + "TYPE_ID_CONTAINER": 27, + "TYPE_ID_REGISTRY_KEY": 28, + "TYPE_ID_REGISTRY_VALUE": 29, + "TYPE_ID_FINGERPRINT": 30, + "TYPE_ID_USER_OBJECT_UID": 31, + "TYPE_ID_GROUP_OBJECT_NAME": 32, + "TYPE_ID_GROUP_OBJECT_UID": 33, + "TYPE_ID_ACCOUNT_OBJECT_NAME": 34, + "TYPE_ID_ACCOUNT_OBJECT_UID": 35, + "TYPE_ID_SCRIPT_CONTENT": 36, + "TYPE_ID_SERIAL_NUMBER": 37, + "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME": 38, + "TYPE_ID_PROCESS_ENTITY_OBJECT_UID": 39, + "TYPE_ID_EMAIL_OBJECT_SUBJECT": 40, + "TYPE_ID_EMAIL_OBJECT_UID": 41, + "TYPE_ID_MESSAGE_UID": 42, + "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME": 43, + "TYPE_ID_ADVISORY_OBJECT_UID": 44, + "TYPE_ID_FILE_PATH": 45, + "TYPE_ID_REGISTRY_KEY_PATH": 46, + "TYPE_ID_DEVICE_OBJECT_UID": 47, + "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID": 48, + "TYPE_ID_OTHER": 99, + } +) + +func (x Observable_TypeId) Enum() *Observable_TypeId { + p := new(Observable_TypeId) + *p = x + return p +} + +func (x Observable_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Observable_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[39].Descriptor() +} + +func (Observable_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[39] +} + +func (x Observable_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use File_TypeId.Descriptor instead. -func (File_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{45, 2} +// Deprecated: Use Observable_TypeId.Descriptor instead. +func (Observable_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{73, 0} } -type Fingerprint_AlgorithmId int32 +type Os_TypeId int32 const ( - Fingerprint_ALGORITHM_ID_UNKNOWN Fingerprint_AlgorithmId = 0 - Fingerprint_ALGORITHM_ID_MD5 Fingerprint_AlgorithmId = 1 - Fingerprint_ALGORITHM_ID_SHA_1 Fingerprint_AlgorithmId = 2 - Fingerprint_ALGORITHM_ID_SHA_256 Fingerprint_AlgorithmId = 3 - Fingerprint_ALGORITHM_ID_SHA_512 Fingerprint_AlgorithmId = 4 - Fingerprint_ALGORITHM_ID_CTPH Fingerprint_AlgorithmId = 5 - Fingerprint_ALGORITHM_ID_TLSH Fingerprint_AlgorithmId = 6 - Fingerprint_ALGORITHM_ID_QUICKXORHASH Fingerprint_AlgorithmId = 7 - Fingerprint_ALGORITHM_ID_SHA_224 Fingerprint_AlgorithmId = 8 - Fingerprint_ALGORITHM_ID_SHA_384 Fingerprint_AlgorithmId = 9 - Fingerprint_ALGORITHM_ID_SHA_512_224 Fingerprint_AlgorithmId = 10 - Fingerprint_ALGORITHM_ID_SHA_512_256 Fingerprint_AlgorithmId = 11 - Fingerprint_ALGORITHM_ID_SHA3_224 Fingerprint_AlgorithmId = 12 - Fingerprint_ALGORITHM_ID_SHA3_256 Fingerprint_AlgorithmId = 13 - Fingerprint_ALGORITHM_ID_SHA3_384 Fingerprint_AlgorithmId = 14 - Fingerprint_ALGORITHM_ID_SHA3_512 Fingerprint_AlgorithmId = 15 - Fingerprint_ALGORITHM_ID_XXHASH_H3_64_BIT Fingerprint_AlgorithmId = 16 - Fingerprint_ALGORITHM_ID_XXHASH_H3_128_BIT Fingerprint_AlgorithmId = 17 - Fingerprint_ALGORITHM_ID_IMPHASH Fingerprint_AlgorithmId = 18 - Fingerprint_ALGORITHM_ID_NPF Fingerprint_AlgorithmId = 19 - Fingerprint_ALGORITHM_ID_HASSH Fingerprint_AlgorithmId = 20 - Fingerprint_ALGORITHM_ID_OTHER Fingerprint_AlgorithmId = 99 + Os_TYPE_ID_UNKNOWN Os_TypeId = 0 + Os_TYPE_ID_OTHER Os_TypeId = 99 + Os_TYPE_ID_WINDOWS Os_TypeId = 100 + Os_TYPE_ID_WINDOWS_MOBILE Os_TypeId = 101 + Os_TYPE_ID_LINUX Os_TypeId = 200 + Os_TYPE_ID_ANDROID Os_TypeId = 201 + Os_TYPE_ID_MACOS Os_TypeId = 300 + Os_TYPE_ID_IOS Os_TypeId = 301 + Os_TYPE_ID_IPADOS Os_TypeId = 302 + Os_TYPE_ID_SOLARIS Os_TypeId = 400 + Os_TYPE_ID_AIX Os_TypeId = 401 + Os_TYPE_ID_HP_UX Os_TypeId = 402 ) -// Enum value maps for Fingerprint_AlgorithmId. +// Enum value maps for Os_TypeId. var ( - Fingerprint_AlgorithmId_name = map[int32]string{ - 0: "ALGORITHM_ID_UNKNOWN", - 1: "ALGORITHM_ID_MD5", - 2: "ALGORITHM_ID_SHA_1", - 3: "ALGORITHM_ID_SHA_256", - 4: "ALGORITHM_ID_SHA_512", - 5: "ALGORITHM_ID_CTPH", - 6: "ALGORITHM_ID_TLSH", - 7: "ALGORITHM_ID_QUICKXORHASH", - 8: "ALGORITHM_ID_SHA_224", - 9: "ALGORITHM_ID_SHA_384", - 10: "ALGORITHM_ID_SHA_512_224", - 11: "ALGORITHM_ID_SHA_512_256", - 12: "ALGORITHM_ID_SHA3_224", - 13: "ALGORITHM_ID_SHA3_256", - 14: "ALGORITHM_ID_SHA3_384", - 15: "ALGORITHM_ID_SHA3_512", - 16: "ALGORITHM_ID_XXHASH_H3_64_BIT", - 17: "ALGORITHM_ID_XXHASH_H3_128_BIT", - 18: "ALGORITHM_ID_IMPHASH", - 19: "ALGORITHM_ID_NPF", - 20: "ALGORITHM_ID_HASSH", - 99: "ALGORITHM_ID_OTHER", + Os_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 99: "TYPE_ID_OTHER", + 100: "TYPE_ID_WINDOWS", + 101: "TYPE_ID_WINDOWS_MOBILE", + 200: "TYPE_ID_LINUX", + 201: "TYPE_ID_ANDROID", + 300: "TYPE_ID_MACOS", + 301: "TYPE_ID_IOS", + 302: "TYPE_ID_IPADOS", + 400: "TYPE_ID_SOLARIS", + 401: "TYPE_ID_AIX", + 402: "TYPE_ID_HP_UX", } - Fingerprint_AlgorithmId_value = map[string]int32{ - "ALGORITHM_ID_UNKNOWN": 0, - "ALGORITHM_ID_MD5": 1, - "ALGORITHM_ID_SHA_1": 2, - "ALGORITHM_ID_SHA_256": 3, - "ALGORITHM_ID_SHA_512": 4, - "ALGORITHM_ID_CTPH": 5, - "ALGORITHM_ID_TLSH": 6, - "ALGORITHM_ID_QUICKXORHASH": 7, - "ALGORITHM_ID_SHA_224": 8, - "ALGORITHM_ID_SHA_384": 9, - "ALGORITHM_ID_SHA_512_224": 10, - "ALGORITHM_ID_SHA_512_256": 11, - "ALGORITHM_ID_SHA3_224": 12, - "ALGORITHM_ID_SHA3_256": 13, - "ALGORITHM_ID_SHA3_384": 14, - "ALGORITHM_ID_SHA3_512": 15, - "ALGORITHM_ID_XXHASH_H3_64_BIT": 16, - "ALGORITHM_ID_XXHASH_H3_128_BIT": 17, - "ALGORITHM_ID_IMPHASH": 18, - "ALGORITHM_ID_NPF": 19, - "ALGORITHM_ID_HASSH": 20, - "ALGORITHM_ID_OTHER": 99, + Os_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_OTHER": 99, + "TYPE_ID_WINDOWS": 100, + "TYPE_ID_WINDOWS_MOBILE": 101, + "TYPE_ID_LINUX": 200, + "TYPE_ID_ANDROID": 201, + "TYPE_ID_MACOS": 300, + "TYPE_ID_IOS": 301, + "TYPE_ID_IPADOS": 302, + "TYPE_ID_SOLARIS": 400, + "TYPE_ID_AIX": 401, + "TYPE_ID_HP_UX": 402, } ) -func (x Fingerprint_AlgorithmId) Enum() *Fingerprint_AlgorithmId { - p := new(Fingerprint_AlgorithmId) +func (x Os_TypeId) Enum() *Os_TypeId { + p := new(Os_TypeId) *p = x return p } -func (x Fingerprint_AlgorithmId) String() string { +func (x Os_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Fingerprint_AlgorithmId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[42].Descriptor() +func (Os_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[40].Descriptor() } -func (Fingerprint_AlgorithmId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[42] +func (Os_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[40] } -func (x Fingerprint_AlgorithmId) Number() protoreflect.EnumNumber { +func (x Os_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Fingerprint_AlgorithmId.Descriptor instead. -func (Fingerprint_AlgorithmId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{46, 0} +// Deprecated: Use Os_TypeId.Descriptor instead. +func (Os_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{76, 0} } -type GpuInfo_BusTypeId int32 +type Osint_ConfidenceId int32 const ( - GpuInfo_BUS_TYPE_ID_UNKNOWN GpuInfo_BusTypeId = 0 - GpuInfo_BUS_TYPE_ID_ONBOARD GpuInfo_BusTypeId = 1 - GpuInfo_BUS_TYPE_ID_PCIE_X16 GpuInfo_BusTypeId = 2 - GpuInfo_BUS_TYPE_ID_PCIE_X8 GpuInfo_BusTypeId = 3 - GpuInfo_BUS_TYPE_ID_MXM_TYPE_A GpuInfo_BusTypeId = 4 - GpuInfo_BUS_TYPE_ID_MXM_TYPE_B GpuInfo_BusTypeId = 5 - GpuInfo_BUS_TYPE_ID_M_2 GpuInfo_BusTypeId = 6 - GpuInfo_BUS_TYPE_ID_CXL GpuInfo_BusTypeId = 7 - GpuInfo_BUS_TYPE_ID_OTHER GpuInfo_BusTypeId = 99 + Osint_CONFIDENCE_ID_UNKNOWN Osint_ConfidenceId = 0 + Osint_CONFIDENCE_ID_LOW Osint_ConfidenceId = 1 + Osint_CONFIDENCE_ID_MEDIUM Osint_ConfidenceId = 2 + Osint_CONFIDENCE_ID_HIGH Osint_ConfidenceId = 3 + Osint_CONFIDENCE_ID_OTHER Osint_ConfidenceId = 99 ) -// Enum value maps for GpuInfo_BusTypeId. +// Enum value maps for Osint_ConfidenceId. var ( - GpuInfo_BusTypeId_name = map[int32]string{ - 0: "BUS_TYPE_ID_UNKNOWN", - 1: "BUS_TYPE_ID_ONBOARD", - 2: "BUS_TYPE_ID_PCIE_X16", - 3: "BUS_TYPE_ID_PCIE_X8", - 4: "BUS_TYPE_ID_MXM_TYPE_A", - 5: "BUS_TYPE_ID_MXM_TYPE_B", - 6: "BUS_TYPE_ID_M_2", - 7: "BUS_TYPE_ID_CXL", - 99: "BUS_TYPE_ID_OTHER", + Osint_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", } - GpuInfo_BusTypeId_value = map[string]int32{ - "BUS_TYPE_ID_UNKNOWN": 0, - "BUS_TYPE_ID_ONBOARD": 1, - "BUS_TYPE_ID_PCIE_X16": 2, - "BUS_TYPE_ID_PCIE_X8": 3, - "BUS_TYPE_ID_MXM_TYPE_A": 4, - "BUS_TYPE_ID_MXM_TYPE_B": 5, - "BUS_TYPE_ID_M_2": 6, - "BUS_TYPE_ID_CXL": 7, - "BUS_TYPE_ID_OTHER": 99, + Osint_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, } ) -func (x GpuInfo_BusTypeId) Enum() *GpuInfo_BusTypeId { - p := new(GpuInfo_BusTypeId) +func (x Osint_ConfidenceId) Enum() *Osint_ConfidenceId { + p := new(Osint_ConfidenceId) *p = x return p } -func (x GpuInfo_BusTypeId) String() string { +func (x Osint_ConfidenceId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (GpuInfo_BusTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[43].Descriptor() +func (Osint_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[41].Descriptor() } -func (GpuInfo_BusTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[43] +func (Osint_ConfidenceId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[41] } -func (x GpuInfo_BusTypeId) Number() protoreflect.EnumNumber { +func (x Osint_ConfidenceId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use GpuInfo_BusTypeId.Descriptor instead. -func (GpuInfo_BusTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{48, 0} +// Deprecated: Use Osint_ConfidenceId.Descriptor instead. +func (Osint_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{77, 0} } -type GpuInfo_VramModeId int32 +type Osint_DetectionPatternTypeId int32 const ( - GpuInfo_VRAM_MODE_ID_UNKNOWN GpuInfo_VramModeId = 0 - GpuInfo_VRAM_MODE_ID_SHARED GpuInfo_VramModeId = 1 - GpuInfo_VRAM_MODE_ID_DEDICATED GpuInfo_VramModeId = 2 - GpuInfo_VRAM_MODE_ID_OTHER GpuInfo_VramModeId = 99 + Osint_DETECTION_PATTERN_TYPE_ID_UNKNOWN Osint_DetectionPatternTypeId = 0 + Osint_DETECTION_PATTERN_TYPE_ID_STIX Osint_DetectionPatternTypeId = 1 + Osint_DETECTION_PATTERN_TYPE_ID_PCRE Osint_DetectionPatternTypeId = 2 + Osint_DETECTION_PATTERN_TYPE_ID_SIGMA Osint_DetectionPatternTypeId = 3 + Osint_DETECTION_PATTERN_TYPE_ID_SNORT Osint_DetectionPatternTypeId = 4 + Osint_DETECTION_PATTERN_TYPE_ID_SURICATA Osint_DetectionPatternTypeId = 5 + Osint_DETECTION_PATTERN_TYPE_ID_YARA Osint_DetectionPatternTypeId = 6 + Osint_DETECTION_PATTERN_TYPE_ID_OTHER Osint_DetectionPatternTypeId = 99 ) -// Enum value maps for GpuInfo_VramModeId. +// Enum value maps for Osint_DetectionPatternTypeId. var ( - GpuInfo_VramModeId_name = map[int32]string{ - 0: "VRAM_MODE_ID_UNKNOWN", - 1: "VRAM_MODE_ID_SHARED", - 2: "VRAM_MODE_ID_DEDICATED", - 99: "VRAM_MODE_ID_OTHER", + Osint_DetectionPatternTypeId_name = map[int32]string{ + 0: "DETECTION_PATTERN_TYPE_ID_UNKNOWN", + 1: "DETECTION_PATTERN_TYPE_ID_STIX", + 2: "DETECTION_PATTERN_TYPE_ID_PCRE", + 3: "DETECTION_PATTERN_TYPE_ID_SIGMA", + 4: "DETECTION_PATTERN_TYPE_ID_SNORT", + 5: "DETECTION_PATTERN_TYPE_ID_SURICATA", + 6: "DETECTION_PATTERN_TYPE_ID_YARA", + 99: "DETECTION_PATTERN_TYPE_ID_OTHER", } - GpuInfo_VramModeId_value = map[string]int32{ - "VRAM_MODE_ID_UNKNOWN": 0, - "VRAM_MODE_ID_SHARED": 1, - "VRAM_MODE_ID_DEDICATED": 2, - "VRAM_MODE_ID_OTHER": 99, + Osint_DetectionPatternTypeId_value = map[string]int32{ + "DETECTION_PATTERN_TYPE_ID_UNKNOWN": 0, + "DETECTION_PATTERN_TYPE_ID_STIX": 1, + "DETECTION_PATTERN_TYPE_ID_PCRE": 2, + "DETECTION_PATTERN_TYPE_ID_SIGMA": 3, + "DETECTION_PATTERN_TYPE_ID_SNORT": 4, + "DETECTION_PATTERN_TYPE_ID_SURICATA": 5, + "DETECTION_PATTERN_TYPE_ID_YARA": 6, + "DETECTION_PATTERN_TYPE_ID_OTHER": 99, } ) -func (x GpuInfo_VramModeId) Enum() *GpuInfo_VramModeId { - p := new(GpuInfo_VramModeId) +func (x Osint_DetectionPatternTypeId) Enum() *Osint_DetectionPatternTypeId { + p := new(Osint_DetectionPatternTypeId) *p = x return p } -func (x GpuInfo_VramModeId) String() string { +func (x Osint_DetectionPatternTypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (GpuInfo_VramModeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[44].Descriptor() +func (Osint_DetectionPatternTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[42].Descriptor() } -func (GpuInfo_VramModeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[44] +func (Osint_DetectionPatternTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[42] } -func (x GpuInfo_VramModeId) Number() protoreflect.EnumNumber { +func (x Osint_DetectionPatternTypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use GpuInfo_VramModeId.Descriptor instead. -func (GpuInfo_VramModeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{48, 1} +// Deprecated: Use Osint_DetectionPatternTypeId.Descriptor instead. +func (Osint_DetectionPatternTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{77, 1} } -type Graph_QueryLanguageId int32 +type Osint_SeverityId int32 const ( - Graph_QUERY_LANGUAGE_ID_UNKNOWN Graph_QueryLanguageId = 0 - Graph_QUERY_LANGUAGE_ID_CYPHER Graph_QueryLanguageId = 1 - Graph_QUERY_LANGUAGE_ID_GRAPHQL Graph_QueryLanguageId = 2 - Graph_QUERY_LANGUAGE_ID_GREMLIN Graph_QueryLanguageId = 3 - Graph_QUERY_LANGUAGE_ID_GQL Graph_QueryLanguageId = 4 - Graph_QUERY_LANGUAGE_ID_G_CORE Graph_QueryLanguageId = 5 - Graph_QUERY_LANGUAGE_ID_PGQL Graph_QueryLanguageId = 6 - Graph_QUERY_LANGUAGE_ID_SPARQL Graph_QueryLanguageId = 7 - Graph_QUERY_LANGUAGE_ID_OTHER Graph_QueryLanguageId = 99 + Osint_SEVERITY_ID_UNKNOWN Osint_SeverityId = 0 + Osint_SEVERITY_ID_INFORMATIONAL Osint_SeverityId = 1 + Osint_SEVERITY_ID_LOW Osint_SeverityId = 2 + Osint_SEVERITY_ID_MEDIUM Osint_SeverityId = 3 + Osint_SEVERITY_ID_HIGH Osint_SeverityId = 4 + Osint_SEVERITY_ID_CRITICAL Osint_SeverityId = 5 + Osint_SEVERITY_ID_FATAL Osint_SeverityId = 6 + Osint_SEVERITY_ID_OTHER Osint_SeverityId = 99 ) -// Enum value maps for Graph_QueryLanguageId. +// Enum value maps for Osint_SeverityId. var ( - Graph_QueryLanguageId_name = map[int32]string{ - 0: "QUERY_LANGUAGE_ID_UNKNOWN", - 1: "QUERY_LANGUAGE_ID_CYPHER", - 2: "QUERY_LANGUAGE_ID_GRAPHQL", - 3: "QUERY_LANGUAGE_ID_GREMLIN", - 4: "QUERY_LANGUAGE_ID_GQL", - 5: "QUERY_LANGUAGE_ID_G_CORE", - 6: "QUERY_LANGUAGE_ID_PGQL", - 7: "QUERY_LANGUAGE_ID_SPARQL", - 99: "QUERY_LANGUAGE_ID_OTHER", + Osint_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", } - Graph_QueryLanguageId_value = map[string]int32{ - "QUERY_LANGUAGE_ID_UNKNOWN": 0, - "QUERY_LANGUAGE_ID_CYPHER": 1, - "QUERY_LANGUAGE_ID_GRAPHQL": 2, - "QUERY_LANGUAGE_ID_GREMLIN": 3, - "QUERY_LANGUAGE_ID_GQL": 4, - "QUERY_LANGUAGE_ID_G_CORE": 5, - "QUERY_LANGUAGE_ID_PGQL": 6, - "QUERY_LANGUAGE_ID_SPARQL": 7, - "QUERY_LANGUAGE_ID_OTHER": 99, + Osint_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, } ) -func (x Graph_QueryLanguageId) Enum() *Graph_QueryLanguageId { - p := new(Graph_QueryLanguageId) +func (x Osint_SeverityId) Enum() *Osint_SeverityId { + p := new(Osint_SeverityId) *p = x return p } -func (x Graph_QueryLanguageId) String() string { +func (x Osint_SeverityId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Graph_QueryLanguageId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[45].Descriptor() +func (Osint_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[43].Descriptor() } -func (Graph_QueryLanguageId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[45] +func (Osint_SeverityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[43] } -func (x Graph_QueryLanguageId) Number() protoreflect.EnumNumber { +func (x Osint_SeverityId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Graph_QueryLanguageId.Descriptor instead. -func (Graph_QueryLanguageId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{49, 0} +// Deprecated: Use Osint_SeverityId.Descriptor instead. +func (Osint_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{77, 2} } -type Idp_StateId int32 +type Osint_TypeId int32 const ( - Idp_STATE_ID_UNKNOWN Idp_StateId = 0 - Idp_STATE_ID_ACTIVE Idp_StateId = 1 - Idp_STATE_ID_SUSPENDED Idp_StateId = 2 - Idp_STATE_ID_DEPRECATED Idp_StateId = 3 - Idp_STATE_ID_DELETED Idp_StateId = 4 - Idp_STATE_ID_OTHER Idp_StateId = 99 + Osint_TYPE_ID_UNKNOWN Osint_TypeId = 0 + Osint_TYPE_ID_IP_ADDRESS Osint_TypeId = 1 + Osint_TYPE_ID_DOMAIN Osint_TypeId = 2 + Osint_TYPE_ID_HOSTNAME Osint_TypeId = 3 + Osint_TYPE_ID_HASH Osint_TypeId = 4 + Osint_TYPE_ID_URL Osint_TypeId = 5 + Osint_TYPE_ID_USER_AGENT Osint_TypeId = 6 + Osint_TYPE_ID_DIGITAL_CERTIFICATE Osint_TypeId = 7 + Osint_TYPE_ID_EMAIL Osint_TypeId = 8 + Osint_TYPE_ID_EMAIL_ADDRESS Osint_TypeId = 9 + Osint_TYPE_ID_VULNERABILITY Osint_TypeId = 10 + Osint_TYPE_ID_FILE Osint_TypeId = 11 + Osint_TYPE_ID_REGISTRY_KEY Osint_TypeId = 12 + Osint_TYPE_ID_REGISTRY_VALUE Osint_TypeId = 13 + Osint_TYPE_ID_COMMAND_LINE Osint_TypeId = 14 + Osint_TYPE_ID_OTHER Osint_TypeId = 99 ) -// Enum value maps for Idp_StateId. +// Enum value maps for Osint_TypeId. var ( - Idp_StateId_name = map[int32]string{ - 0: "STATE_ID_UNKNOWN", - 1: "STATE_ID_ACTIVE", - 2: "STATE_ID_SUSPENDED", - 3: "STATE_ID_DEPRECATED", - 4: "STATE_ID_DELETED", - 99: "STATE_ID_OTHER", - } - Idp_StateId_value = map[string]int32{ - "STATE_ID_UNKNOWN": 0, - "STATE_ID_ACTIVE": 1, - "STATE_ID_SUSPENDED": 2, - "STATE_ID_DEPRECATED": 3, - "STATE_ID_DELETED": 4, - "STATE_ID_OTHER": 99, + Osint_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_IP_ADDRESS", + 2: "TYPE_ID_DOMAIN", + 3: "TYPE_ID_HOSTNAME", + 4: "TYPE_ID_HASH", + 5: "TYPE_ID_URL", + 6: "TYPE_ID_USER_AGENT", + 7: "TYPE_ID_DIGITAL_CERTIFICATE", + 8: "TYPE_ID_EMAIL", + 9: "TYPE_ID_EMAIL_ADDRESS", + 10: "TYPE_ID_VULNERABILITY", + 11: "TYPE_ID_FILE", + 12: "TYPE_ID_REGISTRY_KEY", + 13: "TYPE_ID_REGISTRY_VALUE", + 14: "TYPE_ID_COMMAND_LINE", + 99: "TYPE_ID_OTHER", } -) - -func (x Idp_StateId) Enum() *Idp_StateId { - p := new(Idp_StateId) + Osint_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_IP_ADDRESS": 1, + "TYPE_ID_DOMAIN": 2, + "TYPE_ID_HOSTNAME": 3, + "TYPE_ID_HASH": 4, + "TYPE_ID_URL": 5, + "TYPE_ID_USER_AGENT": 6, + "TYPE_ID_DIGITAL_CERTIFICATE": 7, + "TYPE_ID_EMAIL": 8, + "TYPE_ID_EMAIL_ADDRESS": 9, + "TYPE_ID_VULNERABILITY": 10, + "TYPE_ID_FILE": 11, + "TYPE_ID_REGISTRY_KEY": 12, + "TYPE_ID_REGISTRY_VALUE": 13, + "TYPE_ID_COMMAND_LINE": 14, + "TYPE_ID_OTHER": 99, + } +) + +func (x Osint_TypeId) Enum() *Osint_TypeId { + p := new(Osint_TypeId) *p = x return p } -func (x Idp_StateId) String() string { +func (x Osint_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Idp_StateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[46].Descriptor() +func (Osint_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[44].Descriptor() } -func (Idp_StateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[46] +func (Osint_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[44] } -func (x Idp_StateId) Number() protoreflect.EnumNumber { +func (x Osint_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Idp_StateId.Descriptor instead. -func (Idp_StateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{54, 0} +// Deprecated: Use Osint_TypeId.Descriptor instead. +func (Osint_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{77, 3} } -type KbArticle_InstallStateId int32 +type Package_TypeId int32 const ( - KbArticle_INSTALL_STATE_ID_UNKNOWN KbArticle_InstallStateId = 0 - KbArticle_INSTALL_STATE_ID_INSTALLED KbArticle_InstallStateId = 1 - KbArticle_INSTALL_STATE_ID_NOT_INSTALLED KbArticle_InstallStateId = 2 - KbArticle_INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT KbArticle_InstallStateId = 3 - KbArticle_INSTALL_STATE_ID_OTHER KbArticle_InstallStateId = 99 + Package_TYPE_ID_UNKNOWN Package_TypeId = 0 + Package_TYPE_ID_APPLICATION Package_TypeId = 1 + Package_TYPE_ID_OPERATING_SYSTEM Package_TypeId = 2 + Package_TYPE_ID_OTHER Package_TypeId = 99 ) -// Enum value maps for KbArticle_InstallStateId. +// Enum value maps for Package_TypeId. var ( - KbArticle_InstallStateId_name = map[int32]string{ - 0: "INSTALL_STATE_ID_UNKNOWN", - 1: "INSTALL_STATE_ID_INSTALLED", - 2: "INSTALL_STATE_ID_NOT_INSTALLED", - 3: "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT", - 99: "INSTALL_STATE_ID_OTHER", + Package_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_APPLICATION", + 2: "TYPE_ID_OPERATING_SYSTEM", + 99: "TYPE_ID_OTHER", } - KbArticle_InstallStateId_value = map[string]int32{ - "INSTALL_STATE_ID_UNKNOWN": 0, - "INSTALL_STATE_ID_INSTALLED": 1, - "INSTALL_STATE_ID_NOT_INSTALLED": 2, - "INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT": 3, - "INSTALL_STATE_ID_OTHER": 99, + Package_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_APPLICATION": 1, + "TYPE_ID_OPERATING_SYSTEM": 2, + "TYPE_ID_OTHER": 99, } ) -func (x KbArticle_InstallStateId) Enum() *KbArticle_InstallStateId { - p := new(KbArticle_InstallStateId) +func (x Package_TypeId) Enum() *Package_TypeId { + p := new(Package_TypeId) *p = x return p } -func (x KbArticle_InstallStateId) String() string { +func (x Package_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (KbArticle_InstallStateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[47].Descriptor() +func (Package_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[45].Descriptor() } -func (KbArticle_InstallStateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[47] +func (Package_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[45] } -func (x KbArticle_InstallStateId) Number() protoreflect.EnumNumber { +func (x Package_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use KbArticle_InstallStateId.Descriptor instead. -func (KbArticle_InstallStateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{56, 0} +// Deprecated: Use Package_TypeId.Descriptor instead. +func (Package_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{78, 0} } -type KillChainPhase_PhaseId int32 +type Process_IntegrityId int32 const ( - KillChainPhase_PHASE_ID_UNKNOWN KillChainPhase_PhaseId = 0 - KillChainPhase_PHASE_ID_RECONNAISSANCE KillChainPhase_PhaseId = 1 - KillChainPhase_PHASE_ID_WEAPONIZATION KillChainPhase_PhaseId = 2 - KillChainPhase_PHASE_ID_DELIVERY KillChainPhase_PhaseId = 3 - KillChainPhase_PHASE_ID_EXPLOITATION KillChainPhase_PhaseId = 4 - KillChainPhase_PHASE_ID_INSTALLATION KillChainPhase_PhaseId = 5 - KillChainPhase_PHASE_ID_COMMAND_CONTROL KillChainPhase_PhaseId = 6 - KillChainPhase_PHASE_ID_ACTIONS_ON_OBJECTIVES KillChainPhase_PhaseId = 7 - KillChainPhase_PHASE_ID_OTHER KillChainPhase_PhaseId = 99 + Process_INTEGRITY_ID_UNKNOWN Process_IntegrityId = 0 + Process_INTEGRITY_ID_UNTRUSTED Process_IntegrityId = 1 + Process_INTEGRITY_ID_LOW Process_IntegrityId = 2 + Process_INTEGRITY_ID_MEDIUM Process_IntegrityId = 3 + Process_INTEGRITY_ID_HIGH Process_IntegrityId = 4 + Process_INTEGRITY_ID_SYSTEM Process_IntegrityId = 5 + Process_INTEGRITY_ID_PROTECTED Process_IntegrityId = 6 + Process_INTEGRITY_ID_OTHER Process_IntegrityId = 99 ) -// Enum value maps for KillChainPhase_PhaseId. +// Enum value maps for Process_IntegrityId. var ( - KillChainPhase_PhaseId_name = map[int32]string{ - 0: "PHASE_ID_UNKNOWN", - 1: "PHASE_ID_RECONNAISSANCE", - 2: "PHASE_ID_WEAPONIZATION", - 3: "PHASE_ID_DELIVERY", - 4: "PHASE_ID_EXPLOITATION", - 5: "PHASE_ID_INSTALLATION", - 6: "PHASE_ID_COMMAND_CONTROL", - 7: "PHASE_ID_ACTIONS_ON_OBJECTIVES", - 99: "PHASE_ID_OTHER", + Process_IntegrityId_name = map[int32]string{ + 0: "INTEGRITY_ID_UNKNOWN", + 1: "INTEGRITY_ID_UNTRUSTED", + 2: "INTEGRITY_ID_LOW", + 3: "INTEGRITY_ID_MEDIUM", + 4: "INTEGRITY_ID_HIGH", + 5: "INTEGRITY_ID_SYSTEM", + 6: "INTEGRITY_ID_PROTECTED", + 99: "INTEGRITY_ID_OTHER", } - KillChainPhase_PhaseId_value = map[string]int32{ - "PHASE_ID_UNKNOWN": 0, - "PHASE_ID_RECONNAISSANCE": 1, - "PHASE_ID_WEAPONIZATION": 2, - "PHASE_ID_DELIVERY": 3, - "PHASE_ID_EXPLOITATION": 4, - "PHASE_ID_INSTALLATION": 5, - "PHASE_ID_COMMAND_CONTROL": 6, - "PHASE_ID_ACTIONS_ON_OBJECTIVES": 7, - "PHASE_ID_OTHER": 99, + Process_IntegrityId_value = map[string]int32{ + "INTEGRITY_ID_UNKNOWN": 0, + "INTEGRITY_ID_UNTRUSTED": 1, + "INTEGRITY_ID_LOW": 2, + "INTEGRITY_ID_MEDIUM": 3, + "INTEGRITY_ID_HIGH": 4, + "INTEGRITY_ID_SYSTEM": 5, + "INTEGRITY_ID_PROTECTED": 6, + "INTEGRITY_ID_OTHER": 99, } ) -func (x KillChainPhase_PhaseId) Enum() *KillChainPhase_PhaseId { - p := new(KillChainPhase_PhaseId) +func (x Process_IntegrityId) Enum() *Process_IntegrityId { + p := new(Process_IntegrityId) *p = x return p } -func (x KillChainPhase_PhaseId) String() string { +func (x Process_IntegrityId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (KillChainPhase_PhaseId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[48].Descriptor() +func (Process_IntegrityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[46].Descriptor() } -func (KillChainPhase_PhaseId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[48] +func (Process_IntegrityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[46] } -func (x KillChainPhase_PhaseId) Number() protoreflect.EnumNumber { +func (x Process_IntegrityId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use KillChainPhase_PhaseId.Descriptor instead. -func (KillChainPhase_PhaseId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{59, 0} +// Deprecated: Use Process_IntegrityId.Descriptor instead. +func (Process_IntegrityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{81, 0} } -type Malware_ClassificationIds int32 +type Reputation_ScoreId int32 const ( - Malware_CLASSIFICATION_IDS_UNKNOWN Malware_ClassificationIds = 0 - Malware_CLASSIFICATION_IDS_ADWARE Malware_ClassificationIds = 1 - Malware_CLASSIFICATION_IDS_BACKDOOR Malware_ClassificationIds = 2 - Malware_CLASSIFICATION_IDS_BOT Malware_ClassificationIds = 3 - Malware_CLASSIFICATION_IDS_BOOTKIT Malware_ClassificationIds = 4 - Malware_CLASSIFICATION_IDS_DDOS Malware_ClassificationIds = 5 - Malware_CLASSIFICATION_IDS_DOWNLOADER Malware_ClassificationIds = 6 - Malware_CLASSIFICATION_IDS_DROPPER Malware_ClassificationIds = 7 - Malware_CLASSIFICATION_IDS_EXPLOIT_KIT Malware_ClassificationIds = 8 - Malware_CLASSIFICATION_IDS_KEYLOGGER Malware_ClassificationIds = 9 - Malware_CLASSIFICATION_IDS_RANSOMWARE Malware_ClassificationIds = 10 - Malware_CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN Malware_ClassificationIds = 11 - Malware_CLASSIFICATION_IDS_RESOURCE_EXPLOITATION Malware_ClassificationIds = 13 - Malware_CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE Malware_ClassificationIds = 14 - Malware_CLASSIFICATION_IDS_ROOTKIT Malware_ClassificationIds = 15 - Malware_CLASSIFICATION_IDS_SCREEN_CAPTURE Malware_ClassificationIds = 16 - Malware_CLASSIFICATION_IDS_SPYWARE Malware_ClassificationIds = 17 - Malware_CLASSIFICATION_IDS_TROJAN Malware_ClassificationIds = 18 - Malware_CLASSIFICATION_IDS_VIRUS Malware_ClassificationIds = 19 - Malware_CLASSIFICATION_IDS_WEBSHELL Malware_ClassificationIds = 20 - Malware_CLASSIFICATION_IDS_WIPER Malware_ClassificationIds = 21 - Malware_CLASSIFICATION_IDS_WORM Malware_ClassificationIds = 22 - Malware_CLASSIFICATION_IDS_OTHER Malware_ClassificationIds = 99 + Reputation_SCORE_ID_UNKNOWN Reputation_ScoreId = 0 + Reputation_SCORE_ID_VERY_SAFE Reputation_ScoreId = 1 + Reputation_SCORE_ID_SAFE Reputation_ScoreId = 2 + Reputation_SCORE_ID_PROBABLY_SAFE Reputation_ScoreId = 3 + Reputation_SCORE_ID_LEANS_SAFE Reputation_ScoreId = 4 + Reputation_SCORE_ID_MAY_NOT_BE_SAFE Reputation_ScoreId = 5 + Reputation_SCORE_ID_EXERCISE_CAUTION Reputation_ScoreId = 6 + Reputation_SCORE_ID_SUSPICIOUS_RISKY Reputation_ScoreId = 7 + Reputation_SCORE_ID_POSSIBLY_MALICIOUS Reputation_ScoreId = 8 + Reputation_SCORE_ID_PROBABLY_MALICIOUS Reputation_ScoreId = 9 + Reputation_SCORE_ID_MALICIOUS Reputation_ScoreId = 10 + Reputation_SCORE_ID_OTHER Reputation_ScoreId = 99 ) -// Enum value maps for Malware_ClassificationIds. +// Enum value maps for Reputation_ScoreId. var ( - Malware_ClassificationIds_name = map[int32]string{ - 0: "CLASSIFICATION_IDS_UNKNOWN", - 1: "CLASSIFICATION_IDS_ADWARE", - 2: "CLASSIFICATION_IDS_BACKDOOR", - 3: "CLASSIFICATION_IDS_BOT", - 4: "CLASSIFICATION_IDS_BOOTKIT", - 5: "CLASSIFICATION_IDS_DDOS", - 6: "CLASSIFICATION_IDS_DOWNLOADER", - 7: "CLASSIFICATION_IDS_DROPPER", - 8: "CLASSIFICATION_IDS_EXPLOIT_KIT", - 9: "CLASSIFICATION_IDS_KEYLOGGER", - 10: "CLASSIFICATION_IDS_RANSOMWARE", - 11: "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN", - 13: "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION", - 14: "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE", - 15: "CLASSIFICATION_IDS_ROOTKIT", - 16: "CLASSIFICATION_IDS_SCREEN_CAPTURE", - 17: "CLASSIFICATION_IDS_SPYWARE", - 18: "CLASSIFICATION_IDS_TROJAN", - 19: "CLASSIFICATION_IDS_VIRUS", - 20: "CLASSIFICATION_IDS_WEBSHELL", - 21: "CLASSIFICATION_IDS_WIPER", - 22: "CLASSIFICATION_IDS_WORM", - 99: "CLASSIFICATION_IDS_OTHER", + Reputation_ScoreId_name = map[int32]string{ + 0: "SCORE_ID_UNKNOWN", + 1: "SCORE_ID_VERY_SAFE", + 2: "SCORE_ID_SAFE", + 3: "SCORE_ID_PROBABLY_SAFE", + 4: "SCORE_ID_LEANS_SAFE", + 5: "SCORE_ID_MAY_NOT_BE_SAFE", + 6: "SCORE_ID_EXERCISE_CAUTION", + 7: "SCORE_ID_SUSPICIOUS_RISKY", + 8: "SCORE_ID_POSSIBLY_MALICIOUS", + 9: "SCORE_ID_PROBABLY_MALICIOUS", + 10: "SCORE_ID_MALICIOUS", + 99: "SCORE_ID_OTHER", } - Malware_ClassificationIds_value = map[string]int32{ - "CLASSIFICATION_IDS_UNKNOWN": 0, - "CLASSIFICATION_IDS_ADWARE": 1, - "CLASSIFICATION_IDS_BACKDOOR": 2, - "CLASSIFICATION_IDS_BOT": 3, - "CLASSIFICATION_IDS_BOOTKIT": 4, - "CLASSIFICATION_IDS_DDOS": 5, - "CLASSIFICATION_IDS_DOWNLOADER": 6, - "CLASSIFICATION_IDS_DROPPER": 7, - "CLASSIFICATION_IDS_EXPLOIT_KIT": 8, - "CLASSIFICATION_IDS_KEYLOGGER": 9, - "CLASSIFICATION_IDS_RANSOMWARE": 10, - "CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN": 11, - "CLASSIFICATION_IDS_RESOURCE_EXPLOITATION": 13, - "CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE": 14, - "CLASSIFICATION_IDS_ROOTKIT": 15, - "CLASSIFICATION_IDS_SCREEN_CAPTURE": 16, - "CLASSIFICATION_IDS_SPYWARE": 17, - "CLASSIFICATION_IDS_TROJAN": 18, - "CLASSIFICATION_IDS_VIRUS": 19, - "CLASSIFICATION_IDS_WEBSHELL": 20, - "CLASSIFICATION_IDS_WIPER": 21, - "CLASSIFICATION_IDS_WORM": 22, - "CLASSIFICATION_IDS_OTHER": 99, + Reputation_ScoreId_value = map[string]int32{ + "SCORE_ID_UNKNOWN": 0, + "SCORE_ID_VERY_SAFE": 1, + "SCORE_ID_SAFE": 2, + "SCORE_ID_PROBABLY_SAFE": 3, + "SCORE_ID_LEANS_SAFE": 4, + "SCORE_ID_MAY_NOT_BE_SAFE": 5, + "SCORE_ID_EXERCISE_CAUTION": 6, + "SCORE_ID_SUSPICIOUS_RISKY": 7, + "SCORE_ID_POSSIBLY_MALICIOUS": 8, + "SCORE_ID_PROBABLY_MALICIOUS": 9, + "SCORE_ID_MALICIOUS": 10, + "SCORE_ID_OTHER": 99, } ) -func (x Malware_ClassificationIds) Enum() *Malware_ClassificationIds { - p := new(Malware_ClassificationIds) +func (x Reputation_ScoreId) Enum() *Reputation_ScoreId { + p := new(Reputation_ScoreId) *p = x return p } -func (x Malware_ClassificationIds) String() string { +func (x Reputation_ScoreId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Malware_ClassificationIds) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[49].Descriptor() +func (Reputation_ScoreId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[47].Descriptor() } -func (Malware_ClassificationIds) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[49] +func (Reputation_ScoreId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[47] } -func (x Malware_ClassificationIds) Number() protoreflect.EnumNumber { +func (x Reputation_ScoreId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Malware_ClassificationIds.Descriptor instead. -func (Malware_ClassificationIds) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{64, 0} +// Deprecated: Use Reputation_ScoreId.Descriptor instead. +func (Reputation_ScoreId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{87, 0} } -type Malware_SeverityId int32 +type ResourceDetails_RoleId int32 const ( - Malware_SEVERITY_ID_UNKNOWN Malware_SeverityId = 0 - Malware_SEVERITY_ID_INFORMATIONAL Malware_SeverityId = 1 - Malware_SEVERITY_ID_LOW Malware_SeverityId = 2 - Malware_SEVERITY_ID_MEDIUM Malware_SeverityId = 3 - Malware_SEVERITY_ID_HIGH Malware_SeverityId = 4 - Malware_SEVERITY_ID_CRITICAL Malware_SeverityId = 5 - Malware_SEVERITY_ID_FATAL Malware_SeverityId = 6 - Malware_SEVERITY_ID_OTHER Malware_SeverityId = 99 + ResourceDetails_ROLE_ID_UNKNOWN ResourceDetails_RoleId = 0 + ResourceDetails_ROLE_ID_TARGET ResourceDetails_RoleId = 1 + ResourceDetails_ROLE_ID_ACTOR ResourceDetails_RoleId = 2 + ResourceDetails_ROLE_ID_AFFECTED ResourceDetails_RoleId = 3 + ResourceDetails_ROLE_ID_RELATED ResourceDetails_RoleId = 4 + ResourceDetails_ROLE_ID_OTHER ResourceDetails_RoleId = 99 ) -// Enum value maps for Malware_SeverityId. +// Enum value maps for ResourceDetails_RoleId. var ( - Malware_SeverityId_name = map[int32]string{ - 0: "SEVERITY_ID_UNKNOWN", - 1: "SEVERITY_ID_INFORMATIONAL", - 2: "SEVERITY_ID_LOW", - 3: "SEVERITY_ID_MEDIUM", - 4: "SEVERITY_ID_HIGH", - 5: "SEVERITY_ID_CRITICAL", - 6: "SEVERITY_ID_FATAL", - 99: "SEVERITY_ID_OTHER", + ResourceDetails_RoleId_name = map[int32]string{ + 0: "ROLE_ID_UNKNOWN", + 1: "ROLE_ID_TARGET", + 2: "ROLE_ID_ACTOR", + 3: "ROLE_ID_AFFECTED", + 4: "ROLE_ID_RELATED", + 99: "ROLE_ID_OTHER", } - Malware_SeverityId_value = map[string]int32{ - "SEVERITY_ID_UNKNOWN": 0, - "SEVERITY_ID_INFORMATIONAL": 1, - "SEVERITY_ID_LOW": 2, - "SEVERITY_ID_MEDIUM": 3, - "SEVERITY_ID_HIGH": 4, - "SEVERITY_ID_CRITICAL": 5, - "SEVERITY_ID_FATAL": 6, - "SEVERITY_ID_OTHER": 99, + ResourceDetails_RoleId_value = map[string]int32{ + "ROLE_ID_UNKNOWN": 0, + "ROLE_ID_TARGET": 1, + "ROLE_ID_ACTOR": 2, + "ROLE_ID_AFFECTED": 3, + "ROLE_ID_RELATED": 4, + "ROLE_ID_OTHER": 99, } ) -func (x Malware_SeverityId) Enum() *Malware_SeverityId { - p := new(Malware_SeverityId) +func (x ResourceDetails_RoleId) Enum() *ResourceDetails_RoleId { + p := new(ResourceDetails_RoleId) *p = x return p } -func (x Malware_SeverityId) String() string { +func (x ResourceDetails_RoleId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Malware_SeverityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[50].Descriptor() +func (ResourceDetails_RoleId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[48].Descriptor() } -func (Malware_SeverityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[50] +func (ResourceDetails_RoleId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[48] } -func (x Malware_SeverityId) Number() protoreflect.EnumNumber { +func (x ResourceDetails_RoleId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Malware_SeverityId.Descriptor instead. -func (Malware_SeverityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{64, 1} +// Deprecated: Use ResourceDetails_RoleId.Descriptor instead. +func (ResourceDetails_RoleId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{89, 0} } -type MalwareScanInfo_TypeId int32 +type Sbom_TypeId int32 const ( - MalwareScanInfo_TYPE_ID_UNKNOWN MalwareScanInfo_TypeId = 0 - MalwareScanInfo_TYPE_ID_MANUAL MalwareScanInfo_TypeId = 1 - MalwareScanInfo_TYPE_ID_SCHEDULED MalwareScanInfo_TypeId = 2 - MalwareScanInfo_TYPE_ID_UPDATED_CONTENT MalwareScanInfo_TypeId = 3 - MalwareScanInfo_TYPE_ID_QUARANTINED_ITEMS MalwareScanInfo_TypeId = 4 - MalwareScanInfo_TYPE_ID_ATTACHED_MEDIA MalwareScanInfo_TypeId = 5 - MalwareScanInfo_TYPE_ID_USER_LOGON MalwareScanInfo_TypeId = 6 - MalwareScanInfo_TYPE_ID_ELAM MalwareScanInfo_TypeId = 7 - MalwareScanInfo_TYPE_ID_OTHER MalwareScanInfo_TypeId = 99 + Sbom_TYPE_ID_UNKNOWN Sbom_TypeId = 0 + Sbom_TYPE_ID_SPDX Sbom_TypeId = 1 + Sbom_TYPE_ID_CYCLONEDX Sbom_TypeId = 2 + Sbom_TYPE_ID_SWID Sbom_TypeId = 3 + Sbom_TYPE_ID_OTHER Sbom_TypeId = 99 ) -// Enum value maps for MalwareScanInfo_TypeId. +// Enum value maps for Sbom_TypeId. var ( - MalwareScanInfo_TypeId_name = map[int32]string{ + Sbom_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_MANUAL", - 2: "TYPE_ID_SCHEDULED", - 3: "TYPE_ID_UPDATED_CONTENT", - 4: "TYPE_ID_QUARANTINED_ITEMS", - 5: "TYPE_ID_ATTACHED_MEDIA", - 6: "TYPE_ID_USER_LOGON", - 7: "TYPE_ID_ELAM", + 1: "TYPE_ID_SPDX", + 2: "TYPE_ID_CYCLONEDX", + 3: "TYPE_ID_SWID", 99: "TYPE_ID_OTHER", } - MalwareScanInfo_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_MANUAL": 1, - "TYPE_ID_SCHEDULED": 2, - "TYPE_ID_UPDATED_CONTENT": 3, - "TYPE_ID_QUARANTINED_ITEMS": 4, - "TYPE_ID_ATTACHED_MEDIA": 5, - "TYPE_ID_USER_LOGON": 6, - "TYPE_ID_ELAM": 7, - "TYPE_ID_OTHER": 99, + Sbom_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_SPDX": 1, + "TYPE_ID_CYCLONEDX": 2, + "TYPE_ID_SWID": 3, + "TYPE_ID_OTHER": 99, } ) -func (x MalwareScanInfo_TypeId) Enum() *MalwareScanInfo_TypeId { - p := new(MalwareScanInfo_TypeId) +func (x Sbom_TypeId) Enum() *Sbom_TypeId { + p := new(Sbom_TypeId) *p = x return p } -func (x MalwareScanInfo_TypeId) String() string { +func (x Sbom_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (MalwareScanInfo_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[51].Descriptor() +func (Sbom_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[49].Descriptor() } -func (MalwareScanInfo_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[51] +func (Sbom_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[49] } -func (x MalwareScanInfo_TypeId) Number() protoreflect.EnumNumber { +func (x Sbom_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use MalwareScanInfo_TypeId.Descriptor instead. -func (MalwareScanInfo_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{65, 0} +// Deprecated: Use Sbom_TypeId.Descriptor instead. +func (Sbom_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{93, 0} } -type ManagedEntity_TypeId int32 +type Scim_AuthProtocolId int32 const ( - ManagedEntity_TYPE_ID_UNKNOWN ManagedEntity_TypeId = 0 - ManagedEntity_TYPE_ID_DEVICE ManagedEntity_TypeId = 1 - ManagedEntity_TYPE_ID_USER ManagedEntity_TypeId = 2 - ManagedEntity_TYPE_ID_GROUP ManagedEntity_TypeId = 3 - ManagedEntity_TYPE_ID_ORGANIZATION ManagedEntity_TypeId = 4 - ManagedEntity_TYPE_ID_POLICY ManagedEntity_TypeId = 5 - ManagedEntity_TYPE_ID_EMAIL ManagedEntity_TypeId = 6 - ManagedEntity_TYPE_ID_NETWORK_ZONE ManagedEntity_TypeId = 7 - ManagedEntity_TYPE_ID_OTHER ManagedEntity_TypeId = 99 + Scim_AUTH_PROTOCOL_ID_UNKNOWN Scim_AuthProtocolId = 0 + Scim_AUTH_PROTOCOL_ID_NTLM Scim_AuthProtocolId = 1 + Scim_AUTH_PROTOCOL_ID_KERBEROS Scim_AuthProtocolId = 2 + Scim_AUTH_PROTOCOL_ID_DIGEST Scim_AuthProtocolId = 3 + Scim_AUTH_PROTOCOL_ID_OPENID Scim_AuthProtocolId = 4 + Scim_AUTH_PROTOCOL_ID_SAML Scim_AuthProtocolId = 5 + Scim_AUTH_PROTOCOL_ID_OAUTH_2_0 Scim_AuthProtocolId = 6 + Scim_AUTH_PROTOCOL_ID_PAP Scim_AuthProtocolId = 7 + Scim_AUTH_PROTOCOL_ID_CHAP Scim_AuthProtocolId = 8 + Scim_AUTH_PROTOCOL_ID_EAP Scim_AuthProtocolId = 9 + Scim_AUTH_PROTOCOL_ID_RADIUS Scim_AuthProtocolId = 10 + Scim_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Scim_AuthProtocolId = 11 + Scim_AUTH_PROTOCOL_ID_LDAP Scim_AuthProtocolId = 12 + Scim_AUTH_PROTOCOL_ID_OTHER Scim_AuthProtocolId = 99 ) -// Enum value maps for ManagedEntity_TypeId. +// Enum value maps for Scim_AuthProtocolId. var ( - ManagedEntity_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_DEVICE", - 2: "TYPE_ID_USER", - 3: "TYPE_ID_GROUP", - 4: "TYPE_ID_ORGANIZATION", - 5: "TYPE_ID_POLICY", - 6: "TYPE_ID_EMAIL", - 7: "TYPE_ID_NETWORK_ZONE", - 99: "TYPE_ID_OTHER", + Scim_AuthProtocolId_name = map[int32]string{ + 0: "AUTH_PROTOCOL_ID_UNKNOWN", + 1: "AUTH_PROTOCOL_ID_NTLM", + 2: "AUTH_PROTOCOL_ID_KERBEROS", + 3: "AUTH_PROTOCOL_ID_DIGEST", + 4: "AUTH_PROTOCOL_ID_OPENID", + 5: "AUTH_PROTOCOL_ID_SAML", + 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", + 7: "AUTH_PROTOCOL_ID_PAP", + 8: "AUTH_PROTOCOL_ID_CHAP", + 9: "AUTH_PROTOCOL_ID_EAP", + 10: "AUTH_PROTOCOL_ID_RADIUS", + 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", + 12: "AUTH_PROTOCOL_ID_LDAP", + 99: "AUTH_PROTOCOL_ID_OTHER", } - ManagedEntity_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_DEVICE": 1, - "TYPE_ID_USER": 2, - "TYPE_ID_GROUP": 3, - "TYPE_ID_ORGANIZATION": 4, - "TYPE_ID_POLICY": 5, - "TYPE_ID_EMAIL": 6, - "TYPE_ID_NETWORK_ZONE": 7, - "TYPE_ID_OTHER": 99, + Scim_AuthProtocolId_value = map[string]int32{ + "AUTH_PROTOCOL_ID_UNKNOWN": 0, + "AUTH_PROTOCOL_ID_NTLM": 1, + "AUTH_PROTOCOL_ID_KERBEROS": 2, + "AUTH_PROTOCOL_ID_DIGEST": 3, + "AUTH_PROTOCOL_ID_OPENID": 4, + "AUTH_PROTOCOL_ID_SAML": 5, + "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, + "AUTH_PROTOCOL_ID_PAP": 7, + "AUTH_PROTOCOL_ID_CHAP": 8, + "AUTH_PROTOCOL_ID_EAP": 9, + "AUTH_PROTOCOL_ID_RADIUS": 10, + "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, + "AUTH_PROTOCOL_ID_LDAP": 12, + "AUTH_PROTOCOL_ID_OTHER": 99, } ) -func (x ManagedEntity_TypeId) Enum() *ManagedEntity_TypeId { - p := new(ManagedEntity_TypeId) +func (x Scim_AuthProtocolId) Enum() *Scim_AuthProtocolId { + p := new(Scim_AuthProtocolId) *p = x return p } -func (x ManagedEntity_TypeId) String() string { +func (x Scim_AuthProtocolId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (ManagedEntity_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[52].Descriptor() +func (Scim_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[50].Descriptor() } -func (ManagedEntity_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[52] +func (Scim_AuthProtocolId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[50] } -func (x ManagedEntity_TypeId) Number() protoreflect.EnumNumber { +func (x Scim_AuthProtocolId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use ManagedEntity_TypeId.Descriptor instead. -func (ManagedEntity_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{66, 0} +// Deprecated: Use Scim_AuthProtocolId.Descriptor instead. +func (Scim_AuthProtocolId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{94, 0} } -type MessageContext_AiRoleId int32 +type Scim_StateId int32 const ( - MessageContext_AI_ROLE_ID_UNKNOWN MessageContext_AiRoleId = 0 - MessageContext_AI_ROLE_ID_USER MessageContext_AiRoleId = 1 - MessageContext_AI_ROLE_ID_ASSISTANT MessageContext_AiRoleId = 2 - MessageContext_AI_ROLE_ID_TOOL MessageContext_AiRoleId = 3 - MessageContext_AI_ROLE_ID_AGENT MessageContext_AiRoleId = 4 - MessageContext_AI_ROLE_ID_ORCHESTRATOR MessageContext_AiRoleId = 5 - MessageContext_AI_ROLE_ID_RETRIEVER MessageContext_AiRoleId = 6 - MessageContext_AI_ROLE_ID_OTHER MessageContext_AiRoleId = 99 + Scim_STATE_ID_UNKNOWN Scim_StateId = 0 + Scim_STATE_ID_PENDING Scim_StateId = 1 + Scim_STATE_ID_ACTIVE Scim_StateId = 2 + Scim_STATE_ID_FAILED Scim_StateId = 3 + Scim_STATE_ID_DELETED Scim_StateId = 4 + Scim_STATE_ID_OTHER Scim_StateId = 99 ) -// Enum value maps for MessageContext_AiRoleId. +// Enum value maps for Scim_StateId. var ( - MessageContext_AiRoleId_name = map[int32]string{ - 0: "AI_ROLE_ID_UNKNOWN", - 1: "AI_ROLE_ID_USER", - 2: "AI_ROLE_ID_ASSISTANT", - 3: "AI_ROLE_ID_TOOL", - 4: "AI_ROLE_ID_AGENT", - 5: "AI_ROLE_ID_ORCHESTRATOR", - 6: "AI_ROLE_ID_RETRIEVER", - 99: "AI_ROLE_ID_OTHER", + Scim_StateId_name = map[int32]string{ + 0: "STATE_ID_UNKNOWN", + 1: "STATE_ID_PENDING", + 2: "STATE_ID_ACTIVE", + 3: "STATE_ID_FAILED", + 4: "STATE_ID_DELETED", + 99: "STATE_ID_OTHER", } - MessageContext_AiRoleId_value = map[string]int32{ - "AI_ROLE_ID_UNKNOWN": 0, - "AI_ROLE_ID_USER": 1, - "AI_ROLE_ID_ASSISTANT": 2, - "AI_ROLE_ID_TOOL": 3, - "AI_ROLE_ID_AGENT": 4, - "AI_ROLE_ID_ORCHESTRATOR": 5, - "AI_ROLE_ID_RETRIEVER": 6, - "AI_ROLE_ID_OTHER": 99, + Scim_StateId_value = map[string]int32{ + "STATE_ID_UNKNOWN": 0, + "STATE_ID_PENDING": 1, + "STATE_ID_ACTIVE": 2, + "STATE_ID_FAILED": 3, + "STATE_ID_DELETED": 4, + "STATE_ID_OTHER": 99, } ) -func (x MessageContext_AiRoleId) Enum() *MessageContext_AiRoleId { - p := new(MessageContext_AiRoleId) +func (x Scim_StateId) Enum() *Scim_StateId { + p := new(Scim_StateId) *p = x return p } -func (x MessageContext_AiRoleId) String() string { +func (x Scim_StateId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (MessageContext_AiRoleId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[53].Descriptor() +func (Scim_StateId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[51].Descriptor() } -func (MessageContext_AiRoleId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[53] +func (Scim_StateId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[51] } -func (x MessageContext_AiRoleId) Number() protoreflect.EnumNumber { +func (x Scim_StateId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use MessageContext_AiRoleId.Descriptor instead. -func (MessageContext_AiRoleId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{67, 0} +// Deprecated: Use Scim_StateId.Descriptor instead. +func (Scim_StateId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{94, 1} } -type NetworkEndpoint_NetworkScopeId int32 +type Script_TypeId int32 const ( - NetworkEndpoint_NETWORK_SCOPE_ID_UNKNOWN NetworkEndpoint_NetworkScopeId = 0 - NetworkEndpoint_NETWORK_SCOPE_ID_INTERNAL NetworkEndpoint_NetworkScopeId = 1 - NetworkEndpoint_NETWORK_SCOPE_ID_EXTERNAL NetworkEndpoint_NetworkScopeId = 2 - NetworkEndpoint_NETWORK_SCOPE_ID_OTHER NetworkEndpoint_NetworkScopeId = 99 + Script_TYPE_ID_UNKNOWN Script_TypeId = 0 + Script_TYPE_ID_WINDOWS_COMMAND_PROMPT Script_TypeId = 1 + Script_TYPE_ID_POWERSHELL Script_TypeId = 2 + Script_TYPE_ID_PYTHON Script_TypeId = 3 + Script_TYPE_ID_JAVASCRIPT Script_TypeId = 4 + Script_TYPE_ID_VBSCRIPT Script_TypeId = 5 + Script_TYPE_ID_UNIX_SHELL Script_TypeId = 6 + Script_TYPE_ID_VBA Script_TypeId = 7 + Script_TYPE_ID_OTHER Script_TypeId = 99 ) -// Enum value maps for NetworkEndpoint_NetworkScopeId. +// Enum value maps for Script_TypeId. var ( - NetworkEndpoint_NetworkScopeId_name = map[int32]string{ - 0: "NETWORK_SCOPE_ID_UNKNOWN", - 1: "NETWORK_SCOPE_ID_INTERNAL", - 2: "NETWORK_SCOPE_ID_EXTERNAL", - 99: "NETWORK_SCOPE_ID_OTHER", + Script_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_WINDOWS_COMMAND_PROMPT", + 2: "TYPE_ID_POWERSHELL", + 3: "TYPE_ID_PYTHON", + 4: "TYPE_ID_JAVASCRIPT", + 5: "TYPE_ID_VBSCRIPT", + 6: "TYPE_ID_UNIX_SHELL", + 7: "TYPE_ID_VBA", + 99: "TYPE_ID_OTHER", } - NetworkEndpoint_NetworkScopeId_value = map[string]int32{ - "NETWORK_SCOPE_ID_UNKNOWN": 0, - "NETWORK_SCOPE_ID_INTERNAL": 1, - "NETWORK_SCOPE_ID_EXTERNAL": 2, - "NETWORK_SCOPE_ID_OTHER": 99, + Script_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_WINDOWS_COMMAND_PROMPT": 1, + "TYPE_ID_POWERSHELL": 2, + "TYPE_ID_PYTHON": 3, + "TYPE_ID_JAVASCRIPT": 4, + "TYPE_ID_VBSCRIPT": 5, + "TYPE_ID_UNIX_SHELL": 6, + "TYPE_ID_VBA": 7, + "TYPE_ID_OTHER": 99, } ) -func (x NetworkEndpoint_NetworkScopeId) Enum() *NetworkEndpoint_NetworkScopeId { - p := new(NetworkEndpoint_NetworkScopeId) +func (x Script_TypeId) Enum() *Script_TypeId { + p := new(Script_TypeId) *p = x return p } -func (x NetworkEndpoint_NetworkScopeId) String() string { +func (x Script_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (NetworkEndpoint_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[54].Descriptor() +func (Script_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[52].Descriptor() } -func (NetworkEndpoint_NetworkScopeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[54] +func (Script_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[52] } -func (x NetworkEndpoint_NetworkScopeId) Number() protoreflect.EnumNumber { +func (x Script_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use NetworkEndpoint_NetworkScopeId.Descriptor instead. -func (NetworkEndpoint_NetworkScopeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{71, 0} +// Deprecated: Use Script_TypeId.Descriptor instead. +func (Script_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{95, 0} } -type NetworkEndpoint_TypeId int32 +type SoftwareComponent_RelationshipId int32 const ( - NetworkEndpoint_TYPE_ID_UNKNOWN NetworkEndpoint_TypeId = 0 - NetworkEndpoint_TYPE_ID_SERVER NetworkEndpoint_TypeId = 1 - NetworkEndpoint_TYPE_ID_DESKTOP NetworkEndpoint_TypeId = 2 - NetworkEndpoint_TYPE_ID_LAPTOP NetworkEndpoint_TypeId = 3 - NetworkEndpoint_TYPE_ID_TABLET NetworkEndpoint_TypeId = 4 - NetworkEndpoint_TYPE_ID_MOBILE NetworkEndpoint_TypeId = 5 - NetworkEndpoint_TYPE_ID_VIRTUAL NetworkEndpoint_TypeId = 6 - NetworkEndpoint_TYPE_ID_IOT NetworkEndpoint_TypeId = 7 - NetworkEndpoint_TYPE_ID_BROWSER NetworkEndpoint_TypeId = 8 - NetworkEndpoint_TYPE_ID_FIREWALL NetworkEndpoint_TypeId = 9 - NetworkEndpoint_TYPE_ID_SWITCH NetworkEndpoint_TypeId = 10 - NetworkEndpoint_TYPE_ID_HUB NetworkEndpoint_TypeId = 11 - NetworkEndpoint_TYPE_ID_ROUTER NetworkEndpoint_TypeId = 12 - NetworkEndpoint_TYPE_ID_IDS NetworkEndpoint_TypeId = 13 - NetworkEndpoint_TYPE_ID_IPS NetworkEndpoint_TypeId = 14 - NetworkEndpoint_TYPE_ID_LOAD_BALANCER NetworkEndpoint_TypeId = 15 - NetworkEndpoint_TYPE_ID_OTHER NetworkEndpoint_TypeId = 99 + SoftwareComponent_RELATIONSHIP_ID_UNKNOWN SoftwareComponent_RelationshipId = 0 + SoftwareComponent_RELATIONSHIP_ID_DEPENDS_ON SoftwareComponent_RelationshipId = 1 + SoftwareComponent_RELATIONSHIP_ID_OTHER SoftwareComponent_RelationshipId = 99 ) -// Enum value maps for NetworkEndpoint_TypeId. +// Enum value maps for SoftwareComponent_RelationshipId. var ( - NetworkEndpoint_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_SERVER", - 2: "TYPE_ID_DESKTOP", - 3: "TYPE_ID_LAPTOP", - 4: "TYPE_ID_TABLET", - 5: "TYPE_ID_MOBILE", - 6: "TYPE_ID_VIRTUAL", - 7: "TYPE_ID_IOT", - 8: "TYPE_ID_BROWSER", - 9: "TYPE_ID_FIREWALL", - 10: "TYPE_ID_SWITCH", - 11: "TYPE_ID_HUB", - 12: "TYPE_ID_ROUTER", - 13: "TYPE_ID_IDS", - 14: "TYPE_ID_IPS", - 15: "TYPE_ID_LOAD_BALANCER", - 99: "TYPE_ID_OTHER", + SoftwareComponent_RelationshipId_name = map[int32]string{ + 0: "RELATIONSHIP_ID_UNKNOWN", + 1: "RELATIONSHIP_ID_DEPENDS_ON", + 99: "RELATIONSHIP_ID_OTHER", } - NetworkEndpoint_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_SERVER": 1, - "TYPE_ID_DESKTOP": 2, - "TYPE_ID_LAPTOP": 3, - "TYPE_ID_TABLET": 4, - "TYPE_ID_MOBILE": 5, - "TYPE_ID_VIRTUAL": 6, - "TYPE_ID_IOT": 7, - "TYPE_ID_BROWSER": 8, - "TYPE_ID_FIREWALL": 9, - "TYPE_ID_SWITCH": 10, - "TYPE_ID_HUB": 11, - "TYPE_ID_ROUTER": 12, - "TYPE_ID_IDS": 13, - "TYPE_ID_IPS": 14, - "TYPE_ID_LOAD_BALANCER": 15, - "TYPE_ID_OTHER": 99, + SoftwareComponent_RelationshipId_value = map[string]int32{ + "RELATIONSHIP_ID_UNKNOWN": 0, + "RELATIONSHIP_ID_DEPENDS_ON": 1, + "RELATIONSHIP_ID_OTHER": 99, } ) -func (x NetworkEndpoint_TypeId) Enum() *NetworkEndpoint_TypeId { - p := new(NetworkEndpoint_TypeId) +func (x SoftwareComponent_RelationshipId) Enum() *SoftwareComponent_RelationshipId { + p := new(SoftwareComponent_RelationshipId) *p = x return p } -func (x NetworkEndpoint_TypeId) String() string { +func (x SoftwareComponent_RelationshipId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (NetworkEndpoint_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[55].Descriptor() +func (SoftwareComponent_RelationshipId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[53].Descriptor() } -func (NetworkEndpoint_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[55] +func (SoftwareComponent_RelationshipId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[53] } -func (x NetworkEndpoint_TypeId) Number() protoreflect.EnumNumber { +func (x SoftwareComponent_RelationshipId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use NetworkEndpoint_TypeId.Descriptor instead. -func (NetworkEndpoint_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{71, 1} +// Deprecated: Use SoftwareComponent_RelationshipId.Descriptor instead. +func (SoftwareComponent_RelationshipId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{98, 0} } -type NetworkInterface_TypeId int32 +type SoftwareComponent_TypeId int32 const ( - NetworkInterface_TYPE_ID_UNKNOWN NetworkInterface_TypeId = 0 - NetworkInterface_TYPE_ID_WIRED NetworkInterface_TypeId = 1 - NetworkInterface_TYPE_ID_WIRELESS NetworkInterface_TypeId = 2 - NetworkInterface_TYPE_ID_MOBILE NetworkInterface_TypeId = 3 - NetworkInterface_TYPE_ID_TUNNEL NetworkInterface_TypeId = 4 - NetworkInterface_TYPE_ID_OTHER NetworkInterface_TypeId = 99 + SoftwareComponent_TYPE_ID_UNKNOWN SoftwareComponent_TypeId = 0 + SoftwareComponent_TYPE_ID_FRAMEWORK SoftwareComponent_TypeId = 1 + SoftwareComponent_TYPE_ID_LIBRARY SoftwareComponent_TypeId = 2 + SoftwareComponent_TYPE_ID_OPERATING_SYSTEM SoftwareComponent_TypeId = 3 + SoftwareComponent_TYPE_ID_OTHER SoftwareComponent_TypeId = 99 ) -// Enum value maps for NetworkInterface_TypeId. +// Enum value maps for SoftwareComponent_TypeId. var ( - NetworkInterface_TypeId_name = map[int32]string{ + SoftwareComponent_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_WIRED", - 2: "TYPE_ID_WIRELESS", - 3: "TYPE_ID_MOBILE", - 4: "TYPE_ID_TUNNEL", + 1: "TYPE_ID_FRAMEWORK", + 2: "TYPE_ID_LIBRARY", + 3: "TYPE_ID_OPERATING_SYSTEM", 99: "TYPE_ID_OTHER", } - NetworkInterface_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_WIRED": 1, - "TYPE_ID_WIRELESS": 2, - "TYPE_ID_MOBILE": 3, - "TYPE_ID_TUNNEL": 4, - "TYPE_ID_OTHER": 99, + SoftwareComponent_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_FRAMEWORK": 1, + "TYPE_ID_LIBRARY": 2, + "TYPE_ID_OPERATING_SYSTEM": 3, + "TYPE_ID_OTHER": 99, } ) -func (x NetworkInterface_TypeId) Enum() *NetworkInterface_TypeId { - p := new(NetworkInterface_TypeId) +func (x SoftwareComponent_TypeId) Enum() *SoftwareComponent_TypeId { + p := new(SoftwareComponent_TypeId) *p = x return p } -func (x NetworkInterface_TypeId) String() string { +func (x SoftwareComponent_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (NetworkInterface_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[56].Descriptor() +func (SoftwareComponent_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[54].Descriptor() } -func (NetworkInterface_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[56] +func (SoftwareComponent_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[54] } -func (x NetworkInterface_TypeId) Number() protoreflect.EnumNumber { +func (x SoftwareComponent_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use NetworkInterface_TypeId.Descriptor instead. -func (NetworkInterface_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{72, 0} +// Deprecated: Use SoftwareComponent_TypeId.Descriptor instead. +func (SoftwareComponent_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{98, 1} } -type NetworkProxy_NetworkScopeId int32 +type Sso_AuthProtocolId int32 const ( - NetworkProxy_NETWORK_SCOPE_ID_UNKNOWN NetworkProxy_NetworkScopeId = 0 - NetworkProxy_NETWORK_SCOPE_ID_INTERNAL NetworkProxy_NetworkScopeId = 1 - NetworkProxy_NETWORK_SCOPE_ID_EXTERNAL NetworkProxy_NetworkScopeId = 2 - NetworkProxy_NETWORK_SCOPE_ID_OTHER NetworkProxy_NetworkScopeId = 99 + Sso_AUTH_PROTOCOL_ID_UNKNOWN Sso_AuthProtocolId = 0 + Sso_AUTH_PROTOCOL_ID_NTLM Sso_AuthProtocolId = 1 + Sso_AUTH_PROTOCOL_ID_KERBEROS Sso_AuthProtocolId = 2 + Sso_AUTH_PROTOCOL_ID_DIGEST Sso_AuthProtocolId = 3 + Sso_AUTH_PROTOCOL_ID_OPENID Sso_AuthProtocolId = 4 + Sso_AUTH_PROTOCOL_ID_SAML Sso_AuthProtocolId = 5 + Sso_AUTH_PROTOCOL_ID_OAUTH_2_0 Sso_AuthProtocolId = 6 + Sso_AUTH_PROTOCOL_ID_PAP Sso_AuthProtocolId = 7 + Sso_AUTH_PROTOCOL_ID_CHAP Sso_AuthProtocolId = 8 + Sso_AUTH_PROTOCOL_ID_EAP Sso_AuthProtocolId = 9 + Sso_AUTH_PROTOCOL_ID_RADIUS Sso_AuthProtocolId = 10 + Sso_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Sso_AuthProtocolId = 11 + Sso_AUTH_PROTOCOL_ID_LDAP Sso_AuthProtocolId = 12 + Sso_AUTH_PROTOCOL_ID_OTHER Sso_AuthProtocolId = 99 ) -// Enum value maps for NetworkProxy_NetworkScopeId. +// Enum value maps for Sso_AuthProtocolId. var ( - NetworkProxy_NetworkScopeId_name = map[int32]string{ - 0: "NETWORK_SCOPE_ID_UNKNOWN", - 1: "NETWORK_SCOPE_ID_INTERNAL", - 2: "NETWORK_SCOPE_ID_EXTERNAL", - 99: "NETWORK_SCOPE_ID_OTHER", + Sso_AuthProtocolId_name = map[int32]string{ + 0: "AUTH_PROTOCOL_ID_UNKNOWN", + 1: "AUTH_PROTOCOL_ID_NTLM", + 2: "AUTH_PROTOCOL_ID_KERBEROS", + 3: "AUTH_PROTOCOL_ID_DIGEST", + 4: "AUTH_PROTOCOL_ID_OPENID", + 5: "AUTH_PROTOCOL_ID_SAML", + 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", + 7: "AUTH_PROTOCOL_ID_PAP", + 8: "AUTH_PROTOCOL_ID_CHAP", + 9: "AUTH_PROTOCOL_ID_EAP", + 10: "AUTH_PROTOCOL_ID_RADIUS", + 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", + 12: "AUTH_PROTOCOL_ID_LDAP", + 99: "AUTH_PROTOCOL_ID_OTHER", } - NetworkProxy_NetworkScopeId_value = map[string]int32{ - "NETWORK_SCOPE_ID_UNKNOWN": 0, - "NETWORK_SCOPE_ID_INTERNAL": 1, - "NETWORK_SCOPE_ID_EXTERNAL": 2, - "NETWORK_SCOPE_ID_OTHER": 99, + Sso_AuthProtocolId_value = map[string]int32{ + "AUTH_PROTOCOL_ID_UNKNOWN": 0, + "AUTH_PROTOCOL_ID_NTLM": 1, + "AUTH_PROTOCOL_ID_KERBEROS": 2, + "AUTH_PROTOCOL_ID_DIGEST": 3, + "AUTH_PROTOCOL_ID_OPENID": 4, + "AUTH_PROTOCOL_ID_SAML": 5, + "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, + "AUTH_PROTOCOL_ID_PAP": 7, + "AUTH_PROTOCOL_ID_CHAP": 8, + "AUTH_PROTOCOL_ID_EAP": 9, + "AUTH_PROTOCOL_ID_RADIUS": 10, + "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, + "AUTH_PROTOCOL_ID_LDAP": 12, + "AUTH_PROTOCOL_ID_OTHER": 99, } ) -func (x NetworkProxy_NetworkScopeId) Enum() *NetworkProxy_NetworkScopeId { - p := new(NetworkProxy_NetworkScopeId) +func (x Sso_AuthProtocolId) Enum() *Sso_AuthProtocolId { + p := new(Sso_AuthProtocolId) *p = x return p } -func (x NetworkProxy_NetworkScopeId) String() string { +func (x Sso_AuthProtocolId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (NetworkProxy_NetworkScopeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[57].Descriptor() +func (Sso_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[55].Descriptor() } -func (NetworkProxy_NetworkScopeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[57] +func (Sso_AuthProtocolId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[55] } -func (x NetworkProxy_NetworkScopeId) Number() protoreflect.EnumNumber { +func (x Sso_AuthProtocolId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use NetworkProxy_NetworkScopeId.Descriptor instead. -func (NetworkProxy_NetworkScopeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{73, 0} +// Deprecated: Use Sso_AuthProtocolId.Descriptor instead. +func (Sso_AuthProtocolId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{100, 0} } -type NetworkProxy_TypeId int32 +type ThreatActor_TypeId int32 const ( - NetworkProxy_TYPE_ID_UNKNOWN NetworkProxy_TypeId = 0 - NetworkProxy_TYPE_ID_SERVER NetworkProxy_TypeId = 1 - NetworkProxy_TYPE_ID_DESKTOP NetworkProxy_TypeId = 2 - NetworkProxy_TYPE_ID_LAPTOP NetworkProxy_TypeId = 3 - NetworkProxy_TYPE_ID_TABLET NetworkProxy_TypeId = 4 - NetworkProxy_TYPE_ID_MOBILE NetworkProxy_TypeId = 5 - NetworkProxy_TYPE_ID_VIRTUAL NetworkProxy_TypeId = 6 - NetworkProxy_TYPE_ID_IOT NetworkProxy_TypeId = 7 - NetworkProxy_TYPE_ID_BROWSER NetworkProxy_TypeId = 8 - NetworkProxy_TYPE_ID_FIREWALL NetworkProxy_TypeId = 9 - NetworkProxy_TYPE_ID_SWITCH NetworkProxy_TypeId = 10 - NetworkProxy_TYPE_ID_HUB NetworkProxy_TypeId = 11 - NetworkProxy_TYPE_ID_ROUTER NetworkProxy_TypeId = 12 - NetworkProxy_TYPE_ID_IDS NetworkProxy_TypeId = 13 - NetworkProxy_TYPE_ID_IPS NetworkProxy_TypeId = 14 - NetworkProxy_TYPE_ID_LOAD_BALANCER NetworkProxy_TypeId = 15 - NetworkProxy_TYPE_ID_OTHER NetworkProxy_TypeId = 99 + ThreatActor_TYPE_ID_UNKNOWN ThreatActor_TypeId = 0 + ThreatActor_TYPE_ID_NATION_STATE ThreatActor_TypeId = 1 + ThreatActor_TYPE_ID_CYBERCRIMINAL ThreatActor_TypeId = 2 + ThreatActor_TYPE_ID_HACKTIVISTS ThreatActor_TypeId = 3 + ThreatActor_TYPE_ID_INSIDER ThreatActor_TypeId = 4 + ThreatActor_TYPE_ID_OTHER ThreatActor_TypeId = 99 ) -// Enum value maps for NetworkProxy_TypeId. +// Enum value maps for ThreatActor_TypeId. var ( - NetworkProxy_TypeId_name = map[int32]string{ + ThreatActor_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_SERVER", - 2: "TYPE_ID_DESKTOP", - 3: "TYPE_ID_LAPTOP", - 4: "TYPE_ID_TABLET", - 5: "TYPE_ID_MOBILE", - 6: "TYPE_ID_VIRTUAL", - 7: "TYPE_ID_IOT", - 8: "TYPE_ID_BROWSER", - 9: "TYPE_ID_FIREWALL", - 10: "TYPE_ID_SWITCH", - 11: "TYPE_ID_HUB", - 12: "TYPE_ID_ROUTER", - 13: "TYPE_ID_IDS", - 14: "TYPE_ID_IPS", - 15: "TYPE_ID_LOAD_BALANCER", + 1: "TYPE_ID_NATION_STATE", + 2: "TYPE_ID_CYBERCRIMINAL", + 3: "TYPE_ID_HACKTIVISTS", + 4: "TYPE_ID_INSIDER", 99: "TYPE_ID_OTHER", } - NetworkProxy_TypeId_value = map[string]int32{ + ThreatActor_TypeId_value = map[string]int32{ "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_SERVER": 1, - "TYPE_ID_DESKTOP": 2, - "TYPE_ID_LAPTOP": 3, - "TYPE_ID_TABLET": 4, - "TYPE_ID_MOBILE": 5, - "TYPE_ID_VIRTUAL": 6, - "TYPE_ID_IOT": 7, - "TYPE_ID_BROWSER": 8, - "TYPE_ID_FIREWALL": 9, - "TYPE_ID_SWITCH": 10, - "TYPE_ID_HUB": 11, - "TYPE_ID_ROUTER": 12, - "TYPE_ID_IDS": 13, - "TYPE_ID_IPS": 14, - "TYPE_ID_LOAD_BALANCER": 15, + "TYPE_ID_NATION_STATE": 1, + "TYPE_ID_CYBERCRIMINAL": 2, + "TYPE_ID_HACKTIVISTS": 3, + "TYPE_ID_INSIDER": 4, "TYPE_ID_OTHER": 99, } ) -func (x NetworkProxy_TypeId) Enum() *NetworkProxy_TypeId { - p := new(NetworkProxy_TypeId) +func (x ThreatActor_TypeId) Enum() *ThreatActor_TypeId { + p := new(ThreatActor_TypeId) *p = x return p } -func (x NetworkProxy_TypeId) String() string { +func (x ThreatActor_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (NetworkProxy_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[58].Descriptor() +func (ThreatActor_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[56].Descriptor() } -func (NetworkProxy_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[58] +func (ThreatActor_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[56] } -func (x NetworkProxy_TypeId) Number() protoreflect.EnumNumber { +func (x ThreatActor_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use NetworkProxy_TypeId.Descriptor instead. -func (NetworkProxy_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{73, 1} +// Deprecated: Use ThreatActor_TypeId.Descriptor instead. +func (ThreatActor_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{104, 0} } -type Observable_TypeId int32 +type Timespan_TypeId int32 const ( - Observable_TYPE_ID_UNKNOWN Observable_TypeId = 0 - Observable_TYPE_ID_HOSTNAME Observable_TypeId = 1 - Observable_TYPE_ID_IP_ADDRESS Observable_TypeId = 2 - Observable_TYPE_ID_MAC_ADDRESS Observable_TypeId = 3 - Observable_TYPE_ID_USER_NAME Observable_TypeId = 4 - Observable_TYPE_ID_EMAIL_ADDRESS Observable_TypeId = 5 - Observable_TYPE_ID_URL_STRING Observable_TypeId = 6 - Observable_TYPE_ID_FILE_NAME Observable_TypeId = 7 - Observable_TYPE_ID_HASH Observable_TypeId = 8 - Observable_TYPE_ID_PROCESS_NAME Observable_TypeId = 9 - Observable_TYPE_ID_RESOURCE_UID Observable_TypeId = 10 - Observable_TYPE_ID_PORT Observable_TypeId = 11 - Observable_TYPE_ID_SUBNET Observable_TypeId = 12 - Observable_TYPE_ID_COMMAND_LINE Observable_TypeId = 13 - Observable_TYPE_ID_COUNTRY Observable_TypeId = 14 - Observable_TYPE_ID_PROCESS_ID Observable_TypeId = 15 - Observable_TYPE_ID_HTTP_USER_AGENT Observable_TypeId = 16 - Observable_TYPE_ID_CWE_OBJECT_UID Observable_TypeId = 17 - Observable_TYPE_ID_CVE_OBJECT_UID Observable_TypeId = 18 - Observable_TYPE_ID_USER_CREDENTIAL_ID Observable_TypeId = 19 - Observable_TYPE_ID_ENDPOINT Observable_TypeId = 20 - Observable_TYPE_ID_USER Observable_TypeId = 21 - Observable_TYPE_ID_EMAIL Observable_TypeId = 22 - Observable_TYPE_ID_UNIFORM_RESOURCE_LOCATOR Observable_TypeId = 23 - Observable_TYPE_ID_FILE Observable_TypeId = 24 - Observable_TYPE_ID_PROCESS Observable_TypeId = 25 - Observable_TYPE_ID_GEO_LOCATION Observable_TypeId = 26 - Observable_TYPE_ID_CONTAINER Observable_TypeId = 27 - Observable_TYPE_ID_REGISTRY_KEY Observable_TypeId = 28 - Observable_TYPE_ID_REGISTRY_VALUE Observable_TypeId = 29 - Observable_TYPE_ID_FINGERPRINT Observable_TypeId = 30 - Observable_TYPE_ID_USER_OBJECT_UID Observable_TypeId = 31 - Observable_TYPE_ID_GROUP_OBJECT_NAME Observable_TypeId = 32 - Observable_TYPE_ID_GROUP_OBJECT_UID Observable_TypeId = 33 - Observable_TYPE_ID_ACCOUNT_OBJECT_NAME Observable_TypeId = 34 - Observable_TYPE_ID_ACCOUNT_OBJECT_UID Observable_TypeId = 35 - Observable_TYPE_ID_SCRIPT_CONTENT Observable_TypeId = 36 - Observable_TYPE_ID_SERIAL_NUMBER Observable_TypeId = 37 - Observable_TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME Observable_TypeId = 38 - Observable_TYPE_ID_PROCESS_ENTITY_OBJECT_UID Observable_TypeId = 39 - Observable_TYPE_ID_EMAIL_OBJECT_SUBJECT Observable_TypeId = 40 - Observable_TYPE_ID_EMAIL_OBJECT_UID Observable_TypeId = 41 - Observable_TYPE_ID_MESSAGE_UID Observable_TypeId = 42 - Observable_TYPE_ID_REGISTRY_VALUE_OBJECT_NAME Observable_TypeId = 43 - Observable_TYPE_ID_ADVISORY_OBJECT_UID Observable_TypeId = 44 - Observable_TYPE_ID_FILE_PATH Observable_TypeId = 45 - Observable_TYPE_ID_REGISTRY_KEY_PATH Observable_TypeId = 46 - Observable_TYPE_ID_DEVICE_OBJECT_UID Observable_TypeId = 47 - Observable_TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID Observable_TypeId = 48 - Observable_TYPE_ID_OTHER Observable_TypeId = 99 + Timespan_TYPE_ID_UNKNOWN Timespan_TypeId = 0 + Timespan_TYPE_ID_MILLISECONDS Timespan_TypeId = 1 + Timespan_TYPE_ID_SECONDS Timespan_TypeId = 2 + Timespan_TYPE_ID_MINUTES Timespan_TypeId = 3 + Timespan_TYPE_ID_HOURS Timespan_TypeId = 4 + Timespan_TYPE_ID_DAYS Timespan_TypeId = 5 + Timespan_TYPE_ID_WEEKS Timespan_TypeId = 6 + Timespan_TYPE_ID_MONTHS Timespan_TypeId = 7 + Timespan_TYPE_ID_YEARS Timespan_TypeId = 8 + Timespan_TYPE_ID_TIME_INTERVAL Timespan_TypeId = 9 + Timespan_TYPE_ID_OTHER Timespan_TypeId = 99 ) -// Enum value maps for Observable_TypeId. +// Enum value maps for Timespan_TypeId. var ( - Observable_TypeId_name = map[int32]string{ + Timespan_TypeId_name = map[int32]string{ 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_HOSTNAME", - 2: "TYPE_ID_IP_ADDRESS", - 3: "TYPE_ID_MAC_ADDRESS", - 4: "TYPE_ID_USER_NAME", - 5: "TYPE_ID_EMAIL_ADDRESS", - 6: "TYPE_ID_URL_STRING", - 7: "TYPE_ID_FILE_NAME", - 8: "TYPE_ID_HASH", - 9: "TYPE_ID_PROCESS_NAME", - 10: "TYPE_ID_RESOURCE_UID", - 11: "TYPE_ID_PORT", - 12: "TYPE_ID_SUBNET", - 13: "TYPE_ID_COMMAND_LINE", - 14: "TYPE_ID_COUNTRY", - 15: "TYPE_ID_PROCESS_ID", - 16: "TYPE_ID_HTTP_USER_AGENT", - 17: "TYPE_ID_CWE_OBJECT_UID", - 18: "TYPE_ID_CVE_OBJECT_UID", - 19: "TYPE_ID_USER_CREDENTIAL_ID", - 20: "TYPE_ID_ENDPOINT", - 21: "TYPE_ID_USER", - 22: "TYPE_ID_EMAIL", - 23: "TYPE_ID_UNIFORM_RESOURCE_LOCATOR", - 24: "TYPE_ID_FILE", - 25: "TYPE_ID_PROCESS", - 26: "TYPE_ID_GEO_LOCATION", - 27: "TYPE_ID_CONTAINER", - 28: "TYPE_ID_REGISTRY_KEY", - 29: "TYPE_ID_REGISTRY_VALUE", - 30: "TYPE_ID_FINGERPRINT", - 31: "TYPE_ID_USER_OBJECT_UID", - 32: "TYPE_ID_GROUP_OBJECT_NAME", - 33: "TYPE_ID_GROUP_OBJECT_UID", - 34: "TYPE_ID_ACCOUNT_OBJECT_NAME", - 35: "TYPE_ID_ACCOUNT_OBJECT_UID", - 36: "TYPE_ID_SCRIPT_CONTENT", - 37: "TYPE_ID_SERIAL_NUMBER", - 38: "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME", - 39: "TYPE_ID_PROCESS_ENTITY_OBJECT_UID", - 40: "TYPE_ID_EMAIL_OBJECT_SUBJECT", - 41: "TYPE_ID_EMAIL_OBJECT_UID", - 42: "TYPE_ID_MESSAGE_UID", - 43: "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME", - 44: "TYPE_ID_ADVISORY_OBJECT_UID", - 45: "TYPE_ID_FILE_PATH", - 46: "TYPE_ID_REGISTRY_KEY_PATH", - 47: "TYPE_ID_DEVICE_OBJECT_UID", - 48: "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID", + 1: "TYPE_ID_MILLISECONDS", + 2: "TYPE_ID_SECONDS", + 3: "TYPE_ID_MINUTES", + 4: "TYPE_ID_HOURS", + 5: "TYPE_ID_DAYS", + 6: "TYPE_ID_WEEKS", + 7: "TYPE_ID_MONTHS", + 8: "TYPE_ID_YEARS", + 9: "TYPE_ID_TIME_INTERVAL", 99: "TYPE_ID_OTHER", } - Observable_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_HOSTNAME": 1, - "TYPE_ID_IP_ADDRESS": 2, - "TYPE_ID_MAC_ADDRESS": 3, - "TYPE_ID_USER_NAME": 4, - "TYPE_ID_EMAIL_ADDRESS": 5, - "TYPE_ID_URL_STRING": 6, - "TYPE_ID_FILE_NAME": 7, - "TYPE_ID_HASH": 8, - "TYPE_ID_PROCESS_NAME": 9, - "TYPE_ID_RESOURCE_UID": 10, - "TYPE_ID_PORT": 11, - "TYPE_ID_SUBNET": 12, - "TYPE_ID_COMMAND_LINE": 13, - "TYPE_ID_COUNTRY": 14, - "TYPE_ID_PROCESS_ID": 15, - "TYPE_ID_HTTP_USER_AGENT": 16, - "TYPE_ID_CWE_OBJECT_UID": 17, - "TYPE_ID_CVE_OBJECT_UID": 18, - "TYPE_ID_USER_CREDENTIAL_ID": 19, - "TYPE_ID_ENDPOINT": 20, - "TYPE_ID_USER": 21, - "TYPE_ID_EMAIL": 22, - "TYPE_ID_UNIFORM_RESOURCE_LOCATOR": 23, - "TYPE_ID_FILE": 24, - "TYPE_ID_PROCESS": 25, - "TYPE_ID_GEO_LOCATION": 26, - "TYPE_ID_CONTAINER": 27, - "TYPE_ID_REGISTRY_KEY": 28, - "TYPE_ID_REGISTRY_VALUE": 29, - "TYPE_ID_FINGERPRINT": 30, - "TYPE_ID_USER_OBJECT_UID": 31, - "TYPE_ID_GROUP_OBJECT_NAME": 32, - "TYPE_ID_GROUP_OBJECT_UID": 33, - "TYPE_ID_ACCOUNT_OBJECT_NAME": 34, - "TYPE_ID_ACCOUNT_OBJECT_UID": 35, - "TYPE_ID_SCRIPT_CONTENT": 36, - "TYPE_ID_SERIAL_NUMBER": 37, - "TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME": 38, - "TYPE_ID_PROCESS_ENTITY_OBJECT_UID": 39, - "TYPE_ID_EMAIL_OBJECT_SUBJECT": 40, - "TYPE_ID_EMAIL_OBJECT_UID": 41, - "TYPE_ID_MESSAGE_UID": 42, - "TYPE_ID_REGISTRY_VALUE_OBJECT_NAME": 43, - "TYPE_ID_ADVISORY_OBJECT_UID": 44, - "TYPE_ID_FILE_PATH": 45, - "TYPE_ID_REGISTRY_KEY_PATH": 46, - "TYPE_ID_DEVICE_OBJECT_UID": 47, - "TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID": 48, - "TYPE_ID_OTHER": 99, + Timespan_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_MILLISECONDS": 1, + "TYPE_ID_SECONDS": 2, + "TYPE_ID_MINUTES": 3, + "TYPE_ID_HOURS": 4, + "TYPE_ID_DAYS": 5, + "TYPE_ID_WEEKS": 6, + "TYPE_ID_MONTHS": 7, + "TYPE_ID_YEARS": 8, + "TYPE_ID_TIME_INTERVAL": 9, + "TYPE_ID_OTHER": 99, } ) -func (x Observable_TypeId) Enum() *Observable_TypeId { - p := new(Observable_TypeId) +func (x Timespan_TypeId) Enum() *Timespan_TypeId { + p := new(Timespan_TypeId) *p = x return p } -func (x Observable_TypeId) String() string { +func (x Timespan_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Observable_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[59].Descriptor() +func (Timespan_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[57].Descriptor() } -func (Observable_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[59] +func (Timespan_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[57] } -func (x Observable_TypeId) Number() protoreflect.EnumNumber { +func (x Timespan_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Observable_TypeId.Descriptor instead. -func (Observable_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{75, 0} +// Deprecated: Use Timespan_TypeId.Descriptor instead. +func (Timespan_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{105, 0} } -type Os_TypeId int32 +type Token_TypeId int32 const ( - Os_TYPE_ID_UNKNOWN Os_TypeId = 0 - Os_TYPE_ID_OTHER Os_TypeId = 99 - Os_TYPE_ID_WINDOWS Os_TypeId = 100 - Os_TYPE_ID_WINDOWS_MOBILE Os_TypeId = 101 - Os_TYPE_ID_LINUX Os_TypeId = 200 - Os_TYPE_ID_ANDROID Os_TypeId = 201 - Os_TYPE_ID_MACOS Os_TypeId = 300 - Os_TYPE_ID_IOS Os_TypeId = 301 - Os_TYPE_ID_IPADOS Os_TypeId = 302 - Os_TYPE_ID_SOLARIS Os_TypeId = 400 - Os_TYPE_ID_AIX Os_TypeId = 401 - Os_TYPE_ID_HP_UX Os_TypeId = 402 + Token_TYPE_ID_UNKNOWN Token_TypeId = 0 + Token_TYPE_ID_TICKET_GRANTING_TICKET Token_TypeId = 1 + Token_TYPE_ID_SERVICE_TICKET Token_TypeId = 2 + Token_TYPE_ID_IDENTITY_TOKEN Token_TypeId = 3 + Token_TYPE_ID_REFRESH_TOKEN Token_TypeId = 4 + Token_TYPE_ID_SAML_ASSERTION Token_TypeId = 5 + Token_TYPE_ID_CLIENT_TOKEN Token_TypeId = 6 + Token_TYPE_ID_API_TOKEN Token_TypeId = 7 + Token_TYPE_ID_OTHER Token_TypeId = 99 ) -// Enum value maps for Os_TypeId. +// Enum value maps for Token_TypeId. var ( - Os_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 99: "TYPE_ID_OTHER", - 100: "TYPE_ID_WINDOWS", - 101: "TYPE_ID_WINDOWS_MOBILE", - 200: "TYPE_ID_LINUX", - 201: "TYPE_ID_ANDROID", - 300: "TYPE_ID_MACOS", - 301: "TYPE_ID_IOS", - 302: "TYPE_ID_IPADOS", - 400: "TYPE_ID_SOLARIS", - 401: "TYPE_ID_AIX", - 402: "TYPE_ID_HP_UX", + Token_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_TICKET_GRANTING_TICKET", + 2: "TYPE_ID_SERVICE_TICKET", + 3: "TYPE_ID_IDENTITY_TOKEN", + 4: "TYPE_ID_REFRESH_TOKEN", + 5: "TYPE_ID_SAML_ASSERTION", + 6: "TYPE_ID_CLIENT_TOKEN", + 7: "TYPE_ID_API_TOKEN", + 99: "TYPE_ID_OTHER", } - Os_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_OTHER": 99, - "TYPE_ID_WINDOWS": 100, - "TYPE_ID_WINDOWS_MOBILE": 101, - "TYPE_ID_LINUX": 200, - "TYPE_ID_ANDROID": 201, - "TYPE_ID_MACOS": 300, - "TYPE_ID_IOS": 301, - "TYPE_ID_IPADOS": 302, - "TYPE_ID_SOLARIS": 400, - "TYPE_ID_AIX": 401, - "TYPE_ID_HP_UX": 402, + Token_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_TICKET_GRANTING_TICKET": 1, + "TYPE_ID_SERVICE_TICKET": 2, + "TYPE_ID_IDENTITY_TOKEN": 3, + "TYPE_ID_REFRESH_TOKEN": 4, + "TYPE_ID_SAML_ASSERTION": 5, + "TYPE_ID_CLIENT_TOKEN": 6, + "TYPE_ID_API_TOKEN": 7, + "TYPE_ID_OTHER": 99, } ) -func (x Os_TypeId) Enum() *Os_TypeId { - p := new(Os_TypeId) +func (x Token_TypeId) Enum() *Token_TypeId { + p := new(Token_TypeId) *p = x return p } -func (x Os_TypeId) String() string { +func (x Token_TypeId) String() string { return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (Os_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[60].Descriptor() +func (Token_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[58].Descriptor() } -func (Os_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[60] +func (Token_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[58] } -func (x Os_TypeId) Number() protoreflect.EnumNumber { +func (x Token_TypeId) Number() protoreflect.EnumNumber { return protoreflect.EnumNumber(x) } -// Deprecated: Use Os_TypeId.Descriptor instead. -func (Os_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{78, 0} +// Deprecated: Use Token_TypeId.Descriptor instead. +func (Token_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{106, 0} } -type Osint_ConfidenceId int32 +type Url_CategoryIds int32 const ( - Osint_CONFIDENCE_ID_UNKNOWN Osint_ConfidenceId = 0 - Osint_CONFIDENCE_ID_LOW Osint_ConfidenceId = 1 - Osint_CONFIDENCE_ID_MEDIUM Osint_ConfidenceId = 2 - Osint_CONFIDENCE_ID_HIGH Osint_ConfidenceId = 3 - Osint_CONFIDENCE_ID_OTHER Osint_ConfidenceId = 99 -) - -// Enum value maps for Osint_ConfidenceId. -var ( - Osint_ConfidenceId_name = map[int32]string{ - 0: "CONFIDENCE_ID_UNKNOWN", - 1: "CONFIDENCE_ID_LOW", - 2: "CONFIDENCE_ID_MEDIUM", - 3: "CONFIDENCE_ID_HIGH", - 99: "CONFIDENCE_ID_OTHER", - } - Osint_ConfidenceId_value = map[string]int32{ - "CONFIDENCE_ID_UNKNOWN": 0, - "CONFIDENCE_ID_LOW": 1, - "CONFIDENCE_ID_MEDIUM": 2, - "CONFIDENCE_ID_HIGH": 3, - "CONFIDENCE_ID_OTHER": 99, - } -) - -func (x Osint_ConfidenceId) Enum() *Osint_ConfidenceId { - p := new(Osint_ConfidenceId) - *p = x - return p -} - -func (x Osint_ConfidenceId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Osint_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[61].Descriptor() -} - -func (Osint_ConfidenceId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[61] -} - -func (x Osint_ConfidenceId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Osint_ConfidenceId.Descriptor instead. -func (Osint_ConfidenceId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{79, 0} -} - -type Osint_DetectionPatternTypeId int32 - -const ( - Osint_DETECTION_PATTERN_TYPE_ID_UNKNOWN Osint_DetectionPatternTypeId = 0 - Osint_DETECTION_PATTERN_TYPE_ID_STIX Osint_DetectionPatternTypeId = 1 - Osint_DETECTION_PATTERN_TYPE_ID_PCRE Osint_DetectionPatternTypeId = 2 - Osint_DETECTION_PATTERN_TYPE_ID_SIGMA Osint_DetectionPatternTypeId = 3 - Osint_DETECTION_PATTERN_TYPE_ID_SNORT Osint_DetectionPatternTypeId = 4 - Osint_DETECTION_PATTERN_TYPE_ID_SURICATA Osint_DetectionPatternTypeId = 5 - Osint_DETECTION_PATTERN_TYPE_ID_YARA Osint_DetectionPatternTypeId = 6 - Osint_DETECTION_PATTERN_TYPE_ID_OTHER Osint_DetectionPatternTypeId = 99 -) - -// Enum value maps for Osint_DetectionPatternTypeId. -var ( - Osint_DetectionPatternTypeId_name = map[int32]string{ - 0: "DETECTION_PATTERN_TYPE_ID_UNKNOWN", - 1: "DETECTION_PATTERN_TYPE_ID_STIX", - 2: "DETECTION_PATTERN_TYPE_ID_PCRE", - 3: "DETECTION_PATTERN_TYPE_ID_SIGMA", - 4: "DETECTION_PATTERN_TYPE_ID_SNORT", - 5: "DETECTION_PATTERN_TYPE_ID_SURICATA", - 6: "DETECTION_PATTERN_TYPE_ID_YARA", - 99: "DETECTION_PATTERN_TYPE_ID_OTHER", - } - Osint_DetectionPatternTypeId_value = map[string]int32{ - "DETECTION_PATTERN_TYPE_ID_UNKNOWN": 0, - "DETECTION_PATTERN_TYPE_ID_STIX": 1, - "DETECTION_PATTERN_TYPE_ID_PCRE": 2, - "DETECTION_PATTERN_TYPE_ID_SIGMA": 3, - "DETECTION_PATTERN_TYPE_ID_SNORT": 4, - "DETECTION_PATTERN_TYPE_ID_SURICATA": 5, - "DETECTION_PATTERN_TYPE_ID_YARA": 6, - "DETECTION_PATTERN_TYPE_ID_OTHER": 99, - } -) - -func (x Osint_DetectionPatternTypeId) Enum() *Osint_DetectionPatternTypeId { - p := new(Osint_DetectionPatternTypeId) - *p = x - return p -} - -func (x Osint_DetectionPatternTypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Osint_DetectionPatternTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[62].Descriptor() -} - -func (Osint_DetectionPatternTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[62] -} - -func (x Osint_DetectionPatternTypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Osint_DetectionPatternTypeId.Descriptor instead. -func (Osint_DetectionPatternTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{79, 1} -} - -type Osint_SeverityId int32 - -const ( - Osint_SEVERITY_ID_UNKNOWN Osint_SeverityId = 0 - Osint_SEVERITY_ID_INFORMATIONAL Osint_SeverityId = 1 - Osint_SEVERITY_ID_LOW Osint_SeverityId = 2 - Osint_SEVERITY_ID_MEDIUM Osint_SeverityId = 3 - Osint_SEVERITY_ID_HIGH Osint_SeverityId = 4 - Osint_SEVERITY_ID_CRITICAL Osint_SeverityId = 5 - Osint_SEVERITY_ID_FATAL Osint_SeverityId = 6 - Osint_SEVERITY_ID_OTHER Osint_SeverityId = 99 -) - -// Enum value maps for Osint_SeverityId. -var ( - Osint_SeverityId_name = map[int32]string{ - 0: "SEVERITY_ID_UNKNOWN", - 1: "SEVERITY_ID_INFORMATIONAL", - 2: "SEVERITY_ID_LOW", - 3: "SEVERITY_ID_MEDIUM", - 4: "SEVERITY_ID_HIGH", - 5: "SEVERITY_ID_CRITICAL", - 6: "SEVERITY_ID_FATAL", - 99: "SEVERITY_ID_OTHER", - } - Osint_SeverityId_value = map[string]int32{ - "SEVERITY_ID_UNKNOWN": 0, - "SEVERITY_ID_INFORMATIONAL": 1, - "SEVERITY_ID_LOW": 2, - "SEVERITY_ID_MEDIUM": 3, - "SEVERITY_ID_HIGH": 4, - "SEVERITY_ID_CRITICAL": 5, - "SEVERITY_ID_FATAL": 6, - "SEVERITY_ID_OTHER": 99, - } -) - -func (x Osint_SeverityId) Enum() *Osint_SeverityId { - p := new(Osint_SeverityId) - *p = x - return p -} - -func (x Osint_SeverityId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Osint_SeverityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[63].Descriptor() -} - -func (Osint_SeverityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[63] -} - -func (x Osint_SeverityId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Osint_SeverityId.Descriptor instead. -func (Osint_SeverityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{79, 2} -} - -type Osint_TypeId int32 - -const ( - Osint_TYPE_ID_UNKNOWN Osint_TypeId = 0 - Osint_TYPE_ID_IP_ADDRESS Osint_TypeId = 1 - Osint_TYPE_ID_DOMAIN Osint_TypeId = 2 - Osint_TYPE_ID_HOSTNAME Osint_TypeId = 3 - Osint_TYPE_ID_HASH Osint_TypeId = 4 - Osint_TYPE_ID_URL Osint_TypeId = 5 - Osint_TYPE_ID_USER_AGENT Osint_TypeId = 6 - Osint_TYPE_ID_DIGITAL_CERTIFICATE Osint_TypeId = 7 - Osint_TYPE_ID_EMAIL Osint_TypeId = 8 - Osint_TYPE_ID_EMAIL_ADDRESS Osint_TypeId = 9 - Osint_TYPE_ID_VULNERABILITY Osint_TypeId = 10 - Osint_TYPE_ID_FILE Osint_TypeId = 11 - Osint_TYPE_ID_REGISTRY_KEY Osint_TypeId = 12 - Osint_TYPE_ID_REGISTRY_VALUE Osint_TypeId = 13 - Osint_TYPE_ID_COMMAND_LINE Osint_TypeId = 14 - Osint_TYPE_ID_OTHER Osint_TypeId = 99 + Url_CATEGORY_IDS_UNKNOWN Url_CategoryIds = 0 + Url_CATEGORY_IDS_ADULT_MATURE_CONTENT Url_CategoryIds = 1 + Url_CATEGORY_IDS_PORNOGRAPHY Url_CategoryIds = 3 + Url_CATEGORY_IDS_SEX_EDUCATION Url_CategoryIds = 4 + Url_CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT Url_CategoryIds = 5 + Url_CATEGORY_IDS_NUDITY Url_CategoryIds = 6 + Url_CATEGORY_IDS_EXTREME Url_CategoryIds = 7 + Url_CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL Url_CategoryIds = 9 + Url_CATEGORY_IDS_GAMBLING Url_CategoryIds = 11 + Url_CATEGORY_IDS_VIOLENCE_HATE_RACISM Url_CategoryIds = 14 + Url_CATEGORY_IDS_WEAPONS Url_CategoryIds = 15 + Url_CATEGORY_IDS_ABORTION Url_CategoryIds = 16 + Url_CATEGORY_IDS_HACKING Url_CategoryIds = 17 + Url_CATEGORY_IDS_PHISHING Url_CategoryIds = 18 + Url_CATEGORY_IDS_ENTERTAINMENT Url_CategoryIds = 20 + Url_CATEGORY_IDS_BUSINESS_ECONOMY Url_CategoryIds = 21 + Url_CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF Url_CategoryIds = 22 + Url_CATEGORY_IDS_ALCOHOL Url_CategoryIds = 23 + Url_CATEGORY_IDS_TOBACCO Url_CategoryIds = 24 + Url_CATEGORY_IDS_CONTROLLED_SUBSTANCES Url_CategoryIds = 25 + Url_CATEGORY_IDS_CHILD_PORNOGRAPHY Url_CategoryIds = 26 + Url_CATEGORY_IDS_EDUCATION Url_CategoryIds = 27 + Url_CATEGORY_IDS_CHARITABLE_ORGANIZATIONS Url_CategoryIds = 29 + Url_CATEGORY_IDS_ART_CULTURE Url_CategoryIds = 30 + Url_CATEGORY_IDS_FINANCIAL_SERVICES Url_CategoryIds = 31 + Url_CATEGORY_IDS_BROKERAGE_TRADING Url_CategoryIds = 32 + Url_CATEGORY_IDS_GAMES Url_CategoryIds = 33 + Url_CATEGORY_IDS_GOVERNMENT_LEGAL Url_CategoryIds = 34 + Url_CATEGORY_IDS_MILITARY Url_CategoryIds = 35 + Url_CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY Url_CategoryIds = 36 + Url_CATEGORY_IDS_HEALTH Url_CategoryIds = 37 + Url_CATEGORY_IDS_TECHNOLOGY_INTERNET Url_CategoryIds = 38 + Url_CATEGORY_IDS_SEARCH_ENGINES_PORTALS Url_CategoryIds = 40 + Url_CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS Url_CategoryIds = 43 + Url_CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS Url_CategoryIds = 44 + Url_CATEGORY_IDS_JOB_SEARCH_CAREERS Url_CategoryIds = 45 + Url_CATEGORY_IDS_NEWS_MEDIA Url_CategoryIds = 46 + Url_CATEGORY_IDS_PERSONALS_DATING Url_CategoryIds = 47 + Url_CATEGORY_IDS_REFERENCE Url_CategoryIds = 49 + Url_CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT Url_CategoryIds = 50 + Url_CATEGORY_IDS_CHAT_IM_SMS Url_CategoryIds = 51 + Url_CATEGORY_IDS_EMAIL Url_CategoryIds = 52 + Url_CATEGORY_IDS_NEWSGROUPS_FORUMS Url_CategoryIds = 53 + Url_CATEGORY_IDS_RELIGION Url_CategoryIds = 54 + Url_CATEGORY_IDS_SOCIAL_NETWORKING Url_CategoryIds = 55 + Url_CATEGORY_IDS_FILE_STORAGE_SHARING Url_CategoryIds = 56 + Url_CATEGORY_IDS_REMOTE_ACCESS_TOOLS Url_CategoryIds = 57 + Url_CATEGORY_IDS_SHOPPING Url_CategoryIds = 58 + Url_CATEGORY_IDS_AUCTIONS Url_CategoryIds = 59 + Url_CATEGORY_IDS_REAL_ESTATE Url_CategoryIds = 60 + Url_CATEGORY_IDS_SOCIETY_DAILY_LIVING Url_CategoryIds = 61 + Url_CATEGORY_IDS_PERSONAL_SITES Url_CategoryIds = 63 + Url_CATEGORY_IDS_RESTAURANTS_DINING_FOOD Url_CategoryIds = 64 + Url_CATEGORY_IDS_SPORTS_RECREATION Url_CategoryIds = 65 + Url_CATEGORY_IDS_TRAVEL Url_CategoryIds = 66 + Url_CATEGORY_IDS_VEHICLES Url_CategoryIds = 67 + Url_CATEGORY_IDS_HUMOR_JOKES Url_CategoryIds = 68 + Url_CATEGORY_IDS_SOFTWARE_DOWNLOADS Url_CategoryIds = 71 + Url_CATEGORY_IDS_PEER_TO_PEER_P2P Url_CategoryIds = 83 + Url_CATEGORY_IDS_AUDIO_VIDEO_CLIPS Url_CategoryIds = 84 + Url_CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS Url_CategoryIds = 85 + Url_CATEGORY_IDS_PROXY_AVOIDANCE Url_CategoryIds = 86 + Url_CATEGORY_IDS_FOR_KIDS Url_CategoryIds = 87 + Url_CATEGORY_IDS_WEB_ADS_ANALYTICS Url_CategoryIds = 88 + Url_CATEGORY_IDS_WEB_HOSTING Url_CategoryIds = 89 + Url_CATEGORY_IDS_UNCATEGORIZED Url_CategoryIds = 90 + Url_CATEGORY_IDS_SUSPICIOUS Url_CategoryIds = 92 + Url_CATEGORY_IDS_SEXUAL_EXPRESSION Url_CategoryIds = 93 + Url_CATEGORY_IDS_TRANSLATION Url_CategoryIds = 95 + Url_CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE Url_CategoryIds = 96 + Url_CATEGORY_IDS_CONTENT_SERVERS Url_CategoryIds = 97 + Url_CATEGORY_IDS_PLACEHOLDERS Url_CategoryIds = 98 + Url_CATEGORY_IDS_OTHER Url_CategoryIds = 99 + Url_CATEGORY_IDS_SPAM Url_CategoryIds = 101 + Url_CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE Url_CategoryIds = 102 + Url_CATEGORY_IDS_DYNAMIC_DNS_HOST Url_CategoryIds = 103 + Url_CATEGORY_IDS_E_CARD_INVITATIONS Url_CategoryIds = 106 + Url_CATEGORY_IDS_INFORMATIONAL Url_CategoryIds = 107 + Url_CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY Url_CategoryIds = 108 + Url_CATEGORY_IDS_INTERNET_CONNECTED_DEVICES Url_CategoryIds = 109 + Url_CATEGORY_IDS_INTERNET_TELEPHONY Url_CategoryIds = 110 + Url_CATEGORY_IDS_ONLINE_MEETINGS Url_CategoryIds = 111 + Url_CATEGORY_IDS_MEDIA_SHARING Url_CategoryIds = 112 + Url_CATEGORY_IDS_RADIO_AUDIO_STREAMS Url_CategoryIds = 113 + Url_CATEGORY_IDS_TV_VIDEO_STREAMS Url_CategoryIds = 114 + Url_CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS Url_CategoryIds = 118 + Url_CATEGORY_IDS_MARIJUANA Url_CategoryIds = 121 ) -// Enum value maps for Osint_TypeId. +// Enum value maps for Url_CategoryIds. var ( - Osint_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_IP_ADDRESS", - 2: "TYPE_ID_DOMAIN", - 3: "TYPE_ID_HOSTNAME", - 4: "TYPE_ID_HASH", - 5: "TYPE_ID_URL", - 6: "TYPE_ID_USER_AGENT", - 7: "TYPE_ID_DIGITAL_CERTIFICATE", - 8: "TYPE_ID_EMAIL", - 9: "TYPE_ID_EMAIL_ADDRESS", - 10: "TYPE_ID_VULNERABILITY", - 11: "TYPE_ID_FILE", - 12: "TYPE_ID_REGISTRY_KEY", - 13: "TYPE_ID_REGISTRY_VALUE", - 14: "TYPE_ID_COMMAND_LINE", - 99: "TYPE_ID_OTHER", - } - Osint_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_IP_ADDRESS": 1, - "TYPE_ID_DOMAIN": 2, - "TYPE_ID_HOSTNAME": 3, - "TYPE_ID_HASH": 4, - "TYPE_ID_URL": 5, - "TYPE_ID_USER_AGENT": 6, - "TYPE_ID_DIGITAL_CERTIFICATE": 7, - "TYPE_ID_EMAIL": 8, - "TYPE_ID_EMAIL_ADDRESS": 9, - "TYPE_ID_VULNERABILITY": 10, - "TYPE_ID_FILE": 11, - "TYPE_ID_REGISTRY_KEY": 12, - "TYPE_ID_REGISTRY_VALUE": 13, - "TYPE_ID_COMMAND_LINE": 14, - "TYPE_ID_OTHER": 99, - } -) - -func (x Osint_TypeId) Enum() *Osint_TypeId { - p := new(Osint_TypeId) - *p = x - return p -} - -func (x Osint_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Osint_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[64].Descriptor() -} - -func (Osint_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[64] -} - -func (x Osint_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Osint_TypeId.Descriptor instead. -func (Osint_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{79, 3} -} - -type Package_TypeId int32 - -const ( - Package_TYPE_ID_UNKNOWN Package_TypeId = 0 - Package_TYPE_ID_APPLICATION Package_TypeId = 1 - Package_TYPE_ID_OPERATING_SYSTEM Package_TypeId = 2 - Package_TYPE_ID_OTHER Package_TypeId = 99 -) - -// Enum value maps for Package_TypeId. -var ( - Package_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_APPLICATION", - 2: "TYPE_ID_OPERATING_SYSTEM", - 99: "TYPE_ID_OTHER", - } - Package_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_APPLICATION": 1, - "TYPE_ID_OPERATING_SYSTEM": 2, - "TYPE_ID_OTHER": 99, - } -) - -func (x Package_TypeId) Enum() *Package_TypeId { - p := new(Package_TypeId) - *p = x - return p -} - -func (x Package_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Package_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[65].Descriptor() -} - -func (Package_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[65] -} - -func (x Package_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Package_TypeId.Descriptor instead. -func (Package_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{80, 0} -} - -type Process_IntegrityId int32 - -const ( - Process_INTEGRITY_ID_UNKNOWN Process_IntegrityId = 0 - Process_INTEGRITY_ID_UNTRUSTED Process_IntegrityId = 1 - Process_INTEGRITY_ID_LOW Process_IntegrityId = 2 - Process_INTEGRITY_ID_MEDIUM Process_IntegrityId = 3 - Process_INTEGRITY_ID_HIGH Process_IntegrityId = 4 - Process_INTEGRITY_ID_SYSTEM Process_IntegrityId = 5 - Process_INTEGRITY_ID_PROTECTED Process_IntegrityId = 6 - Process_INTEGRITY_ID_OTHER Process_IntegrityId = 99 -) - -// Enum value maps for Process_IntegrityId. -var ( - Process_IntegrityId_name = map[int32]string{ - 0: "INTEGRITY_ID_UNKNOWN", - 1: "INTEGRITY_ID_UNTRUSTED", - 2: "INTEGRITY_ID_LOW", - 3: "INTEGRITY_ID_MEDIUM", - 4: "INTEGRITY_ID_HIGH", - 5: "INTEGRITY_ID_SYSTEM", - 6: "INTEGRITY_ID_PROTECTED", - 99: "INTEGRITY_ID_OTHER", - } - Process_IntegrityId_value = map[string]int32{ - "INTEGRITY_ID_UNKNOWN": 0, - "INTEGRITY_ID_UNTRUSTED": 1, - "INTEGRITY_ID_LOW": 2, - "INTEGRITY_ID_MEDIUM": 3, - "INTEGRITY_ID_HIGH": 4, - "INTEGRITY_ID_SYSTEM": 5, - "INTEGRITY_ID_PROTECTED": 6, - "INTEGRITY_ID_OTHER": 99, - } -) - -func (x Process_IntegrityId) Enum() *Process_IntegrityId { - p := new(Process_IntegrityId) - *p = x - return p -} - -func (x Process_IntegrityId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Process_IntegrityId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[66].Descriptor() -} - -func (Process_IntegrityId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[66] -} - -func (x Process_IntegrityId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Process_IntegrityId.Descriptor instead. -func (Process_IntegrityId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{83, 0} -} - -type Reputation_ScoreId int32 - -const ( - Reputation_SCORE_ID_UNKNOWN Reputation_ScoreId = 0 - Reputation_SCORE_ID_VERY_SAFE Reputation_ScoreId = 1 - Reputation_SCORE_ID_SAFE Reputation_ScoreId = 2 - Reputation_SCORE_ID_PROBABLY_SAFE Reputation_ScoreId = 3 - Reputation_SCORE_ID_LEANS_SAFE Reputation_ScoreId = 4 - Reputation_SCORE_ID_MAY_NOT_BE_SAFE Reputation_ScoreId = 5 - Reputation_SCORE_ID_EXERCISE_CAUTION Reputation_ScoreId = 6 - Reputation_SCORE_ID_SUSPICIOUS_RISKY Reputation_ScoreId = 7 - Reputation_SCORE_ID_POSSIBLY_MALICIOUS Reputation_ScoreId = 8 - Reputation_SCORE_ID_PROBABLY_MALICIOUS Reputation_ScoreId = 9 - Reputation_SCORE_ID_MALICIOUS Reputation_ScoreId = 10 - Reputation_SCORE_ID_OTHER Reputation_ScoreId = 99 -) - -// Enum value maps for Reputation_ScoreId. -var ( - Reputation_ScoreId_name = map[int32]string{ - 0: "SCORE_ID_UNKNOWN", - 1: "SCORE_ID_VERY_SAFE", - 2: "SCORE_ID_SAFE", - 3: "SCORE_ID_PROBABLY_SAFE", - 4: "SCORE_ID_LEANS_SAFE", - 5: "SCORE_ID_MAY_NOT_BE_SAFE", - 6: "SCORE_ID_EXERCISE_CAUTION", - 7: "SCORE_ID_SUSPICIOUS_RISKY", - 8: "SCORE_ID_POSSIBLY_MALICIOUS", - 9: "SCORE_ID_PROBABLY_MALICIOUS", - 10: "SCORE_ID_MALICIOUS", - 99: "SCORE_ID_OTHER", - } - Reputation_ScoreId_value = map[string]int32{ - "SCORE_ID_UNKNOWN": 0, - "SCORE_ID_VERY_SAFE": 1, - "SCORE_ID_SAFE": 2, - "SCORE_ID_PROBABLY_SAFE": 3, - "SCORE_ID_LEANS_SAFE": 4, - "SCORE_ID_MAY_NOT_BE_SAFE": 5, - "SCORE_ID_EXERCISE_CAUTION": 6, - "SCORE_ID_SUSPICIOUS_RISKY": 7, - "SCORE_ID_POSSIBLY_MALICIOUS": 8, - "SCORE_ID_PROBABLY_MALICIOUS": 9, - "SCORE_ID_MALICIOUS": 10, - "SCORE_ID_OTHER": 99, - } -) - -func (x Reputation_ScoreId) Enum() *Reputation_ScoreId { - p := new(Reputation_ScoreId) - *p = x - return p -} - -func (x Reputation_ScoreId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Reputation_ScoreId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[67].Descriptor() -} - -func (Reputation_ScoreId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[67] -} - -func (x Reputation_ScoreId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Reputation_ScoreId.Descriptor instead. -func (Reputation_ScoreId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{89, 0} -} - -type ResourceDetails_RoleId int32 - -const ( - ResourceDetails_ROLE_ID_UNKNOWN ResourceDetails_RoleId = 0 - ResourceDetails_ROLE_ID_TARGET ResourceDetails_RoleId = 1 - ResourceDetails_ROLE_ID_ACTOR ResourceDetails_RoleId = 2 - ResourceDetails_ROLE_ID_AFFECTED ResourceDetails_RoleId = 3 - ResourceDetails_ROLE_ID_RELATED ResourceDetails_RoleId = 4 - ResourceDetails_ROLE_ID_OTHER ResourceDetails_RoleId = 99 -) - -// Enum value maps for ResourceDetails_RoleId. -var ( - ResourceDetails_RoleId_name = map[int32]string{ - 0: "ROLE_ID_UNKNOWN", - 1: "ROLE_ID_TARGET", - 2: "ROLE_ID_ACTOR", - 3: "ROLE_ID_AFFECTED", - 4: "ROLE_ID_RELATED", - 99: "ROLE_ID_OTHER", - } - ResourceDetails_RoleId_value = map[string]int32{ - "ROLE_ID_UNKNOWN": 0, - "ROLE_ID_TARGET": 1, - "ROLE_ID_ACTOR": 2, - "ROLE_ID_AFFECTED": 3, - "ROLE_ID_RELATED": 4, - "ROLE_ID_OTHER": 99, - } -) - -func (x ResourceDetails_RoleId) Enum() *ResourceDetails_RoleId { - p := new(ResourceDetails_RoleId) - *p = x - return p -} - -func (x ResourceDetails_RoleId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ResourceDetails_RoleId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[68].Descriptor() -} - -func (ResourceDetails_RoleId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[68] -} - -func (x ResourceDetails_RoleId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ResourceDetails_RoleId.Descriptor instead. -func (ResourceDetails_RoleId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{91, 0} -} - -type Sbom_TypeId int32 - -const ( - Sbom_TYPE_ID_UNKNOWN Sbom_TypeId = 0 - Sbom_TYPE_ID_SPDX Sbom_TypeId = 1 - Sbom_TYPE_ID_CYCLONEDX Sbom_TypeId = 2 - Sbom_TYPE_ID_SWID Sbom_TypeId = 3 - Sbom_TYPE_ID_OTHER Sbom_TypeId = 99 -) - -// Enum value maps for Sbom_TypeId. -var ( - Sbom_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_SPDX", - 2: "TYPE_ID_CYCLONEDX", - 3: "TYPE_ID_SWID", - 99: "TYPE_ID_OTHER", - } - Sbom_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_SPDX": 1, - "TYPE_ID_CYCLONEDX": 2, - "TYPE_ID_SWID": 3, - "TYPE_ID_OTHER": 99, - } -) - -func (x Sbom_TypeId) Enum() *Sbom_TypeId { - p := new(Sbom_TypeId) - *p = x - return p -} - -func (x Sbom_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Sbom_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[69].Descriptor() -} - -func (Sbom_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[69] -} - -func (x Sbom_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Sbom_TypeId.Descriptor instead. -func (Sbom_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{95, 0} -} - -type Scim_AuthProtocolId int32 - -const ( - Scim_AUTH_PROTOCOL_ID_UNKNOWN Scim_AuthProtocolId = 0 - Scim_AUTH_PROTOCOL_ID_NTLM Scim_AuthProtocolId = 1 - Scim_AUTH_PROTOCOL_ID_KERBEROS Scim_AuthProtocolId = 2 - Scim_AUTH_PROTOCOL_ID_DIGEST Scim_AuthProtocolId = 3 - Scim_AUTH_PROTOCOL_ID_OPENID Scim_AuthProtocolId = 4 - Scim_AUTH_PROTOCOL_ID_SAML Scim_AuthProtocolId = 5 - Scim_AUTH_PROTOCOL_ID_OAUTH_2_0 Scim_AuthProtocolId = 6 - Scim_AUTH_PROTOCOL_ID_PAP Scim_AuthProtocolId = 7 - Scim_AUTH_PROTOCOL_ID_CHAP Scim_AuthProtocolId = 8 - Scim_AUTH_PROTOCOL_ID_EAP Scim_AuthProtocolId = 9 - Scim_AUTH_PROTOCOL_ID_RADIUS Scim_AuthProtocolId = 10 - Scim_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Scim_AuthProtocolId = 11 - Scim_AUTH_PROTOCOL_ID_LDAP Scim_AuthProtocolId = 12 - Scim_AUTH_PROTOCOL_ID_OTHER Scim_AuthProtocolId = 99 -) - -// Enum value maps for Scim_AuthProtocolId. -var ( - Scim_AuthProtocolId_name = map[int32]string{ - 0: "AUTH_PROTOCOL_ID_UNKNOWN", - 1: "AUTH_PROTOCOL_ID_NTLM", - 2: "AUTH_PROTOCOL_ID_KERBEROS", - 3: "AUTH_PROTOCOL_ID_DIGEST", - 4: "AUTH_PROTOCOL_ID_OPENID", - 5: "AUTH_PROTOCOL_ID_SAML", - 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", - 7: "AUTH_PROTOCOL_ID_PAP", - 8: "AUTH_PROTOCOL_ID_CHAP", - 9: "AUTH_PROTOCOL_ID_EAP", - 10: "AUTH_PROTOCOL_ID_RADIUS", - 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", - 12: "AUTH_PROTOCOL_ID_LDAP", - 99: "AUTH_PROTOCOL_ID_OTHER", - } - Scim_AuthProtocolId_value = map[string]int32{ - "AUTH_PROTOCOL_ID_UNKNOWN": 0, - "AUTH_PROTOCOL_ID_NTLM": 1, - "AUTH_PROTOCOL_ID_KERBEROS": 2, - "AUTH_PROTOCOL_ID_DIGEST": 3, - "AUTH_PROTOCOL_ID_OPENID": 4, - "AUTH_PROTOCOL_ID_SAML": 5, - "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, - "AUTH_PROTOCOL_ID_PAP": 7, - "AUTH_PROTOCOL_ID_CHAP": 8, - "AUTH_PROTOCOL_ID_EAP": 9, - "AUTH_PROTOCOL_ID_RADIUS": 10, - "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, - "AUTH_PROTOCOL_ID_LDAP": 12, - "AUTH_PROTOCOL_ID_OTHER": 99, - } -) - -func (x Scim_AuthProtocolId) Enum() *Scim_AuthProtocolId { - p := new(Scim_AuthProtocolId) - *p = x - return p -} - -func (x Scim_AuthProtocolId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Scim_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[70].Descriptor() -} - -func (Scim_AuthProtocolId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[70] -} - -func (x Scim_AuthProtocolId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Scim_AuthProtocolId.Descriptor instead. -func (Scim_AuthProtocolId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{96, 0} -} - -type Scim_StateId int32 - -const ( - Scim_STATE_ID_UNKNOWN Scim_StateId = 0 - Scim_STATE_ID_PENDING Scim_StateId = 1 - Scim_STATE_ID_ACTIVE Scim_StateId = 2 - Scim_STATE_ID_FAILED Scim_StateId = 3 - Scim_STATE_ID_DELETED Scim_StateId = 4 - Scim_STATE_ID_OTHER Scim_StateId = 99 -) - -// Enum value maps for Scim_StateId. -var ( - Scim_StateId_name = map[int32]string{ - 0: "STATE_ID_UNKNOWN", - 1: "STATE_ID_PENDING", - 2: "STATE_ID_ACTIVE", - 3: "STATE_ID_FAILED", - 4: "STATE_ID_DELETED", - 99: "STATE_ID_OTHER", - } - Scim_StateId_value = map[string]int32{ - "STATE_ID_UNKNOWN": 0, - "STATE_ID_PENDING": 1, - "STATE_ID_ACTIVE": 2, - "STATE_ID_FAILED": 3, - "STATE_ID_DELETED": 4, - "STATE_ID_OTHER": 99, - } -) - -func (x Scim_StateId) Enum() *Scim_StateId { - p := new(Scim_StateId) - *p = x - return p -} - -func (x Scim_StateId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Scim_StateId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[71].Descriptor() -} - -func (Scim_StateId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[71] -} - -func (x Scim_StateId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Scim_StateId.Descriptor instead. -func (Scim_StateId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{96, 1} -} - -type Script_TypeId int32 - -const ( - Script_TYPE_ID_UNKNOWN Script_TypeId = 0 - Script_TYPE_ID_WINDOWS_COMMAND_PROMPT Script_TypeId = 1 - Script_TYPE_ID_POWERSHELL Script_TypeId = 2 - Script_TYPE_ID_PYTHON Script_TypeId = 3 - Script_TYPE_ID_JAVASCRIPT Script_TypeId = 4 - Script_TYPE_ID_VBSCRIPT Script_TypeId = 5 - Script_TYPE_ID_UNIX_SHELL Script_TypeId = 6 - Script_TYPE_ID_VBA Script_TypeId = 7 - Script_TYPE_ID_OTHER Script_TypeId = 99 -) - -// Enum value maps for Script_TypeId. -var ( - Script_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_WINDOWS_COMMAND_PROMPT", - 2: "TYPE_ID_POWERSHELL", - 3: "TYPE_ID_PYTHON", - 4: "TYPE_ID_JAVASCRIPT", - 5: "TYPE_ID_VBSCRIPT", - 6: "TYPE_ID_UNIX_SHELL", - 7: "TYPE_ID_VBA", - 99: "TYPE_ID_OTHER", - } - Script_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_WINDOWS_COMMAND_PROMPT": 1, - "TYPE_ID_POWERSHELL": 2, - "TYPE_ID_PYTHON": 3, - "TYPE_ID_JAVASCRIPT": 4, - "TYPE_ID_VBSCRIPT": 5, - "TYPE_ID_UNIX_SHELL": 6, - "TYPE_ID_VBA": 7, - "TYPE_ID_OTHER": 99, - } -) - -func (x Script_TypeId) Enum() *Script_TypeId { - p := new(Script_TypeId) - *p = x - return p -} - -func (x Script_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Script_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[72].Descriptor() -} - -func (Script_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[72] -} - -func (x Script_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Script_TypeId.Descriptor instead. -func (Script_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{97, 0} -} - -type SoftwareComponent_RelationshipId int32 - -const ( - SoftwareComponent_RELATIONSHIP_ID_UNKNOWN SoftwareComponent_RelationshipId = 0 - SoftwareComponent_RELATIONSHIP_ID_DEPENDS_ON SoftwareComponent_RelationshipId = 1 - SoftwareComponent_RELATIONSHIP_ID_OTHER SoftwareComponent_RelationshipId = 99 -) - -// Enum value maps for SoftwareComponent_RelationshipId. -var ( - SoftwareComponent_RelationshipId_name = map[int32]string{ - 0: "RELATIONSHIP_ID_UNKNOWN", - 1: "RELATIONSHIP_ID_DEPENDS_ON", - 99: "RELATIONSHIP_ID_OTHER", - } - SoftwareComponent_RelationshipId_value = map[string]int32{ - "RELATIONSHIP_ID_UNKNOWN": 0, - "RELATIONSHIP_ID_DEPENDS_ON": 1, - "RELATIONSHIP_ID_OTHER": 99, - } -) - -func (x SoftwareComponent_RelationshipId) Enum() *SoftwareComponent_RelationshipId { - p := new(SoftwareComponent_RelationshipId) - *p = x - return p -} - -func (x SoftwareComponent_RelationshipId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SoftwareComponent_RelationshipId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[73].Descriptor() -} - -func (SoftwareComponent_RelationshipId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[73] -} - -func (x SoftwareComponent_RelationshipId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SoftwareComponent_RelationshipId.Descriptor instead. -func (SoftwareComponent_RelationshipId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{100, 0} -} - -type SoftwareComponent_TypeId int32 - -const ( - SoftwareComponent_TYPE_ID_UNKNOWN SoftwareComponent_TypeId = 0 - SoftwareComponent_TYPE_ID_FRAMEWORK SoftwareComponent_TypeId = 1 - SoftwareComponent_TYPE_ID_LIBRARY SoftwareComponent_TypeId = 2 - SoftwareComponent_TYPE_ID_OPERATING_SYSTEM SoftwareComponent_TypeId = 3 - SoftwareComponent_TYPE_ID_OTHER SoftwareComponent_TypeId = 99 -) - -// Enum value maps for SoftwareComponent_TypeId. -var ( - SoftwareComponent_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_FRAMEWORK", - 2: "TYPE_ID_LIBRARY", - 3: "TYPE_ID_OPERATING_SYSTEM", - 99: "TYPE_ID_OTHER", - } - SoftwareComponent_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_FRAMEWORK": 1, - "TYPE_ID_LIBRARY": 2, - "TYPE_ID_OPERATING_SYSTEM": 3, - "TYPE_ID_OTHER": 99, - } -) - -func (x SoftwareComponent_TypeId) Enum() *SoftwareComponent_TypeId { - p := new(SoftwareComponent_TypeId) - *p = x - return p -} - -func (x SoftwareComponent_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SoftwareComponent_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[74].Descriptor() -} - -func (SoftwareComponent_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[74] -} - -func (x SoftwareComponent_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SoftwareComponent_TypeId.Descriptor instead. -func (SoftwareComponent_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{100, 1} -} - -type Sso_AuthProtocolId int32 - -const ( - Sso_AUTH_PROTOCOL_ID_UNKNOWN Sso_AuthProtocolId = 0 - Sso_AUTH_PROTOCOL_ID_NTLM Sso_AuthProtocolId = 1 - Sso_AUTH_PROTOCOL_ID_KERBEROS Sso_AuthProtocolId = 2 - Sso_AUTH_PROTOCOL_ID_DIGEST Sso_AuthProtocolId = 3 - Sso_AUTH_PROTOCOL_ID_OPENID Sso_AuthProtocolId = 4 - Sso_AUTH_PROTOCOL_ID_SAML Sso_AuthProtocolId = 5 - Sso_AUTH_PROTOCOL_ID_OAUTH_2_0 Sso_AuthProtocolId = 6 - Sso_AUTH_PROTOCOL_ID_PAP Sso_AuthProtocolId = 7 - Sso_AUTH_PROTOCOL_ID_CHAP Sso_AuthProtocolId = 8 - Sso_AUTH_PROTOCOL_ID_EAP Sso_AuthProtocolId = 9 - Sso_AUTH_PROTOCOL_ID_RADIUS Sso_AuthProtocolId = 10 - Sso_AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION Sso_AuthProtocolId = 11 - Sso_AUTH_PROTOCOL_ID_LDAP Sso_AuthProtocolId = 12 - Sso_AUTH_PROTOCOL_ID_OTHER Sso_AuthProtocolId = 99 -) - -// Enum value maps for Sso_AuthProtocolId. -var ( - Sso_AuthProtocolId_name = map[int32]string{ - 0: "AUTH_PROTOCOL_ID_UNKNOWN", - 1: "AUTH_PROTOCOL_ID_NTLM", - 2: "AUTH_PROTOCOL_ID_KERBEROS", - 3: "AUTH_PROTOCOL_ID_DIGEST", - 4: "AUTH_PROTOCOL_ID_OPENID", - 5: "AUTH_PROTOCOL_ID_SAML", - 6: "AUTH_PROTOCOL_ID_OAUTH_2_0", - 7: "AUTH_PROTOCOL_ID_PAP", - 8: "AUTH_PROTOCOL_ID_CHAP", - 9: "AUTH_PROTOCOL_ID_EAP", - 10: "AUTH_PROTOCOL_ID_RADIUS", - 11: "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION", - 12: "AUTH_PROTOCOL_ID_LDAP", - 99: "AUTH_PROTOCOL_ID_OTHER", - } - Sso_AuthProtocolId_value = map[string]int32{ - "AUTH_PROTOCOL_ID_UNKNOWN": 0, - "AUTH_PROTOCOL_ID_NTLM": 1, - "AUTH_PROTOCOL_ID_KERBEROS": 2, - "AUTH_PROTOCOL_ID_DIGEST": 3, - "AUTH_PROTOCOL_ID_OPENID": 4, - "AUTH_PROTOCOL_ID_SAML": 5, - "AUTH_PROTOCOL_ID_OAUTH_2_0": 6, - "AUTH_PROTOCOL_ID_PAP": 7, - "AUTH_PROTOCOL_ID_CHAP": 8, - "AUTH_PROTOCOL_ID_EAP": 9, - "AUTH_PROTOCOL_ID_RADIUS": 10, - "AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION": 11, - "AUTH_PROTOCOL_ID_LDAP": 12, - "AUTH_PROTOCOL_ID_OTHER": 99, - } -) - -func (x Sso_AuthProtocolId) Enum() *Sso_AuthProtocolId { - p := new(Sso_AuthProtocolId) - *p = x - return p -} - -func (x Sso_AuthProtocolId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Sso_AuthProtocolId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[75].Descriptor() -} - -func (Sso_AuthProtocolId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[75] -} - -func (x Sso_AuthProtocolId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Sso_AuthProtocolId.Descriptor instead. -func (Sso_AuthProtocolId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{102, 0} -} - -type ThreatActor_TypeId int32 - -const ( - ThreatActor_TYPE_ID_UNKNOWN ThreatActor_TypeId = 0 - ThreatActor_TYPE_ID_NATION_STATE ThreatActor_TypeId = 1 - ThreatActor_TYPE_ID_CYBERCRIMINAL ThreatActor_TypeId = 2 - ThreatActor_TYPE_ID_HACKTIVISTS ThreatActor_TypeId = 3 - ThreatActor_TYPE_ID_INSIDER ThreatActor_TypeId = 4 - ThreatActor_TYPE_ID_OTHER ThreatActor_TypeId = 99 -) - -// Enum value maps for ThreatActor_TypeId. -var ( - ThreatActor_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_NATION_STATE", - 2: "TYPE_ID_CYBERCRIMINAL", - 3: "TYPE_ID_HACKTIVISTS", - 4: "TYPE_ID_INSIDER", - 99: "TYPE_ID_OTHER", - } - ThreatActor_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_NATION_STATE": 1, - "TYPE_ID_CYBERCRIMINAL": 2, - "TYPE_ID_HACKTIVISTS": 3, - "TYPE_ID_INSIDER": 4, - "TYPE_ID_OTHER": 99, - } -) - -func (x ThreatActor_TypeId) Enum() *ThreatActor_TypeId { - p := new(ThreatActor_TypeId) - *p = x - return p -} - -func (x ThreatActor_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ThreatActor_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[76].Descriptor() -} - -func (ThreatActor_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[76] -} - -func (x ThreatActor_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ThreatActor_TypeId.Descriptor instead. -func (ThreatActor_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{106, 0} -} - -type Timespan_TypeId int32 - -const ( - Timespan_TYPE_ID_UNKNOWN Timespan_TypeId = 0 - Timespan_TYPE_ID_MILLISECONDS Timespan_TypeId = 1 - Timespan_TYPE_ID_SECONDS Timespan_TypeId = 2 - Timespan_TYPE_ID_MINUTES Timespan_TypeId = 3 - Timespan_TYPE_ID_HOURS Timespan_TypeId = 4 - Timespan_TYPE_ID_DAYS Timespan_TypeId = 5 - Timespan_TYPE_ID_WEEKS Timespan_TypeId = 6 - Timespan_TYPE_ID_MONTHS Timespan_TypeId = 7 - Timespan_TYPE_ID_YEARS Timespan_TypeId = 8 - Timespan_TYPE_ID_TIME_INTERVAL Timespan_TypeId = 9 - Timespan_TYPE_ID_OTHER Timespan_TypeId = 99 -) - -// Enum value maps for Timespan_TypeId. -var ( - Timespan_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_MILLISECONDS", - 2: "TYPE_ID_SECONDS", - 3: "TYPE_ID_MINUTES", - 4: "TYPE_ID_HOURS", - 5: "TYPE_ID_DAYS", - 6: "TYPE_ID_WEEKS", - 7: "TYPE_ID_MONTHS", - 8: "TYPE_ID_YEARS", - 9: "TYPE_ID_TIME_INTERVAL", - 99: "TYPE_ID_OTHER", - } - Timespan_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_MILLISECONDS": 1, - "TYPE_ID_SECONDS": 2, - "TYPE_ID_MINUTES": 3, - "TYPE_ID_HOURS": 4, - "TYPE_ID_DAYS": 5, - "TYPE_ID_WEEKS": 6, - "TYPE_ID_MONTHS": 7, - "TYPE_ID_YEARS": 8, - "TYPE_ID_TIME_INTERVAL": 9, - "TYPE_ID_OTHER": 99, - } -) - -func (x Timespan_TypeId) Enum() *Timespan_TypeId { - p := new(Timespan_TypeId) - *p = x - return p -} - -func (x Timespan_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Timespan_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[77].Descriptor() -} - -func (Timespan_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[77] -} - -func (x Timespan_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Timespan_TypeId.Descriptor instead. -func (Timespan_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{107, 0} -} - -type Token_TypeId int32 - -const ( - Token_TYPE_ID_UNKNOWN Token_TypeId = 0 - Token_TYPE_ID_TICKET_GRANTING_TICKET Token_TypeId = 1 - Token_TYPE_ID_SERVICE_TICKET Token_TypeId = 2 - Token_TYPE_ID_IDENTITY_TOKEN Token_TypeId = 3 - Token_TYPE_ID_REFRESH_TOKEN Token_TypeId = 4 - Token_TYPE_ID_SAML_ASSERTION Token_TypeId = 5 - Token_TYPE_ID_CLIENT_TOKEN Token_TypeId = 6 - Token_TYPE_ID_API_TOKEN Token_TypeId = 7 - Token_TYPE_ID_OTHER Token_TypeId = 99 -) - -// Enum value maps for Token_TypeId. -var ( - Token_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_TICKET_GRANTING_TICKET", - 2: "TYPE_ID_SERVICE_TICKET", - 3: "TYPE_ID_IDENTITY_TOKEN", - 4: "TYPE_ID_REFRESH_TOKEN", - 5: "TYPE_ID_SAML_ASSERTION", - 6: "TYPE_ID_CLIENT_TOKEN", - 7: "TYPE_ID_API_TOKEN", - 99: "TYPE_ID_OTHER", - } - Token_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_TICKET_GRANTING_TICKET": 1, - "TYPE_ID_SERVICE_TICKET": 2, - "TYPE_ID_IDENTITY_TOKEN": 3, - "TYPE_ID_REFRESH_TOKEN": 4, - "TYPE_ID_SAML_ASSERTION": 5, - "TYPE_ID_CLIENT_TOKEN": 6, - "TYPE_ID_API_TOKEN": 7, - "TYPE_ID_OTHER": 99, - } -) - -func (x Token_TypeId) Enum() *Token_TypeId { - p := new(Token_TypeId) - *p = x - return p -} - -func (x Token_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Token_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[78].Descriptor() -} - -func (Token_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[78] -} - -func (x Token_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Token_TypeId.Descriptor instead. -func (Token_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{108, 0} -} - -type Url_CategoryIds int32 - -const ( - Url_CATEGORY_IDS_UNKNOWN Url_CategoryIds = 0 - Url_CATEGORY_IDS_ADULT_MATURE_CONTENT Url_CategoryIds = 1 - Url_CATEGORY_IDS_PORNOGRAPHY Url_CategoryIds = 3 - Url_CATEGORY_IDS_SEX_EDUCATION Url_CategoryIds = 4 - Url_CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT Url_CategoryIds = 5 - Url_CATEGORY_IDS_NUDITY Url_CategoryIds = 6 - Url_CATEGORY_IDS_EXTREME Url_CategoryIds = 7 - Url_CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL Url_CategoryIds = 9 - Url_CATEGORY_IDS_GAMBLING Url_CategoryIds = 11 - Url_CATEGORY_IDS_VIOLENCE_HATE_RACISM Url_CategoryIds = 14 - Url_CATEGORY_IDS_WEAPONS Url_CategoryIds = 15 - Url_CATEGORY_IDS_ABORTION Url_CategoryIds = 16 - Url_CATEGORY_IDS_HACKING Url_CategoryIds = 17 - Url_CATEGORY_IDS_PHISHING Url_CategoryIds = 18 - Url_CATEGORY_IDS_ENTERTAINMENT Url_CategoryIds = 20 - Url_CATEGORY_IDS_BUSINESS_ECONOMY Url_CategoryIds = 21 - Url_CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF Url_CategoryIds = 22 - Url_CATEGORY_IDS_ALCOHOL Url_CategoryIds = 23 - Url_CATEGORY_IDS_TOBACCO Url_CategoryIds = 24 - Url_CATEGORY_IDS_CONTROLLED_SUBSTANCES Url_CategoryIds = 25 - Url_CATEGORY_IDS_CHILD_PORNOGRAPHY Url_CategoryIds = 26 - Url_CATEGORY_IDS_EDUCATION Url_CategoryIds = 27 - Url_CATEGORY_IDS_CHARITABLE_ORGANIZATIONS Url_CategoryIds = 29 - Url_CATEGORY_IDS_ART_CULTURE Url_CategoryIds = 30 - Url_CATEGORY_IDS_FINANCIAL_SERVICES Url_CategoryIds = 31 - Url_CATEGORY_IDS_BROKERAGE_TRADING Url_CategoryIds = 32 - Url_CATEGORY_IDS_GAMES Url_CategoryIds = 33 - Url_CATEGORY_IDS_GOVERNMENT_LEGAL Url_CategoryIds = 34 - Url_CATEGORY_IDS_MILITARY Url_CategoryIds = 35 - Url_CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY Url_CategoryIds = 36 - Url_CATEGORY_IDS_HEALTH Url_CategoryIds = 37 - Url_CATEGORY_IDS_TECHNOLOGY_INTERNET Url_CategoryIds = 38 - Url_CATEGORY_IDS_SEARCH_ENGINES_PORTALS Url_CategoryIds = 40 - Url_CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS Url_CategoryIds = 43 - Url_CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS Url_CategoryIds = 44 - Url_CATEGORY_IDS_JOB_SEARCH_CAREERS Url_CategoryIds = 45 - Url_CATEGORY_IDS_NEWS_MEDIA Url_CategoryIds = 46 - Url_CATEGORY_IDS_PERSONALS_DATING Url_CategoryIds = 47 - Url_CATEGORY_IDS_REFERENCE Url_CategoryIds = 49 - Url_CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT Url_CategoryIds = 50 - Url_CATEGORY_IDS_CHAT_IM_SMS Url_CategoryIds = 51 - Url_CATEGORY_IDS_EMAIL Url_CategoryIds = 52 - Url_CATEGORY_IDS_NEWSGROUPS_FORUMS Url_CategoryIds = 53 - Url_CATEGORY_IDS_RELIGION Url_CategoryIds = 54 - Url_CATEGORY_IDS_SOCIAL_NETWORKING Url_CategoryIds = 55 - Url_CATEGORY_IDS_FILE_STORAGE_SHARING Url_CategoryIds = 56 - Url_CATEGORY_IDS_REMOTE_ACCESS_TOOLS Url_CategoryIds = 57 - Url_CATEGORY_IDS_SHOPPING Url_CategoryIds = 58 - Url_CATEGORY_IDS_AUCTIONS Url_CategoryIds = 59 - Url_CATEGORY_IDS_REAL_ESTATE Url_CategoryIds = 60 - Url_CATEGORY_IDS_SOCIETY_DAILY_LIVING Url_CategoryIds = 61 - Url_CATEGORY_IDS_PERSONAL_SITES Url_CategoryIds = 63 - Url_CATEGORY_IDS_RESTAURANTS_DINING_FOOD Url_CategoryIds = 64 - Url_CATEGORY_IDS_SPORTS_RECREATION Url_CategoryIds = 65 - Url_CATEGORY_IDS_TRAVEL Url_CategoryIds = 66 - Url_CATEGORY_IDS_VEHICLES Url_CategoryIds = 67 - Url_CATEGORY_IDS_HUMOR_JOKES Url_CategoryIds = 68 - Url_CATEGORY_IDS_SOFTWARE_DOWNLOADS Url_CategoryIds = 71 - Url_CATEGORY_IDS_PEER_TO_PEER_P2P Url_CategoryIds = 83 - Url_CATEGORY_IDS_AUDIO_VIDEO_CLIPS Url_CategoryIds = 84 - Url_CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS Url_CategoryIds = 85 - Url_CATEGORY_IDS_PROXY_AVOIDANCE Url_CategoryIds = 86 - Url_CATEGORY_IDS_FOR_KIDS Url_CategoryIds = 87 - Url_CATEGORY_IDS_WEB_ADS_ANALYTICS Url_CategoryIds = 88 - Url_CATEGORY_IDS_WEB_HOSTING Url_CategoryIds = 89 - Url_CATEGORY_IDS_UNCATEGORIZED Url_CategoryIds = 90 - Url_CATEGORY_IDS_SUSPICIOUS Url_CategoryIds = 92 - Url_CATEGORY_IDS_SEXUAL_EXPRESSION Url_CategoryIds = 93 - Url_CATEGORY_IDS_TRANSLATION Url_CategoryIds = 95 - Url_CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE Url_CategoryIds = 96 - Url_CATEGORY_IDS_CONTENT_SERVERS Url_CategoryIds = 97 - Url_CATEGORY_IDS_PLACEHOLDERS Url_CategoryIds = 98 - Url_CATEGORY_IDS_OTHER Url_CategoryIds = 99 - Url_CATEGORY_IDS_SPAM Url_CategoryIds = 101 - Url_CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE Url_CategoryIds = 102 - Url_CATEGORY_IDS_DYNAMIC_DNS_HOST Url_CategoryIds = 103 - Url_CATEGORY_IDS_E_CARD_INVITATIONS Url_CategoryIds = 106 - Url_CATEGORY_IDS_INFORMATIONAL Url_CategoryIds = 107 - Url_CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY Url_CategoryIds = 108 - Url_CATEGORY_IDS_INTERNET_CONNECTED_DEVICES Url_CategoryIds = 109 - Url_CATEGORY_IDS_INTERNET_TELEPHONY Url_CategoryIds = 110 - Url_CATEGORY_IDS_ONLINE_MEETINGS Url_CategoryIds = 111 - Url_CATEGORY_IDS_MEDIA_SHARING Url_CategoryIds = 112 - Url_CATEGORY_IDS_RADIO_AUDIO_STREAMS Url_CategoryIds = 113 - Url_CATEGORY_IDS_TV_VIDEO_STREAMS Url_CategoryIds = 114 - Url_CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS Url_CategoryIds = 118 - Url_CATEGORY_IDS_MARIJUANA Url_CategoryIds = 121 -) - -// Enum value maps for Url_CategoryIds. -var ( - Url_CategoryIds_name = map[int32]string{ - 0: "CATEGORY_IDS_UNKNOWN", - 1: "CATEGORY_IDS_ADULT_MATURE_CONTENT", - 3: "CATEGORY_IDS_PORNOGRAPHY", - 4: "CATEGORY_IDS_SEX_EDUCATION", - 5: "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT", - 6: "CATEGORY_IDS_NUDITY", - 7: "CATEGORY_IDS_EXTREME", - 9: "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL", - 11: "CATEGORY_IDS_GAMBLING", - 14: "CATEGORY_IDS_VIOLENCE_HATE_RACISM", - 15: "CATEGORY_IDS_WEAPONS", - 16: "CATEGORY_IDS_ABORTION", - 17: "CATEGORY_IDS_HACKING", - 18: "CATEGORY_IDS_PHISHING", - 20: "CATEGORY_IDS_ENTERTAINMENT", - 21: "CATEGORY_IDS_BUSINESS_ECONOMY", - 22: "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF", - 23: "CATEGORY_IDS_ALCOHOL", - 24: "CATEGORY_IDS_TOBACCO", - 25: "CATEGORY_IDS_CONTROLLED_SUBSTANCES", - 26: "CATEGORY_IDS_CHILD_PORNOGRAPHY", - 27: "CATEGORY_IDS_EDUCATION", - 29: "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS", - 30: "CATEGORY_IDS_ART_CULTURE", - 31: "CATEGORY_IDS_FINANCIAL_SERVICES", - 32: "CATEGORY_IDS_BROKERAGE_TRADING", - 33: "CATEGORY_IDS_GAMES", - 34: "CATEGORY_IDS_GOVERNMENT_LEGAL", - 35: "CATEGORY_IDS_MILITARY", - 36: "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY", - 37: "CATEGORY_IDS_HEALTH", - 38: "CATEGORY_IDS_TECHNOLOGY_INTERNET", - 40: "CATEGORY_IDS_SEARCH_ENGINES_PORTALS", - 43: "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS", - 44: "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS", - 45: "CATEGORY_IDS_JOB_SEARCH_CAREERS", - 46: "CATEGORY_IDS_NEWS_MEDIA", - 47: "CATEGORY_IDS_PERSONALS_DATING", - 49: "CATEGORY_IDS_REFERENCE", - 50: "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT", - 51: "CATEGORY_IDS_CHAT_IM_SMS", - 52: "CATEGORY_IDS_EMAIL", - 53: "CATEGORY_IDS_NEWSGROUPS_FORUMS", - 54: "CATEGORY_IDS_RELIGION", - 55: "CATEGORY_IDS_SOCIAL_NETWORKING", - 56: "CATEGORY_IDS_FILE_STORAGE_SHARING", - 57: "CATEGORY_IDS_REMOTE_ACCESS_TOOLS", - 58: "CATEGORY_IDS_SHOPPING", - 59: "CATEGORY_IDS_AUCTIONS", - 60: "CATEGORY_IDS_REAL_ESTATE", - 61: "CATEGORY_IDS_SOCIETY_DAILY_LIVING", - 63: "CATEGORY_IDS_PERSONAL_SITES", - 64: "CATEGORY_IDS_RESTAURANTS_DINING_FOOD", - 65: "CATEGORY_IDS_SPORTS_RECREATION", - 66: "CATEGORY_IDS_TRAVEL", - 67: "CATEGORY_IDS_VEHICLES", - 68: "CATEGORY_IDS_HUMOR_JOKES", - 71: "CATEGORY_IDS_SOFTWARE_DOWNLOADS", - 83: "CATEGORY_IDS_PEER_TO_PEER_P2P", - 84: "CATEGORY_IDS_AUDIO_VIDEO_CLIPS", - 85: "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS", - 86: "CATEGORY_IDS_PROXY_AVOIDANCE", - 87: "CATEGORY_IDS_FOR_KIDS", - 88: "CATEGORY_IDS_WEB_ADS_ANALYTICS", - 89: "CATEGORY_IDS_WEB_HOSTING", - 90: "CATEGORY_IDS_UNCATEGORIZED", - 92: "CATEGORY_IDS_SUSPICIOUS", - 93: "CATEGORY_IDS_SEXUAL_EXPRESSION", - 95: "CATEGORY_IDS_TRANSLATION", - 96: "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE", - 97: "CATEGORY_IDS_CONTENT_SERVERS", - 98: "CATEGORY_IDS_PLACEHOLDERS", - 99: "CATEGORY_IDS_OTHER", - 101: "CATEGORY_IDS_SPAM", - 102: "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE", - 103: "CATEGORY_IDS_DYNAMIC_DNS_HOST", - 106: "CATEGORY_IDS_E_CARD_INVITATIONS", - 107: "CATEGORY_IDS_INFORMATIONAL", - 108: "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY", - 109: "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES", - 110: "CATEGORY_IDS_INTERNET_TELEPHONY", - 111: "CATEGORY_IDS_ONLINE_MEETINGS", - 112: "CATEGORY_IDS_MEDIA_SHARING", - 113: "CATEGORY_IDS_RADIO_AUDIO_STREAMS", - 114: "CATEGORY_IDS_TV_VIDEO_STREAMS", - 118: "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS", - 121: "CATEGORY_IDS_MARIJUANA", - } - Url_CategoryIds_value = map[string]int32{ - "CATEGORY_IDS_UNKNOWN": 0, - "CATEGORY_IDS_ADULT_MATURE_CONTENT": 1, - "CATEGORY_IDS_PORNOGRAPHY": 3, - "CATEGORY_IDS_SEX_EDUCATION": 4, - "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT": 5, - "CATEGORY_IDS_NUDITY": 6, - "CATEGORY_IDS_EXTREME": 7, - "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL": 9, - "CATEGORY_IDS_GAMBLING": 11, - "CATEGORY_IDS_VIOLENCE_HATE_RACISM": 14, - "CATEGORY_IDS_WEAPONS": 15, - "CATEGORY_IDS_ABORTION": 16, - "CATEGORY_IDS_HACKING": 17, - "CATEGORY_IDS_PHISHING": 18, - "CATEGORY_IDS_ENTERTAINMENT": 20, - "CATEGORY_IDS_BUSINESS_ECONOMY": 21, - "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF": 22, - "CATEGORY_IDS_ALCOHOL": 23, - "CATEGORY_IDS_TOBACCO": 24, - "CATEGORY_IDS_CONTROLLED_SUBSTANCES": 25, - "CATEGORY_IDS_CHILD_PORNOGRAPHY": 26, - "CATEGORY_IDS_EDUCATION": 27, - "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS": 29, - "CATEGORY_IDS_ART_CULTURE": 30, - "CATEGORY_IDS_FINANCIAL_SERVICES": 31, - "CATEGORY_IDS_BROKERAGE_TRADING": 32, - "CATEGORY_IDS_GAMES": 33, - "CATEGORY_IDS_GOVERNMENT_LEGAL": 34, - "CATEGORY_IDS_MILITARY": 35, - "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY": 36, - "CATEGORY_IDS_HEALTH": 37, - "CATEGORY_IDS_TECHNOLOGY_INTERNET": 38, - "CATEGORY_IDS_SEARCH_ENGINES_PORTALS": 40, - "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS": 43, - "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS": 44, - "CATEGORY_IDS_JOB_SEARCH_CAREERS": 45, - "CATEGORY_IDS_NEWS_MEDIA": 46, - "CATEGORY_IDS_PERSONALS_DATING": 47, - "CATEGORY_IDS_REFERENCE": 49, - "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT": 50, - "CATEGORY_IDS_CHAT_IM_SMS": 51, - "CATEGORY_IDS_EMAIL": 52, - "CATEGORY_IDS_NEWSGROUPS_FORUMS": 53, - "CATEGORY_IDS_RELIGION": 54, - "CATEGORY_IDS_SOCIAL_NETWORKING": 55, - "CATEGORY_IDS_FILE_STORAGE_SHARING": 56, - "CATEGORY_IDS_REMOTE_ACCESS_TOOLS": 57, - "CATEGORY_IDS_SHOPPING": 58, - "CATEGORY_IDS_AUCTIONS": 59, - "CATEGORY_IDS_REAL_ESTATE": 60, - "CATEGORY_IDS_SOCIETY_DAILY_LIVING": 61, - "CATEGORY_IDS_PERSONAL_SITES": 63, - "CATEGORY_IDS_RESTAURANTS_DINING_FOOD": 64, - "CATEGORY_IDS_SPORTS_RECREATION": 65, - "CATEGORY_IDS_TRAVEL": 66, - "CATEGORY_IDS_VEHICLES": 67, - "CATEGORY_IDS_HUMOR_JOKES": 68, - "CATEGORY_IDS_SOFTWARE_DOWNLOADS": 71, - "CATEGORY_IDS_PEER_TO_PEER_P2P": 83, - "CATEGORY_IDS_AUDIO_VIDEO_CLIPS": 84, - "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS": 85, - "CATEGORY_IDS_PROXY_AVOIDANCE": 86, - "CATEGORY_IDS_FOR_KIDS": 87, - "CATEGORY_IDS_WEB_ADS_ANALYTICS": 88, - "CATEGORY_IDS_WEB_HOSTING": 89, - "CATEGORY_IDS_UNCATEGORIZED": 90, - "CATEGORY_IDS_SUSPICIOUS": 92, - "CATEGORY_IDS_SEXUAL_EXPRESSION": 93, - "CATEGORY_IDS_TRANSLATION": 95, - "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE": 96, - "CATEGORY_IDS_CONTENT_SERVERS": 97, - "CATEGORY_IDS_PLACEHOLDERS": 98, - "CATEGORY_IDS_OTHER": 99, - "CATEGORY_IDS_SPAM": 101, - "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE": 102, - "CATEGORY_IDS_DYNAMIC_DNS_HOST": 103, - "CATEGORY_IDS_E_CARD_INVITATIONS": 106, - "CATEGORY_IDS_INFORMATIONAL": 107, - "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY": 108, - "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES": 109, - "CATEGORY_IDS_INTERNET_TELEPHONY": 110, - "CATEGORY_IDS_ONLINE_MEETINGS": 111, - "CATEGORY_IDS_MEDIA_SHARING": 112, - "CATEGORY_IDS_RADIO_AUDIO_STREAMS": 113, - "CATEGORY_IDS_TV_VIDEO_STREAMS": 114, - "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS": 118, - "CATEGORY_IDS_MARIJUANA": 121, - } -) - -func (x Url_CategoryIds) Enum() *Url_CategoryIds { - p := new(Url_CategoryIds) - *p = x - return p -} - -func (x Url_CategoryIds) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Url_CategoryIds) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[79].Descriptor() -} - -func (Url_CategoryIds) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[79] -} - -func (x Url_CategoryIds) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Url_CategoryIds.Descriptor instead. -func (Url_CategoryIds) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{111, 0} -} - -type User_RiskLevelId int32 - -const ( - User_RISK_LEVEL_ID_INFO User_RiskLevelId = 0 - User_RISK_LEVEL_ID_LOW User_RiskLevelId = 1 - User_RISK_LEVEL_ID_MEDIUM User_RiskLevelId = 2 - User_RISK_LEVEL_ID_HIGH User_RiskLevelId = 3 - User_RISK_LEVEL_ID_CRITICAL User_RiskLevelId = 4 - User_RISK_LEVEL_ID_OTHER User_RiskLevelId = 99 -) - -// Enum value maps for User_RiskLevelId. -var ( - User_RiskLevelId_name = map[int32]string{ - 0: "RISK_LEVEL_ID_INFO", - 1: "RISK_LEVEL_ID_LOW", - 2: "RISK_LEVEL_ID_MEDIUM", - 3: "RISK_LEVEL_ID_HIGH", - 4: "RISK_LEVEL_ID_CRITICAL", - 99: "RISK_LEVEL_ID_OTHER", - } - User_RiskLevelId_value = map[string]int32{ - "RISK_LEVEL_ID_INFO": 0, - "RISK_LEVEL_ID_LOW": 1, - "RISK_LEVEL_ID_MEDIUM": 2, - "RISK_LEVEL_ID_HIGH": 3, - "RISK_LEVEL_ID_CRITICAL": 4, - "RISK_LEVEL_ID_OTHER": 99, - } -) - -func (x User_RiskLevelId) Enum() *User_RiskLevelId { - p := new(User_RiskLevelId) - *p = x - return p -} - -func (x User_RiskLevelId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (User_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[80].Descriptor() -} - -func (User_RiskLevelId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[80] -} - -func (x User_RiskLevelId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use User_RiskLevelId.Descriptor instead. -func (User_RiskLevelId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{112, 0} -} - -type User_TypeId int32 - -const ( - User_TYPE_ID_UNKNOWN User_TypeId = 0 - User_TYPE_ID_USER User_TypeId = 1 - User_TYPE_ID_ADMIN User_TypeId = 2 - User_TYPE_ID_SYSTEM User_TypeId = 3 - User_TYPE_ID_SERVICE User_TypeId = 4 - User_TYPE_ID_OTHER User_TypeId = 99 -) - -// Enum value maps for User_TypeId. -var ( - User_TypeId_name = map[int32]string{ - 0: "TYPE_ID_UNKNOWN", - 1: "TYPE_ID_USER", - 2: "TYPE_ID_ADMIN", - 3: "TYPE_ID_SYSTEM", - 4: "TYPE_ID_SERVICE", - 99: "TYPE_ID_OTHER", - } - User_TypeId_value = map[string]int32{ - "TYPE_ID_UNKNOWN": 0, - "TYPE_ID_USER": 1, - "TYPE_ID_ADMIN": 2, - "TYPE_ID_SYSTEM": 3, - "TYPE_ID_SERVICE": 4, - "TYPE_ID_OTHER": 99, - } -) - -func (x User_TypeId) Enum() *User_TypeId { - p := new(User_TypeId) - *p = x - return p -} - -func (x User_TypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (User_TypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[81].Descriptor() -} - -func (User_TypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[81] -} - -func (x User_TypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use User_TypeId.Descriptor instead. -func (User_TypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{112, 1} -} - -type Vulnerability_FixCoverageId int32 - -const ( - Vulnerability_FIX_COVERAGE_ID_UNKNOWN Vulnerability_FixCoverageId = 0 - Vulnerability_FIX_COVERAGE_ID_COMPLETE Vulnerability_FixCoverageId = 1 - Vulnerability_FIX_COVERAGE_ID_PARTIAL Vulnerability_FixCoverageId = 2 - Vulnerability_FIX_COVERAGE_ID_NONE Vulnerability_FixCoverageId = 3 - Vulnerability_FIX_COVERAGE_ID_OTHER Vulnerability_FixCoverageId = 99 -) - -// Enum value maps for Vulnerability_FixCoverageId. -var ( - Vulnerability_FixCoverageId_name = map[int32]string{ - 0: "FIX_COVERAGE_ID_UNKNOWN", - 1: "FIX_COVERAGE_ID_COMPLETE", - 2: "FIX_COVERAGE_ID_PARTIAL", - 3: "FIX_COVERAGE_ID_NONE", - 99: "FIX_COVERAGE_ID_OTHER", - } - Vulnerability_FixCoverageId_value = map[string]int32{ - "FIX_COVERAGE_ID_UNKNOWN": 0, - "FIX_COVERAGE_ID_COMPLETE": 1, - "FIX_COVERAGE_ID_PARTIAL": 2, - "FIX_COVERAGE_ID_NONE": 3, - "FIX_COVERAGE_ID_OTHER": 99, - } -) - -func (x Vulnerability_FixCoverageId) Enum() *Vulnerability_FixCoverageId { - p := new(Vulnerability_FixCoverageId) - *p = x - return p -} - -func (x Vulnerability_FixCoverageId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Vulnerability_FixCoverageId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[82].Descriptor() -} - -func (Vulnerability_FixCoverageId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[82] -} - -func (x Vulnerability_FixCoverageId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Vulnerability_FixCoverageId.Descriptor instead. -func (Vulnerability_FixCoverageId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{113, 0} -} - -type Whois_DnssecStatusId int32 - -const ( - Whois_DNSSEC_STATUS_ID_UNKNOWN Whois_DnssecStatusId = 0 - Whois_DNSSEC_STATUS_ID_SIGNED Whois_DnssecStatusId = 1 - Whois_DNSSEC_STATUS_ID_UNSIGNED Whois_DnssecStatusId = 2 - Whois_DNSSEC_STATUS_ID_OTHER Whois_DnssecStatusId = 99 -) - -// Enum value maps for Whois_DnssecStatusId. -var ( - Whois_DnssecStatusId_name = map[int32]string{ - 0: "DNSSEC_STATUS_ID_UNKNOWN", - 1: "DNSSEC_STATUS_ID_SIGNED", - 2: "DNSSEC_STATUS_ID_UNSIGNED", - 99: "DNSSEC_STATUS_ID_OTHER", - } - Whois_DnssecStatusId_value = map[string]int32{ - "DNSSEC_STATUS_ID_UNKNOWN": 0, - "DNSSEC_STATUS_ID_SIGNED": 1, - "DNSSEC_STATUS_ID_UNSIGNED": 2, - "DNSSEC_STATUS_ID_OTHER": 99, - } -) - -func (x Whois_DnssecStatusId) Enum() *Whois_DnssecStatusId { - p := new(Whois_DnssecStatusId) - *p = x - return p -} - -func (x Whois_DnssecStatusId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (Whois_DnssecStatusId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[83].Descriptor() -} - -func (Whois_DnssecStatusId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[83] -} - -func (x Whois_DnssecStatusId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use Whois_DnssecStatusId.Descriptor instead. -func (Whois_DnssecStatusId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{114, 0} -} - -type WinService_ServiceCategoryId int32 - -const ( - WinService_SERVICE_CATEGORY_ID_UNKNOWN WinService_ServiceCategoryId = 0 - WinService_SERVICE_CATEGORY_ID_KERNEL_MODE WinService_ServiceCategoryId = 1 - WinService_SERVICE_CATEGORY_ID_USER_MODE WinService_ServiceCategoryId = 2 - WinService_SERVICE_CATEGORY_ID_OTHER WinService_ServiceCategoryId = 99 -) - -// Enum value maps for WinService_ServiceCategoryId. -var ( - WinService_ServiceCategoryId_name = map[int32]string{ - 0: "SERVICE_CATEGORY_ID_UNKNOWN", - 1: "SERVICE_CATEGORY_ID_KERNEL_MODE", - 2: "SERVICE_CATEGORY_ID_USER_MODE", - 99: "SERVICE_CATEGORY_ID_OTHER", - } - WinService_ServiceCategoryId_value = map[string]int32{ - "SERVICE_CATEGORY_ID_UNKNOWN": 0, - "SERVICE_CATEGORY_ID_KERNEL_MODE": 1, - "SERVICE_CATEGORY_ID_USER_MODE": 2, - "SERVICE_CATEGORY_ID_OTHER": 99, - } -) - -func (x WinService_ServiceCategoryId) Enum() *WinService_ServiceCategoryId { - p := new(WinService_ServiceCategoryId) - *p = x - return p -} - -func (x WinService_ServiceCategoryId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WinService_ServiceCategoryId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[84].Descriptor() -} - -func (WinService_ServiceCategoryId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[84] -} - -func (x WinService_ServiceCategoryId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WinService_ServiceCategoryId.Descriptor instead. -func (WinService_ServiceCategoryId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{115, 0} -} - -type WinService_ServiceErrorControlId int32 - -const ( - WinService_SERVICE_ERROR_CONTROL_ID_UNKNOWN WinService_ServiceErrorControlId = 0 - WinService_SERVICE_ERROR_CONTROL_ID_IGNORE WinService_ServiceErrorControlId = 1 - WinService_SERVICE_ERROR_CONTROL_ID_NORMAL WinService_ServiceErrorControlId = 2 - WinService_SERVICE_ERROR_CONTROL_ID_SEVERE WinService_ServiceErrorControlId = 3 - WinService_SERVICE_ERROR_CONTROL_ID_CRITICAL WinService_ServiceErrorControlId = 4 - WinService_SERVICE_ERROR_CONTROL_ID_OTHER WinService_ServiceErrorControlId = 99 -) - -// Enum value maps for WinService_ServiceErrorControlId. -var ( - WinService_ServiceErrorControlId_name = map[int32]string{ - 0: "SERVICE_ERROR_CONTROL_ID_UNKNOWN", - 1: "SERVICE_ERROR_CONTROL_ID_IGNORE", - 2: "SERVICE_ERROR_CONTROL_ID_NORMAL", - 3: "SERVICE_ERROR_CONTROL_ID_SEVERE", - 4: "SERVICE_ERROR_CONTROL_ID_CRITICAL", - 99: "SERVICE_ERROR_CONTROL_ID_OTHER", - } - WinService_ServiceErrorControlId_value = map[string]int32{ - "SERVICE_ERROR_CONTROL_ID_UNKNOWN": 0, - "SERVICE_ERROR_CONTROL_ID_IGNORE": 1, - "SERVICE_ERROR_CONTROL_ID_NORMAL": 2, - "SERVICE_ERROR_CONTROL_ID_SEVERE": 3, - "SERVICE_ERROR_CONTROL_ID_CRITICAL": 4, - "SERVICE_ERROR_CONTROL_ID_OTHER": 99, - } -) - -func (x WinService_ServiceErrorControlId) Enum() *WinService_ServiceErrorControlId { - p := new(WinService_ServiceErrorControlId) - *p = x - return p -} - -func (x WinService_ServiceErrorControlId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WinService_ServiceErrorControlId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[85].Descriptor() -} - -func (WinService_ServiceErrorControlId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[85] -} - -func (x WinService_ServiceErrorControlId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WinService_ServiceErrorControlId.Descriptor instead. -func (WinService_ServiceErrorControlId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{115, 1} -} - -type WinService_ServiceStartTypeId int32 - -const ( - WinService_SERVICE_START_TYPE_ID_UNKNOWN WinService_ServiceStartTypeId = 0 - WinService_SERVICE_START_TYPE_ID_BOOT WinService_ServiceStartTypeId = 1 - WinService_SERVICE_START_TYPE_ID_SYSTEM WinService_ServiceStartTypeId = 2 - WinService_SERVICE_START_TYPE_ID_AUTO WinService_ServiceStartTypeId = 3 - WinService_SERVICE_START_TYPE_ID_DEMAND WinService_ServiceStartTypeId = 4 - WinService_SERVICE_START_TYPE_ID_DISABLED WinService_ServiceStartTypeId = 5 - WinService_SERVICE_START_TYPE_ID_OTHER WinService_ServiceStartTypeId = 99 -) - -// Enum value maps for WinService_ServiceStartTypeId. -var ( - WinService_ServiceStartTypeId_name = map[int32]string{ - 0: "SERVICE_START_TYPE_ID_UNKNOWN", - 1: "SERVICE_START_TYPE_ID_BOOT", - 2: "SERVICE_START_TYPE_ID_SYSTEM", - 3: "SERVICE_START_TYPE_ID_AUTO", - 4: "SERVICE_START_TYPE_ID_DEMAND", - 5: "SERVICE_START_TYPE_ID_DISABLED", - 99: "SERVICE_START_TYPE_ID_OTHER", - } - WinService_ServiceStartTypeId_value = map[string]int32{ - "SERVICE_START_TYPE_ID_UNKNOWN": 0, - "SERVICE_START_TYPE_ID_BOOT": 1, - "SERVICE_START_TYPE_ID_SYSTEM": 2, - "SERVICE_START_TYPE_ID_AUTO": 3, - "SERVICE_START_TYPE_ID_DEMAND": 4, - "SERVICE_START_TYPE_ID_DISABLED": 5, - "SERVICE_START_TYPE_ID_OTHER": 99, - } -) - -func (x WinService_ServiceStartTypeId) Enum() *WinService_ServiceStartTypeId { - p := new(WinService_ServiceStartTypeId) - *p = x - return p -} - -func (x WinService_ServiceStartTypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WinService_ServiceStartTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[86].Descriptor() -} - -func (WinService_ServiceStartTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[86] -} - -func (x WinService_ServiceStartTypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WinService_ServiceStartTypeId.Descriptor instead. -func (WinService_ServiceStartTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{115, 2} -} - -type WinService_ServiceTypeId int32 - -const ( - WinService_SERVICE_TYPE_ID_UNKNOWN WinService_ServiceTypeId = 0 - WinService_SERVICE_TYPE_ID_KERNEL_DRIVER WinService_ServiceTypeId = 1 - WinService_SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER WinService_ServiceTypeId = 2 - WinService_SERVICE_TYPE_ID_OWN_PROCESS WinService_ServiceTypeId = 3 - WinService_SERVICE_TYPE_ID_SHARE_PROCESS WinService_ServiceTypeId = 4 - WinService_SERVICE_TYPE_ID_OTHER WinService_ServiceTypeId = 99 -) - -// Enum value maps for WinService_ServiceTypeId. -var ( - WinService_ServiceTypeId_name = map[int32]string{ - 0: "SERVICE_TYPE_ID_UNKNOWN", - 1: "SERVICE_TYPE_ID_KERNEL_DRIVER", - 2: "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER", - 3: "SERVICE_TYPE_ID_OWN_PROCESS", - 4: "SERVICE_TYPE_ID_SHARE_PROCESS", - 99: "SERVICE_TYPE_ID_OTHER", - } - WinService_ServiceTypeId_value = map[string]int32{ - "SERVICE_TYPE_ID_UNKNOWN": 0, - "SERVICE_TYPE_ID_KERNEL_DRIVER": 1, - "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER": 2, - "SERVICE_TYPE_ID_OWN_PROCESS": 3, - "SERVICE_TYPE_ID_SHARE_PROCESS": 4, - "SERVICE_TYPE_ID_OTHER": 99, - } -) - -func (x WinService_ServiceTypeId) Enum() *WinService_ServiceTypeId { - p := new(WinService_ServiceTypeId) - *p = x - return p -} - -func (x WinService_ServiceTypeId) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WinService_ServiceTypeId) Descriptor() protoreflect.EnumDescriptor { - return file_api_entity_proto_enumTypes[87].Descriptor() -} - -func (WinService_ServiceTypeId) Type() protoreflect.EnumType { - return &file_api_entity_proto_enumTypes[87] -} - -func (x WinService_ServiceTypeId) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WinService_ServiceTypeId.Descriptor instead. -func (WinService_ServiceTypeId) EnumDescriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{115, 3} -} - -type ApiActivity struct { - state protoimpl.MessageState `protogen:"open.v1"` - Action string `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"` - ActionId ApiActivity_ActionId `protobuf:"varint,2,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.ApiActivity_ActionId" json:"action_id,omitempty"` - ActivityId ApiActivity_ActivityId `protobuf:"varint,3,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.ApiActivity_ActivityId" json:"activity_id,omitempty"` - ActivityName string `protobuf:"bytes,4,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` - Actor *Actor `protobuf:"bytes,5,opt,name=actor,proto3" json:"actor,omitempty"` - AiModel *AiModel `protobuf:"bytes,6,opt,name=ai_model,json=aiModel,proto3" json:"ai_model,omitempty"` - Api *Api `protobuf:"bytes,7,opt,name=api,proto3" json:"api,omitempty"` - Attacks []*Attack `protobuf:"bytes,8,rep,name=attacks,proto3" json:"attacks,omitempty"` - Authorizations []*Authorization `protobuf:"bytes,9,rep,name=authorizations,proto3" json:"authorizations,omitempty"` - CategoryName string `protobuf:"bytes,10,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` - CategoryUid ApiActivity_CategoryUid `protobuf:"varint,11,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.ApiActivity_CategoryUid" json:"category_uid,omitempty"` - ClassName string `protobuf:"bytes,12,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` - ClassUid ApiActivity_ClassUid `protobuf:"varint,13,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.ApiActivity_ClassUid" json:"class_uid,omitempty"` - Cloud *Cloud `protobuf:"bytes,14,opt,name=cloud,proto3" json:"cloud,omitempty"` - Confidence string `protobuf:"bytes,15,opt,name=confidence,proto3" json:"confidence,omitempty"` - ConfidenceId ApiActivity_ConfidenceId `protobuf:"varint,16,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.ApiActivity_ConfidenceId" json:"confidence_id,omitempty"` - ConfidenceScore int32 `protobuf:"varint,17,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` - Count int32 `protobuf:"varint,18,opt,name=count,proto3" json:"count,omitempty"` - Device *Device `protobuf:"bytes,19,opt,name=device,proto3" json:"device,omitempty"` - Disposition string `protobuf:"bytes,20,opt,name=disposition,proto3" json:"disposition,omitempty"` - DispositionId ApiActivity_DispositionId `protobuf:"varint,21,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.ApiActivity_DispositionId" json:"disposition_id,omitempty"` - DstEndpoint *NetworkEndpoint `protobuf:"bytes,22,opt,name=dst_endpoint,json=dstEndpoint,proto3" json:"dst_endpoint,omitempty"` - Duration int64 `protobuf:"varint,23,opt,name=duration,proto3" json:"duration,omitempty"` - EndTime int64 `protobuf:"varint,24,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` - EndTimeDt string `protobuf:"bytes,25,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` - Enrichments []*Enrichment `protobuf:"bytes,26,rep,name=enrichments,proto3" json:"enrichments,omitempty"` - FirewallRule *FirewallRule `protobuf:"bytes,27,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` - HttpRequest *HttpRequest `protobuf:"bytes,28,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` - HttpResponse *HttpResponse `protobuf:"bytes,29,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` - IsAlert bool `protobuf:"varint,30,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` - Malware []*Malware `protobuf:"bytes,31,rep,name=malware,proto3" json:"malware,omitempty"` - MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,32,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` - Message string `protobuf:"bytes,33,opt,name=message,proto3" json:"message,omitempty"` - MessageContext *MessageContext `protobuf:"bytes,34,opt,name=message_context,json=messageContext,proto3" json:"message_context,omitempty"` - Metadata *Metadata `protobuf:"bytes,35,opt,name=metadata,proto3" json:"metadata,omitempty"` - Observables []*Observable `protobuf:"bytes,36,rep,name=observables,proto3" json:"observables,omitempty"` - Osint []*Osint `protobuf:"bytes,37,rep,name=osint,proto3" json:"osint,omitempty"` - Policy *Policy `protobuf:"bytes,38,opt,name=policy,proto3" json:"policy,omitempty"` - RawData string `protobuf:"bytes,39,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` - RawDataHash *Fingerprint `protobuf:"bytes,40,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` - RawDataSize int64 `protobuf:"varint,41,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` - Resources []*ResourceDetails `protobuf:"bytes,42,rep,name=resources,proto3" json:"resources,omitempty"` - RiskDetails string `protobuf:"bytes,43,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` - RiskLevel string `protobuf:"bytes,44,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` - RiskLevelId ApiActivity_RiskLevelId `protobuf:"varint,45,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.ApiActivity_RiskLevelId" json:"risk_level_id,omitempty"` - RiskScore int32 `protobuf:"varint,46,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` - Severity string `protobuf:"bytes,47,opt,name=severity,proto3" json:"severity,omitempty"` - SeverityId ApiActivity_SeverityId `protobuf:"varint,48,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.ApiActivity_SeverityId" json:"severity_id,omitempty"` - SrcEndpoint *NetworkEndpoint `protobuf:"bytes,49,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` - StartTime int64 `protobuf:"varint,50,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` - StartTimeDt string `protobuf:"bytes,51,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` - Status string `protobuf:"bytes,52,opt,name=status,proto3" json:"status,omitempty"` - StatusCode string `protobuf:"bytes,53,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` - StatusDetail string `protobuf:"bytes,54,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` - StatusId ApiActivity_StatusId `protobuf:"varint,55,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.ApiActivity_StatusId" json:"status_id,omitempty"` - Time int64 `protobuf:"varint,56,opt,name=time,proto3" json:"time,omitempty"` - TimeDt string `protobuf:"bytes,57,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` - TimezoneOffset int32 `protobuf:"varint,58,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` - Trace *Trace `protobuf:"bytes,59,opt,name=trace,proto3" json:"trace,omitempty"` - TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` - TypeUid ApiActivity_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.ApiActivity_TypeUid" json:"type_uid,omitempty"` - Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApiActivity) Reset() { - *x = ApiActivity{} - mi := &file_api_entity_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApiActivity) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApiActivity) ProtoMessage() {} - -func (x *ApiActivity) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApiActivity.ProtoReflect.Descriptor instead. -func (*ApiActivity) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{0} -} - -func (x *ApiActivity) GetAction() string { - if x != nil { - return x.Action - } - return "" -} - -func (x *ApiActivity) GetActionId() ApiActivity_ActionId { - if x != nil { - return x.ActionId - } - return ApiActivity_ACTION_ID_UNKNOWN -} - -func (x *ApiActivity) GetActivityId() ApiActivity_ActivityId { - if x != nil { - return x.ActivityId - } - return ApiActivity_ACTIVITY_ID_UNKNOWN -} - -func (x *ApiActivity) GetActivityName() string { - if x != nil { - return x.ActivityName - } - return "" -} - -func (x *ApiActivity) GetActor() *Actor { - if x != nil { - return x.Actor - } - return nil -} - -func (x *ApiActivity) GetAiModel() *AiModel { - if x != nil { - return x.AiModel - } - return nil -} - -func (x *ApiActivity) GetApi() *Api { - if x != nil { - return x.Api - } - return nil -} - -func (x *ApiActivity) GetAttacks() []*Attack { - if x != nil { - return x.Attacks - } - return nil -} - -func (x *ApiActivity) GetAuthorizations() []*Authorization { - if x != nil { - return x.Authorizations - } - return nil -} - -func (x *ApiActivity) GetCategoryName() string { - if x != nil { - return x.CategoryName - } - return "" -} - -func (x *ApiActivity) GetCategoryUid() ApiActivity_CategoryUid { - if x != nil { - return x.CategoryUid - } - return ApiActivity_CATEGORY_UID_UNKNOWN -} - -func (x *ApiActivity) GetClassName() string { - if x != nil { - return x.ClassName - } - return "" -} - -func (x *ApiActivity) GetClassUid() ApiActivity_ClassUid { - if x != nil { - return x.ClassUid - } - return ApiActivity_CLASS_UID_UNKNOWN -} - -func (x *ApiActivity) GetCloud() *Cloud { - if x != nil { - return x.Cloud - } - return nil -} - -func (x *ApiActivity) GetConfidence() string { - if x != nil { - return x.Confidence - } - return "" -} - -func (x *ApiActivity) GetConfidenceId() ApiActivity_ConfidenceId { - if x != nil { - return x.ConfidenceId - } - return ApiActivity_CONFIDENCE_ID_UNKNOWN -} - -func (x *ApiActivity) GetConfidenceScore() int32 { - if x != nil { - return x.ConfidenceScore - } - return 0 -} - -func (x *ApiActivity) GetCount() int32 { - if x != nil { - return x.Count - } - return 0 -} - -func (x *ApiActivity) GetDevice() *Device { - if x != nil { - return x.Device - } - return nil -} - -func (x *ApiActivity) GetDisposition() string { - if x != nil { - return x.Disposition - } - return "" -} - -func (x *ApiActivity) GetDispositionId() ApiActivity_DispositionId { - if x != nil { - return x.DispositionId - } - return ApiActivity_DISPOSITION_ID_UNKNOWN -} - -func (x *ApiActivity) GetDstEndpoint() *NetworkEndpoint { - if x != nil { - return x.DstEndpoint - } - return nil -} - -func (x *ApiActivity) GetDuration() int64 { - if x != nil { - return x.Duration - } - return 0 -} - -func (x *ApiActivity) GetEndTime() int64 { - if x != nil { - return x.EndTime - } - return 0 -} - -func (x *ApiActivity) GetEndTimeDt() string { - if x != nil { - return x.EndTimeDt - } - return "" -} - -func (x *ApiActivity) GetEnrichments() []*Enrichment { - if x != nil { - return x.Enrichments - } - return nil -} - -func (x *ApiActivity) GetFirewallRule() *FirewallRule { - if x != nil { - return x.FirewallRule - } - return nil -} - -func (x *ApiActivity) GetHttpRequest() *HttpRequest { - if x != nil { - return x.HttpRequest - } - return nil -} - -func (x *ApiActivity) GetHttpResponse() *HttpResponse { - if x != nil { - return x.HttpResponse - } - return nil -} - -func (x *ApiActivity) GetIsAlert() bool { - if x != nil { - return x.IsAlert - } - return false -} - -func (x *ApiActivity) GetMalware() []*Malware { - if x != nil { - return x.Malware - } - return nil -} - -func (x *ApiActivity) GetMalwareScanInfo() *MalwareScanInfo { - if x != nil { - return x.MalwareScanInfo - } - return nil -} - -func (x *ApiActivity) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *ApiActivity) GetMessageContext() *MessageContext { - if x != nil { - return x.MessageContext - } - return nil -} - -func (x *ApiActivity) GetMetadata() *Metadata { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *ApiActivity) GetObservables() []*Observable { - if x != nil { - return x.Observables - } - return nil -} - -func (x *ApiActivity) GetOsint() []*Osint { - if x != nil { - return x.Osint - } - return nil -} - -func (x *ApiActivity) GetPolicy() *Policy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *ApiActivity) GetRawData() string { - if x != nil { - return x.RawData - } - return "" -} - -func (x *ApiActivity) GetRawDataHash() *Fingerprint { - if x != nil { - return x.RawDataHash + Url_CategoryIds_name = map[int32]string{ + 0: "CATEGORY_IDS_UNKNOWN", + 1: "CATEGORY_IDS_ADULT_MATURE_CONTENT", + 3: "CATEGORY_IDS_PORNOGRAPHY", + 4: "CATEGORY_IDS_SEX_EDUCATION", + 5: "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT", + 6: "CATEGORY_IDS_NUDITY", + 7: "CATEGORY_IDS_EXTREME", + 9: "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL", + 11: "CATEGORY_IDS_GAMBLING", + 14: "CATEGORY_IDS_VIOLENCE_HATE_RACISM", + 15: "CATEGORY_IDS_WEAPONS", + 16: "CATEGORY_IDS_ABORTION", + 17: "CATEGORY_IDS_HACKING", + 18: "CATEGORY_IDS_PHISHING", + 20: "CATEGORY_IDS_ENTERTAINMENT", + 21: "CATEGORY_IDS_BUSINESS_ECONOMY", + 22: "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF", + 23: "CATEGORY_IDS_ALCOHOL", + 24: "CATEGORY_IDS_TOBACCO", + 25: "CATEGORY_IDS_CONTROLLED_SUBSTANCES", + 26: "CATEGORY_IDS_CHILD_PORNOGRAPHY", + 27: "CATEGORY_IDS_EDUCATION", + 29: "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS", + 30: "CATEGORY_IDS_ART_CULTURE", + 31: "CATEGORY_IDS_FINANCIAL_SERVICES", + 32: "CATEGORY_IDS_BROKERAGE_TRADING", + 33: "CATEGORY_IDS_GAMES", + 34: "CATEGORY_IDS_GOVERNMENT_LEGAL", + 35: "CATEGORY_IDS_MILITARY", + 36: "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY", + 37: "CATEGORY_IDS_HEALTH", + 38: "CATEGORY_IDS_TECHNOLOGY_INTERNET", + 40: "CATEGORY_IDS_SEARCH_ENGINES_PORTALS", + 43: "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS", + 44: "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS", + 45: "CATEGORY_IDS_JOB_SEARCH_CAREERS", + 46: "CATEGORY_IDS_NEWS_MEDIA", + 47: "CATEGORY_IDS_PERSONALS_DATING", + 49: "CATEGORY_IDS_REFERENCE", + 50: "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT", + 51: "CATEGORY_IDS_CHAT_IM_SMS", + 52: "CATEGORY_IDS_EMAIL", + 53: "CATEGORY_IDS_NEWSGROUPS_FORUMS", + 54: "CATEGORY_IDS_RELIGION", + 55: "CATEGORY_IDS_SOCIAL_NETWORKING", + 56: "CATEGORY_IDS_FILE_STORAGE_SHARING", + 57: "CATEGORY_IDS_REMOTE_ACCESS_TOOLS", + 58: "CATEGORY_IDS_SHOPPING", + 59: "CATEGORY_IDS_AUCTIONS", + 60: "CATEGORY_IDS_REAL_ESTATE", + 61: "CATEGORY_IDS_SOCIETY_DAILY_LIVING", + 63: "CATEGORY_IDS_PERSONAL_SITES", + 64: "CATEGORY_IDS_RESTAURANTS_DINING_FOOD", + 65: "CATEGORY_IDS_SPORTS_RECREATION", + 66: "CATEGORY_IDS_TRAVEL", + 67: "CATEGORY_IDS_VEHICLES", + 68: "CATEGORY_IDS_HUMOR_JOKES", + 71: "CATEGORY_IDS_SOFTWARE_DOWNLOADS", + 83: "CATEGORY_IDS_PEER_TO_PEER_P2P", + 84: "CATEGORY_IDS_AUDIO_VIDEO_CLIPS", + 85: "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS", + 86: "CATEGORY_IDS_PROXY_AVOIDANCE", + 87: "CATEGORY_IDS_FOR_KIDS", + 88: "CATEGORY_IDS_WEB_ADS_ANALYTICS", + 89: "CATEGORY_IDS_WEB_HOSTING", + 90: "CATEGORY_IDS_UNCATEGORIZED", + 92: "CATEGORY_IDS_SUSPICIOUS", + 93: "CATEGORY_IDS_SEXUAL_EXPRESSION", + 95: "CATEGORY_IDS_TRANSLATION", + 96: "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE", + 97: "CATEGORY_IDS_CONTENT_SERVERS", + 98: "CATEGORY_IDS_PLACEHOLDERS", + 99: "CATEGORY_IDS_OTHER", + 101: "CATEGORY_IDS_SPAM", + 102: "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE", + 103: "CATEGORY_IDS_DYNAMIC_DNS_HOST", + 106: "CATEGORY_IDS_E_CARD_INVITATIONS", + 107: "CATEGORY_IDS_INFORMATIONAL", + 108: "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY", + 109: "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES", + 110: "CATEGORY_IDS_INTERNET_TELEPHONY", + 111: "CATEGORY_IDS_ONLINE_MEETINGS", + 112: "CATEGORY_IDS_MEDIA_SHARING", + 113: "CATEGORY_IDS_RADIO_AUDIO_STREAMS", + 114: "CATEGORY_IDS_TV_VIDEO_STREAMS", + 118: "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS", + 121: "CATEGORY_IDS_MARIJUANA", } - return nil -} - -func (x *ApiActivity) GetRawDataSize() int64 { - if x != nil { - return x.RawDataSize + Url_CategoryIds_value = map[string]int32{ + "CATEGORY_IDS_UNKNOWN": 0, + "CATEGORY_IDS_ADULT_MATURE_CONTENT": 1, + "CATEGORY_IDS_PORNOGRAPHY": 3, + "CATEGORY_IDS_SEX_EDUCATION": 4, + "CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT": 5, + "CATEGORY_IDS_NUDITY": 6, + "CATEGORY_IDS_EXTREME": 7, + "CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL": 9, + "CATEGORY_IDS_GAMBLING": 11, + "CATEGORY_IDS_VIOLENCE_HATE_RACISM": 14, + "CATEGORY_IDS_WEAPONS": 15, + "CATEGORY_IDS_ABORTION": 16, + "CATEGORY_IDS_HACKING": 17, + "CATEGORY_IDS_PHISHING": 18, + "CATEGORY_IDS_ENTERTAINMENT": 20, + "CATEGORY_IDS_BUSINESS_ECONOMY": 21, + "CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF": 22, + "CATEGORY_IDS_ALCOHOL": 23, + "CATEGORY_IDS_TOBACCO": 24, + "CATEGORY_IDS_CONTROLLED_SUBSTANCES": 25, + "CATEGORY_IDS_CHILD_PORNOGRAPHY": 26, + "CATEGORY_IDS_EDUCATION": 27, + "CATEGORY_IDS_CHARITABLE_ORGANIZATIONS": 29, + "CATEGORY_IDS_ART_CULTURE": 30, + "CATEGORY_IDS_FINANCIAL_SERVICES": 31, + "CATEGORY_IDS_BROKERAGE_TRADING": 32, + "CATEGORY_IDS_GAMES": 33, + "CATEGORY_IDS_GOVERNMENT_LEGAL": 34, + "CATEGORY_IDS_MILITARY": 35, + "CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY": 36, + "CATEGORY_IDS_HEALTH": 37, + "CATEGORY_IDS_TECHNOLOGY_INTERNET": 38, + "CATEGORY_IDS_SEARCH_ENGINES_PORTALS": 40, + "CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS": 43, + "CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS": 44, + "CATEGORY_IDS_JOB_SEARCH_CAREERS": 45, + "CATEGORY_IDS_NEWS_MEDIA": 46, + "CATEGORY_IDS_PERSONALS_DATING": 47, + "CATEGORY_IDS_REFERENCE": 49, + "CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT": 50, + "CATEGORY_IDS_CHAT_IM_SMS": 51, + "CATEGORY_IDS_EMAIL": 52, + "CATEGORY_IDS_NEWSGROUPS_FORUMS": 53, + "CATEGORY_IDS_RELIGION": 54, + "CATEGORY_IDS_SOCIAL_NETWORKING": 55, + "CATEGORY_IDS_FILE_STORAGE_SHARING": 56, + "CATEGORY_IDS_REMOTE_ACCESS_TOOLS": 57, + "CATEGORY_IDS_SHOPPING": 58, + "CATEGORY_IDS_AUCTIONS": 59, + "CATEGORY_IDS_REAL_ESTATE": 60, + "CATEGORY_IDS_SOCIETY_DAILY_LIVING": 61, + "CATEGORY_IDS_PERSONAL_SITES": 63, + "CATEGORY_IDS_RESTAURANTS_DINING_FOOD": 64, + "CATEGORY_IDS_SPORTS_RECREATION": 65, + "CATEGORY_IDS_TRAVEL": 66, + "CATEGORY_IDS_VEHICLES": 67, + "CATEGORY_IDS_HUMOR_JOKES": 68, + "CATEGORY_IDS_SOFTWARE_DOWNLOADS": 71, + "CATEGORY_IDS_PEER_TO_PEER_P2P": 83, + "CATEGORY_IDS_AUDIO_VIDEO_CLIPS": 84, + "CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS": 85, + "CATEGORY_IDS_PROXY_AVOIDANCE": 86, + "CATEGORY_IDS_FOR_KIDS": 87, + "CATEGORY_IDS_WEB_ADS_ANALYTICS": 88, + "CATEGORY_IDS_WEB_HOSTING": 89, + "CATEGORY_IDS_UNCATEGORIZED": 90, + "CATEGORY_IDS_SUSPICIOUS": 92, + "CATEGORY_IDS_SEXUAL_EXPRESSION": 93, + "CATEGORY_IDS_TRANSLATION": 95, + "CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE": 96, + "CATEGORY_IDS_CONTENT_SERVERS": 97, + "CATEGORY_IDS_PLACEHOLDERS": 98, + "CATEGORY_IDS_OTHER": 99, + "CATEGORY_IDS_SPAM": 101, + "CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE": 102, + "CATEGORY_IDS_DYNAMIC_DNS_HOST": 103, + "CATEGORY_IDS_E_CARD_INVITATIONS": 106, + "CATEGORY_IDS_INFORMATIONAL": 107, + "CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY": 108, + "CATEGORY_IDS_INTERNET_CONNECTED_DEVICES": 109, + "CATEGORY_IDS_INTERNET_TELEPHONY": 110, + "CATEGORY_IDS_ONLINE_MEETINGS": 111, + "CATEGORY_IDS_MEDIA_SHARING": 112, + "CATEGORY_IDS_RADIO_AUDIO_STREAMS": 113, + "CATEGORY_IDS_TV_VIDEO_STREAMS": 114, + "CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS": 118, + "CATEGORY_IDS_MARIJUANA": 121, } - return 0 -} +) -func (x *ApiActivity) GetResources() []*ResourceDetails { - if x != nil { - return x.Resources - } - return nil +func (x Url_CategoryIds) Enum() *Url_CategoryIds { + p := new(Url_CategoryIds) + *p = x + return p } -func (x *ApiActivity) GetRiskDetails() string { - if x != nil { - return x.RiskDetails - } - return "" +func (x Url_CategoryIds) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *ApiActivity) GetRiskLevel() string { - if x != nil { - return x.RiskLevel - } - return "" +func (Url_CategoryIds) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[59].Descriptor() } -func (x *ApiActivity) GetRiskLevelId() ApiActivity_RiskLevelId { - if x != nil { - return x.RiskLevelId - } - return ApiActivity_RISK_LEVEL_ID_INFO +func (Url_CategoryIds) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[59] } -func (x *ApiActivity) GetRiskScore() int32 { - if x != nil { - return x.RiskScore - } - return 0 +func (x Url_CategoryIds) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *ApiActivity) GetSeverity() string { - if x != nil { - return x.Severity - } - return "" +// Deprecated: Use Url_CategoryIds.Descriptor instead. +func (Url_CategoryIds) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{109, 0} } -func (x *ApiActivity) GetSeverityId() ApiActivity_SeverityId { - if x != nil { - return x.SeverityId - } - return ApiActivity_SEVERITY_ID_UNKNOWN -} +type User_RiskLevelId int32 -func (x *ApiActivity) GetSrcEndpoint() *NetworkEndpoint { - if x != nil { - return x.SrcEndpoint - } - return nil -} +const ( + User_RISK_LEVEL_ID_INFO User_RiskLevelId = 0 + User_RISK_LEVEL_ID_LOW User_RiskLevelId = 1 + User_RISK_LEVEL_ID_MEDIUM User_RiskLevelId = 2 + User_RISK_LEVEL_ID_HIGH User_RiskLevelId = 3 + User_RISK_LEVEL_ID_CRITICAL User_RiskLevelId = 4 + User_RISK_LEVEL_ID_OTHER User_RiskLevelId = 99 +) -func (x *ApiActivity) GetStartTime() int64 { - if x != nil { - return x.StartTime +// Enum value maps for User_RiskLevelId. +var ( + User_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", } - return 0 -} - -func (x *ApiActivity) GetStartTimeDt() string { - if x != nil { - return x.StartTimeDt + User_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, } - return "" -} +) -func (x *ApiActivity) GetStatus() string { - if x != nil { - return x.Status - } - return "" +func (x User_RiskLevelId) Enum() *User_RiskLevelId { + p := new(User_RiskLevelId) + *p = x + return p } -func (x *ApiActivity) GetStatusCode() string { - if x != nil { - return x.StatusCode - } - return "" +func (x User_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *ApiActivity) GetStatusDetail() string { - if x != nil { - return x.StatusDetail - } - return "" +func (User_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[60].Descriptor() } -func (x *ApiActivity) GetStatusId() ApiActivity_StatusId { - if x != nil { - return x.StatusId - } - return ApiActivity_STATUS_ID_UNKNOWN +func (User_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[60] } -func (x *ApiActivity) GetTime() int64 { - if x != nil { - return x.Time - } - return 0 +func (x User_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *ApiActivity) GetTimeDt() string { - if x != nil { - return x.TimeDt - } - return "" +// Deprecated: Use User_RiskLevelId.Descriptor instead. +func (User_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{110, 0} } -func (x *ApiActivity) GetTimezoneOffset() int32 { - if x != nil { - return x.TimezoneOffset - } - return 0 -} +type User_TypeId int32 -func (x *ApiActivity) GetTrace() *Trace { - if x != nil { - return x.Trace - } - return nil -} +const ( + User_TYPE_ID_UNKNOWN User_TypeId = 0 + User_TYPE_ID_USER User_TypeId = 1 + User_TYPE_ID_ADMIN User_TypeId = 2 + User_TYPE_ID_SYSTEM User_TypeId = 3 + User_TYPE_ID_SERVICE User_TypeId = 4 + User_TYPE_ID_OTHER User_TypeId = 99 +) -func (x *ApiActivity) GetTypeName() string { - if x != nil { - return x.TypeName +// Enum value maps for User_TypeId. +var ( + User_TypeId_name = map[int32]string{ + 0: "TYPE_ID_UNKNOWN", + 1: "TYPE_ID_USER", + 2: "TYPE_ID_ADMIN", + 3: "TYPE_ID_SYSTEM", + 4: "TYPE_ID_SERVICE", + 99: "TYPE_ID_OTHER", } - return "" -} - -func (x *ApiActivity) GetTypeUid() ApiActivity_TypeUid { - if x != nil { - return x.TypeUid + User_TypeId_value = map[string]int32{ + "TYPE_ID_UNKNOWN": 0, + "TYPE_ID_USER": 1, + "TYPE_ID_ADMIN": 2, + "TYPE_ID_SYSTEM": 3, + "TYPE_ID_SERVICE": 4, + "TYPE_ID_OTHER": 99, } - return ApiActivity_TYPE_UID_UNKNOWN -} - -func (x *ApiActivity) GetUnmapped() *structpb.Value { - if x != nil { - return x.Unmapped - } - return nil -} - -type EntityManagement struct { - state protoimpl.MessageState `protogen:"open.v1"` - AccessList []string `protobuf:"bytes,1,rep,name=access_list,json=accessList,proto3" json:"access_list,omitempty"` - AccessMask int32 `protobuf:"varint,2,opt,name=access_mask,json=accessMask,proto3" json:"access_mask,omitempty"` - Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` - ActionId EntityManagement_ActionId `protobuf:"varint,4,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.EntityManagement_ActionId" json:"action_id,omitempty"` - ActivityId EntityManagement_ActivityId `protobuf:"varint,5,opt,name=activity_id,json=activityId,proto3,enum=ocsf.v1.EntityManagement_ActivityId" json:"activity_id,omitempty"` - ActivityName string `protobuf:"bytes,6,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` - Actor *Actor `protobuf:"bytes,7,opt,name=actor,proto3" json:"actor,omitempty"` - Api *Api `protobuf:"bytes,8,opt,name=api,proto3" json:"api,omitempty"` - Attacks []*Attack `protobuf:"bytes,9,rep,name=attacks,proto3" json:"attacks,omitempty"` - Authorizations []*Authorization `protobuf:"bytes,10,rep,name=authorizations,proto3" json:"authorizations,omitempty"` - CategoryName string `protobuf:"bytes,11,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` - CategoryUid EntityManagement_CategoryUid `protobuf:"varint,12,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.EntityManagement_CategoryUid" json:"category_uid,omitempty"` - ClassName string `protobuf:"bytes,13,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` - ClassUid EntityManagement_ClassUid `protobuf:"varint,14,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.EntityManagement_ClassUid" json:"class_uid,omitempty"` - Cloud *Cloud `protobuf:"bytes,15,opt,name=cloud,proto3" json:"cloud,omitempty"` - Comment string `protobuf:"bytes,16,opt,name=comment,proto3" json:"comment,omitempty"` - Confidence string `protobuf:"bytes,17,opt,name=confidence,proto3" json:"confidence,omitempty"` - ConfidenceId EntityManagement_ConfidenceId `protobuf:"varint,18,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.EntityManagement_ConfidenceId" json:"confidence_id,omitempty"` - ConfidenceScore int32 `protobuf:"varint,19,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` - Count int32 `protobuf:"varint,20,opt,name=count,proto3" json:"count,omitempty"` - Device *Device `protobuf:"bytes,21,opt,name=device,proto3" json:"device,omitempty"` - Disposition string `protobuf:"bytes,22,opt,name=disposition,proto3" json:"disposition,omitempty"` - DispositionId EntityManagement_DispositionId `protobuf:"varint,23,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.EntityManagement_DispositionId" json:"disposition_id,omitempty"` - Duration int64 `protobuf:"varint,24,opt,name=duration,proto3" json:"duration,omitempty"` - EndTime int64 `protobuf:"varint,25,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` - EndTimeDt string `protobuf:"bytes,26,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` - Enrichments []*Enrichment `protobuf:"bytes,27,rep,name=enrichments,proto3" json:"enrichments,omitempty"` - Entity *ManagedEntity `protobuf:"bytes,28,opt,name=entity,proto3" json:"entity,omitempty"` - EntityResult *ManagedEntity `protobuf:"bytes,29,opt,name=entity_result,json=entityResult,proto3" json:"entity_result,omitempty"` - FirewallRule *FirewallRule `protobuf:"bytes,30,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` - HttpRequest *HttpRequest `protobuf:"bytes,31,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` - HttpResponse *HttpResponse `protobuf:"bytes,32,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` - IsAlert bool `protobuf:"varint,33,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` - Malware []*Malware `protobuf:"bytes,34,rep,name=malware,proto3" json:"malware,omitempty"` - MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,35,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` - Message string `protobuf:"bytes,36,opt,name=message,proto3" json:"message,omitempty"` - Metadata *Metadata `protobuf:"bytes,37,opt,name=metadata,proto3" json:"metadata,omitempty"` - Observables []*Observable `protobuf:"bytes,38,rep,name=observables,proto3" json:"observables,omitempty"` - Osint []*Osint `protobuf:"bytes,39,rep,name=osint,proto3" json:"osint,omitempty"` - Policy *Policy `protobuf:"bytes,40,opt,name=policy,proto3" json:"policy,omitempty"` - RawData string `protobuf:"bytes,41,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` - RawDataHash *Fingerprint `protobuf:"bytes,42,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` - RawDataSize int64 `protobuf:"varint,43,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` - RiskDetails string `protobuf:"bytes,44,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` - RiskLevel string `protobuf:"bytes,45,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` - RiskLevelId EntityManagement_RiskLevelId `protobuf:"varint,46,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.EntityManagement_RiskLevelId" json:"risk_level_id,omitempty"` - RiskScore int32 `protobuf:"varint,47,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` - Severity string `protobuf:"bytes,48,opt,name=severity,proto3" json:"severity,omitempty"` - SeverityId EntityManagement_SeverityId `protobuf:"varint,49,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.EntityManagement_SeverityId" json:"severity_id,omitempty"` - SrcEndpoint *NetworkEndpoint `protobuf:"bytes,50,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` - StartTime int64 `protobuf:"varint,51,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` - StartTimeDt string `protobuf:"bytes,52,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` - Status string `protobuf:"bytes,53,opt,name=status,proto3" json:"status,omitempty"` - StatusCode string `protobuf:"bytes,54,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` - StatusDetail string `protobuf:"bytes,55,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` - StatusId EntityManagement_StatusId `protobuf:"varint,56,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.EntityManagement_StatusId" json:"status_id,omitempty"` - Time int64 `protobuf:"varint,57,opt,name=time,proto3" json:"time,omitempty"` - TimeDt string `protobuf:"bytes,58,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` - TimezoneOffset int32 `protobuf:"varint,59,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` - TypeName string `protobuf:"bytes,60,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` - TypeUid EntityManagement_TypeUid `protobuf:"varint,61,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.EntityManagement_TypeUid" json:"type_uid,omitempty"` - Unmapped *structpb.Value `protobuf:"bytes,62,opt,name=unmapped,proto3" json:"unmapped,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} +) -func (x *EntityManagement) Reset() { - *x = EntityManagement{} - mi := &file_api_entity_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) +func (x User_TypeId) Enum() *User_TypeId { + p := new(User_TypeId) + *p = x + return p } -func (x *EntityManagement) String() string { - return protoimpl.X.MessageStringOf(x) +func (x User_TypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (*EntityManagement) ProtoMessage() {} - -func (x *EntityManagement) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) +func (User_TypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[61].Descriptor() } -// Deprecated: Use EntityManagement.ProtoReflect.Descriptor instead. -func (*EntityManagement) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{1} +func (User_TypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[61] } -func (x *EntityManagement) GetAccessList() []string { - if x != nil { - return x.AccessList - } - return nil +func (x User_TypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetAccessMask() int32 { - if x != nil { - return x.AccessMask - } - return 0 +// Deprecated: Use User_TypeId.Descriptor instead. +func (User_TypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{110, 1} } -func (x *EntityManagement) GetAction() string { - if x != nil { - return x.Action - } - return "" -} +type Vulnerability_FixCoverageId int32 -func (x *EntityManagement) GetActionId() EntityManagement_ActionId { - if x != nil { - return x.ActionId - } - return EntityManagement_ACTION_ID_UNKNOWN -} +const ( + Vulnerability_FIX_COVERAGE_ID_UNKNOWN Vulnerability_FixCoverageId = 0 + Vulnerability_FIX_COVERAGE_ID_COMPLETE Vulnerability_FixCoverageId = 1 + Vulnerability_FIX_COVERAGE_ID_PARTIAL Vulnerability_FixCoverageId = 2 + Vulnerability_FIX_COVERAGE_ID_NONE Vulnerability_FixCoverageId = 3 + Vulnerability_FIX_COVERAGE_ID_OTHER Vulnerability_FixCoverageId = 99 +) -func (x *EntityManagement) GetActivityId() EntityManagement_ActivityId { - if x != nil { - return x.ActivityId +// Enum value maps for Vulnerability_FixCoverageId. +var ( + Vulnerability_FixCoverageId_name = map[int32]string{ + 0: "FIX_COVERAGE_ID_UNKNOWN", + 1: "FIX_COVERAGE_ID_COMPLETE", + 2: "FIX_COVERAGE_ID_PARTIAL", + 3: "FIX_COVERAGE_ID_NONE", + 99: "FIX_COVERAGE_ID_OTHER", } - return EntityManagement_ACTIVITY_ID_UNKNOWN -} - -func (x *EntityManagement) GetActivityName() string { - if x != nil { - return x.ActivityName + Vulnerability_FixCoverageId_value = map[string]int32{ + "FIX_COVERAGE_ID_UNKNOWN": 0, + "FIX_COVERAGE_ID_COMPLETE": 1, + "FIX_COVERAGE_ID_PARTIAL": 2, + "FIX_COVERAGE_ID_NONE": 3, + "FIX_COVERAGE_ID_OTHER": 99, } - return "" -} +) -func (x *EntityManagement) GetActor() *Actor { - if x != nil { - return x.Actor - } - return nil +func (x Vulnerability_FixCoverageId) Enum() *Vulnerability_FixCoverageId { + p := new(Vulnerability_FixCoverageId) + *p = x + return p } -func (x *EntityManagement) GetApi() *Api { - if x != nil { - return x.Api - } - return nil +func (x Vulnerability_FixCoverageId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetAttacks() []*Attack { - if x != nil { - return x.Attacks - } - return nil +func (Vulnerability_FixCoverageId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[62].Descriptor() } -func (x *EntityManagement) GetAuthorizations() []*Authorization { - if x != nil { - return x.Authorizations - } - return nil +func (Vulnerability_FixCoverageId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[62] } -func (x *EntityManagement) GetCategoryName() string { - if x != nil { - return x.CategoryName - } - return "" +func (x Vulnerability_FixCoverageId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetCategoryUid() EntityManagement_CategoryUid { - if x != nil { - return x.CategoryUid - } - return EntityManagement_CATEGORY_UID_UNKNOWN +// Deprecated: Use Vulnerability_FixCoverageId.Descriptor instead. +func (Vulnerability_FixCoverageId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{111, 0} } -func (x *EntityManagement) GetClassName() string { - if x != nil { - return x.ClassName - } - return "" -} +type Whois_DnssecStatusId int32 -func (x *EntityManagement) GetClassUid() EntityManagement_ClassUid { - if x != nil { - return x.ClassUid - } - return EntityManagement_CLASS_UID_UNKNOWN -} +const ( + Whois_DNSSEC_STATUS_ID_UNKNOWN Whois_DnssecStatusId = 0 + Whois_DNSSEC_STATUS_ID_SIGNED Whois_DnssecStatusId = 1 + Whois_DNSSEC_STATUS_ID_UNSIGNED Whois_DnssecStatusId = 2 + Whois_DNSSEC_STATUS_ID_OTHER Whois_DnssecStatusId = 99 +) -func (x *EntityManagement) GetCloud() *Cloud { - if x != nil { - return x.Cloud +// Enum value maps for Whois_DnssecStatusId. +var ( + Whois_DnssecStatusId_name = map[int32]string{ + 0: "DNSSEC_STATUS_ID_UNKNOWN", + 1: "DNSSEC_STATUS_ID_SIGNED", + 2: "DNSSEC_STATUS_ID_UNSIGNED", + 99: "DNSSEC_STATUS_ID_OTHER", } - return nil -} - -func (x *EntityManagement) GetComment() string { - if x != nil { - return x.Comment + Whois_DnssecStatusId_value = map[string]int32{ + "DNSSEC_STATUS_ID_UNKNOWN": 0, + "DNSSEC_STATUS_ID_SIGNED": 1, + "DNSSEC_STATUS_ID_UNSIGNED": 2, + "DNSSEC_STATUS_ID_OTHER": 99, } - return "" -} +) -func (x *EntityManagement) GetConfidence() string { - if x != nil { - return x.Confidence - } - return "" +func (x Whois_DnssecStatusId) Enum() *Whois_DnssecStatusId { + p := new(Whois_DnssecStatusId) + *p = x + return p } -func (x *EntityManagement) GetConfidenceId() EntityManagement_ConfidenceId { - if x != nil { - return x.ConfidenceId - } - return EntityManagement_CONFIDENCE_ID_UNKNOWN +func (x Whois_DnssecStatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetConfidenceScore() int32 { - if x != nil { - return x.ConfidenceScore - } - return 0 +func (Whois_DnssecStatusId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[63].Descriptor() } -func (x *EntityManagement) GetCount() int32 { - if x != nil { - return x.Count - } - return 0 +func (Whois_DnssecStatusId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[63] } -func (x *EntityManagement) GetDevice() *Device { - if x != nil { - return x.Device - } - return nil +func (x Whois_DnssecStatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetDisposition() string { - if x != nil { - return x.Disposition - } - return "" +// Deprecated: Use Whois_DnssecStatusId.Descriptor instead. +func (Whois_DnssecStatusId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{112, 0} } -func (x *EntityManagement) GetDispositionId() EntityManagement_DispositionId { - if x != nil { - return x.DispositionId - } - return EntityManagement_DISPOSITION_ID_UNKNOWN -} +type WinService_ServiceCategoryId int32 -func (x *EntityManagement) GetDuration() int64 { - if x != nil { - return x.Duration - } - return 0 -} +const ( + WinService_SERVICE_CATEGORY_ID_UNKNOWN WinService_ServiceCategoryId = 0 + WinService_SERVICE_CATEGORY_ID_KERNEL_MODE WinService_ServiceCategoryId = 1 + WinService_SERVICE_CATEGORY_ID_USER_MODE WinService_ServiceCategoryId = 2 + WinService_SERVICE_CATEGORY_ID_OTHER WinService_ServiceCategoryId = 99 +) -func (x *EntityManagement) GetEndTime() int64 { - if x != nil { - return x.EndTime +// Enum value maps for WinService_ServiceCategoryId. +var ( + WinService_ServiceCategoryId_name = map[int32]string{ + 0: "SERVICE_CATEGORY_ID_UNKNOWN", + 1: "SERVICE_CATEGORY_ID_KERNEL_MODE", + 2: "SERVICE_CATEGORY_ID_USER_MODE", + 99: "SERVICE_CATEGORY_ID_OTHER", } - return 0 -} - -func (x *EntityManagement) GetEndTimeDt() string { - if x != nil { - return x.EndTimeDt + WinService_ServiceCategoryId_value = map[string]int32{ + "SERVICE_CATEGORY_ID_UNKNOWN": 0, + "SERVICE_CATEGORY_ID_KERNEL_MODE": 1, + "SERVICE_CATEGORY_ID_USER_MODE": 2, + "SERVICE_CATEGORY_ID_OTHER": 99, } - return "" -} +) -func (x *EntityManagement) GetEnrichments() []*Enrichment { - if x != nil { - return x.Enrichments - } - return nil +func (x WinService_ServiceCategoryId) Enum() *WinService_ServiceCategoryId { + p := new(WinService_ServiceCategoryId) + *p = x + return p } -func (x *EntityManagement) GetEntity() *ManagedEntity { - if x != nil { - return x.Entity - } - return nil +func (x WinService_ServiceCategoryId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetEntityResult() *ManagedEntity { - if x != nil { - return x.EntityResult - } - return nil +func (WinService_ServiceCategoryId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[64].Descriptor() } -func (x *EntityManagement) GetFirewallRule() *FirewallRule { - if x != nil { - return x.FirewallRule - } - return nil +func (WinService_ServiceCategoryId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[64] } -func (x *EntityManagement) GetHttpRequest() *HttpRequest { - if x != nil { - return x.HttpRequest - } - return nil +func (x WinService_ServiceCategoryId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetHttpResponse() *HttpResponse { - if x != nil { - return x.HttpResponse - } - return nil +// Deprecated: Use WinService_ServiceCategoryId.Descriptor instead. +func (WinService_ServiceCategoryId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{113, 0} } -func (x *EntityManagement) GetIsAlert() bool { - if x != nil { - return x.IsAlert - } - return false -} +type WinService_ServiceErrorControlId int32 -func (x *EntityManagement) GetMalware() []*Malware { - if x != nil { - return x.Malware - } - return nil -} +const ( + WinService_SERVICE_ERROR_CONTROL_ID_UNKNOWN WinService_ServiceErrorControlId = 0 + WinService_SERVICE_ERROR_CONTROL_ID_IGNORE WinService_ServiceErrorControlId = 1 + WinService_SERVICE_ERROR_CONTROL_ID_NORMAL WinService_ServiceErrorControlId = 2 + WinService_SERVICE_ERROR_CONTROL_ID_SEVERE WinService_ServiceErrorControlId = 3 + WinService_SERVICE_ERROR_CONTROL_ID_CRITICAL WinService_ServiceErrorControlId = 4 + WinService_SERVICE_ERROR_CONTROL_ID_OTHER WinService_ServiceErrorControlId = 99 +) -func (x *EntityManagement) GetMalwareScanInfo() *MalwareScanInfo { - if x != nil { - return x.MalwareScanInfo +// Enum value maps for WinService_ServiceErrorControlId. +var ( + WinService_ServiceErrorControlId_name = map[int32]string{ + 0: "SERVICE_ERROR_CONTROL_ID_UNKNOWN", + 1: "SERVICE_ERROR_CONTROL_ID_IGNORE", + 2: "SERVICE_ERROR_CONTROL_ID_NORMAL", + 3: "SERVICE_ERROR_CONTROL_ID_SEVERE", + 4: "SERVICE_ERROR_CONTROL_ID_CRITICAL", + 99: "SERVICE_ERROR_CONTROL_ID_OTHER", } - return nil -} - -func (x *EntityManagement) GetMessage() string { - if x != nil { - return x.Message + WinService_ServiceErrorControlId_value = map[string]int32{ + "SERVICE_ERROR_CONTROL_ID_UNKNOWN": 0, + "SERVICE_ERROR_CONTROL_ID_IGNORE": 1, + "SERVICE_ERROR_CONTROL_ID_NORMAL": 2, + "SERVICE_ERROR_CONTROL_ID_SEVERE": 3, + "SERVICE_ERROR_CONTROL_ID_CRITICAL": 4, + "SERVICE_ERROR_CONTROL_ID_OTHER": 99, } - return "" -} +) -func (x *EntityManagement) GetMetadata() *Metadata { - if x != nil { - return x.Metadata - } - return nil +func (x WinService_ServiceErrorControlId) Enum() *WinService_ServiceErrorControlId { + p := new(WinService_ServiceErrorControlId) + *p = x + return p } -func (x *EntityManagement) GetObservables() []*Observable { - if x != nil { - return x.Observables - } - return nil +func (x WinService_ServiceErrorControlId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetOsint() []*Osint { - if x != nil { - return x.Osint - } - return nil +func (WinService_ServiceErrorControlId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[65].Descriptor() } -func (x *EntityManagement) GetPolicy() *Policy { - if x != nil { - return x.Policy - } - return nil +func (WinService_ServiceErrorControlId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[65] } -func (x *EntityManagement) GetRawData() string { - if x != nil { - return x.RawData - } - return "" +func (x WinService_ServiceErrorControlId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetRawDataHash() *Fingerprint { - if x != nil { - return x.RawDataHash - } - return nil +// Deprecated: Use WinService_ServiceErrorControlId.Descriptor instead. +func (WinService_ServiceErrorControlId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{113, 1} } -func (x *EntityManagement) GetRawDataSize() int64 { - if x != nil { - return x.RawDataSize - } - return 0 -} +type WinService_ServiceStartTypeId int32 -func (x *EntityManagement) GetRiskDetails() string { - if x != nil { - return x.RiskDetails - } - return "" -} +const ( + WinService_SERVICE_START_TYPE_ID_UNKNOWN WinService_ServiceStartTypeId = 0 + WinService_SERVICE_START_TYPE_ID_BOOT WinService_ServiceStartTypeId = 1 + WinService_SERVICE_START_TYPE_ID_SYSTEM WinService_ServiceStartTypeId = 2 + WinService_SERVICE_START_TYPE_ID_AUTO WinService_ServiceStartTypeId = 3 + WinService_SERVICE_START_TYPE_ID_DEMAND WinService_ServiceStartTypeId = 4 + WinService_SERVICE_START_TYPE_ID_DISABLED WinService_ServiceStartTypeId = 5 + WinService_SERVICE_START_TYPE_ID_OTHER WinService_ServiceStartTypeId = 99 +) -func (x *EntityManagement) GetRiskLevel() string { - if x != nil { - return x.RiskLevel +// Enum value maps for WinService_ServiceStartTypeId. +var ( + WinService_ServiceStartTypeId_name = map[int32]string{ + 0: "SERVICE_START_TYPE_ID_UNKNOWN", + 1: "SERVICE_START_TYPE_ID_BOOT", + 2: "SERVICE_START_TYPE_ID_SYSTEM", + 3: "SERVICE_START_TYPE_ID_AUTO", + 4: "SERVICE_START_TYPE_ID_DEMAND", + 5: "SERVICE_START_TYPE_ID_DISABLED", + 99: "SERVICE_START_TYPE_ID_OTHER", } - return "" -} - -func (x *EntityManagement) GetRiskLevelId() EntityManagement_RiskLevelId { - if x != nil { - return x.RiskLevelId + WinService_ServiceStartTypeId_value = map[string]int32{ + "SERVICE_START_TYPE_ID_UNKNOWN": 0, + "SERVICE_START_TYPE_ID_BOOT": 1, + "SERVICE_START_TYPE_ID_SYSTEM": 2, + "SERVICE_START_TYPE_ID_AUTO": 3, + "SERVICE_START_TYPE_ID_DEMAND": 4, + "SERVICE_START_TYPE_ID_DISABLED": 5, + "SERVICE_START_TYPE_ID_OTHER": 99, } - return EntityManagement_RISK_LEVEL_ID_INFO -} +) -func (x *EntityManagement) GetRiskScore() int32 { - if x != nil { - return x.RiskScore - } - return 0 +func (x WinService_ServiceStartTypeId) Enum() *WinService_ServiceStartTypeId { + p := new(WinService_ServiceStartTypeId) + *p = x + return p } -func (x *EntityManagement) GetSeverity() string { - if x != nil { - return x.Severity - } - return "" +func (x WinService_ServiceStartTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetSeverityId() EntityManagement_SeverityId { - if x != nil { - return x.SeverityId - } - return EntityManagement_SEVERITY_ID_UNKNOWN +func (WinService_ServiceStartTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[66].Descriptor() } -func (x *EntityManagement) GetSrcEndpoint() *NetworkEndpoint { - if x != nil { - return x.SrcEndpoint - } - return nil +func (WinService_ServiceStartTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[66] } -func (x *EntityManagement) GetStartTime() int64 { - if x != nil { - return x.StartTime - } - return 0 +func (x WinService_ServiceStartTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetStartTimeDt() string { - if x != nil { - return x.StartTimeDt - } - return "" +// Deprecated: Use WinService_ServiceStartTypeId.Descriptor instead. +func (WinService_ServiceStartTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{113, 2} } -func (x *EntityManagement) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} +type WinService_ServiceTypeId int32 -func (x *EntityManagement) GetStatusCode() string { - if x != nil { - return x.StatusCode - } - return "" -} +const ( + WinService_SERVICE_TYPE_ID_UNKNOWN WinService_ServiceTypeId = 0 + WinService_SERVICE_TYPE_ID_KERNEL_DRIVER WinService_ServiceTypeId = 1 + WinService_SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER WinService_ServiceTypeId = 2 + WinService_SERVICE_TYPE_ID_OWN_PROCESS WinService_ServiceTypeId = 3 + WinService_SERVICE_TYPE_ID_SHARE_PROCESS WinService_ServiceTypeId = 4 + WinService_SERVICE_TYPE_ID_OTHER WinService_ServiceTypeId = 99 +) -func (x *EntityManagement) GetStatusDetail() string { - if x != nil { - return x.StatusDetail +// Enum value maps for WinService_ServiceTypeId. +var ( + WinService_ServiceTypeId_name = map[int32]string{ + 0: "SERVICE_TYPE_ID_UNKNOWN", + 1: "SERVICE_TYPE_ID_KERNEL_DRIVER", + 2: "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER", + 3: "SERVICE_TYPE_ID_OWN_PROCESS", + 4: "SERVICE_TYPE_ID_SHARE_PROCESS", + 99: "SERVICE_TYPE_ID_OTHER", } - return "" -} - -func (x *EntityManagement) GetStatusId() EntityManagement_StatusId { - if x != nil { - return x.StatusId + WinService_ServiceTypeId_value = map[string]int32{ + "SERVICE_TYPE_ID_UNKNOWN": 0, + "SERVICE_TYPE_ID_KERNEL_DRIVER": 1, + "SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER": 2, + "SERVICE_TYPE_ID_OWN_PROCESS": 3, + "SERVICE_TYPE_ID_SHARE_PROCESS": 4, + "SERVICE_TYPE_ID_OTHER": 99, } - return EntityManagement_STATUS_ID_UNKNOWN -} +) -func (x *EntityManagement) GetTime() int64 { - if x != nil { - return x.Time - } - return 0 +func (x WinService_ServiceTypeId) Enum() *WinService_ServiceTypeId { + p := new(WinService_ServiceTypeId) + *p = x + return p } -func (x *EntityManagement) GetTimeDt() string { - if x != nil { - return x.TimeDt - } - return "" +func (x WinService_ServiceTypeId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) } -func (x *EntityManagement) GetTimezoneOffset() int32 { - if x != nil { - return x.TimezoneOffset - } - return 0 +func (WinService_ServiceTypeId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_objects_proto_enumTypes[67].Descriptor() } -func (x *EntityManagement) GetTypeName() string { - if x != nil { - return x.TypeName - } - return "" +func (WinService_ServiceTypeId) Type() protoreflect.EnumType { + return &file_ocsf_v1_objects_proto_enumTypes[67] } -func (x *EntityManagement) GetTypeUid() EntityManagement_TypeUid { - if x != nil { - return x.TypeUid - } - return EntityManagement_TYPE_UID_UNKNOWN +func (x WinService_ServiceTypeId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) } -func (x *EntityManagement) GetUnmapped() *structpb.Value { - if x != nil { - return x.Unmapped - } - return nil +// Deprecated: Use WinService_ServiceTypeId.Descriptor instead. +func (WinService_ServiceTypeId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{113, 3} } type Account struct { @@ -7253,7 +4885,7 @@ type Account struct { func (x *Account) Reset() { *x = Account{} - mi := &file_api_entity_proto_msgTypes[2] + mi := &file_ocsf_v1_objects_proto_msgTypes[0] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7265,7 +4897,7 @@ func (x *Account) String() string { func (*Account) ProtoMessage() {} func (x *Account) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[2] + mi := &file_ocsf_v1_objects_proto_msgTypes[0] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7278,7 +4910,7 @@ func (x *Account) ProtoReflect() protoreflect.Message { // Deprecated: Use Account.ProtoReflect.Descriptor instead. func (*Account) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{2} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{0} } func (x *Account) GetIsDisabled() bool { @@ -7360,7 +4992,7 @@ type Actor struct { func (x *Actor) Reset() { *x = Actor{} - mi := &file_api_entity_proto_msgTypes[3] + mi := &file_ocsf_v1_objects_proto_msgTypes[1] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7372,7 +5004,7 @@ func (x *Actor) String() string { func (*Actor) ProtoMessage() {} func (x *Actor) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[3] + mi := &file_ocsf_v1_objects_proto_msgTypes[1] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7385,7 +5017,7 @@ func (x *Actor) ProtoReflect() protoreflect.Message { // Deprecated: Use Actor.ProtoReflect.Descriptor instead. func (*Actor) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{3} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{1} } func (x *Actor) GetAppName() string { @@ -7472,7 +5104,7 @@ type Advisory struct { func (x *Advisory) Reset() { *x = Advisory{} - mi := &file_api_entity_proto_msgTypes[4] + mi := &file_ocsf_v1_objects_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7484,7 +5116,7 @@ func (x *Advisory) String() string { func (*Advisory) ProtoMessage() {} func (x *Advisory) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[4] + mi := &file_ocsf_v1_objects_proto_msgTypes[2] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7497,7 +5129,7 @@ func (x *Advisory) ProtoReflect() protoreflect.Message { // Deprecated: Use Advisory.ProtoReflect.Descriptor instead. func (*Advisory) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{4} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{2} } func (x *Advisory) GetAvgTimespan() *Timespan { @@ -7656,7 +5288,7 @@ type AffectedCode struct { func (x *AffectedCode) Reset() { *x = AffectedCode{} - mi := &file_api_entity_proto_msgTypes[5] + mi := &file_ocsf_v1_objects_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7668,7 +5300,7 @@ func (x *AffectedCode) String() string { func (*AffectedCode) ProtoMessage() {} func (x *AffectedCode) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[5] + mi := &file_ocsf_v1_objects_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7681,7 +5313,7 @@ func (x *AffectedCode) ProtoReflect() protoreflect.Message { // Deprecated: Use AffectedCode.ProtoReflect.Descriptor instead. func (*AffectedCode) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{5} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{3} } func (x *AffectedCode) GetEndColumn() int32 { @@ -7768,7 +5400,7 @@ type AffectedPackage struct { func (x *AffectedPackage) Reset() { *x = AffectedPackage{} - mi := &file_api_entity_proto_msgTypes[6] + mi := &file_ocsf_v1_objects_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7780,7 +5412,7 @@ func (x *AffectedPackage) String() string { func (*AffectedPackage) ProtoMessage() {} func (x *AffectedPackage) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[6] + mi := &file_ocsf_v1_objects_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7793,7 +5425,7 @@ func (x *AffectedPackage) ProtoReflect() protoreflect.Message { // Deprecated: Use AffectedPackage.ProtoReflect.Descriptor instead. func (*AffectedPackage) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{6} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{4} } func (x *AffectedPackage) GetArchitecture() string { @@ -7952,7 +5584,7 @@ type Agent struct { func (x *Agent) Reset() { *x = Agent{} - mi := &file_api_entity_proto_msgTypes[7] + mi := &file_ocsf_v1_objects_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7964,7 +5596,7 @@ func (x *Agent) String() string { func (*Agent) ProtoMessage() {} func (x *Agent) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[7] + mi := &file_ocsf_v1_objects_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7977,7 +5609,7 @@ func (x *Agent) ProtoReflect() protoreflect.Message { // Deprecated: Use Agent.ProtoReflect.Descriptor instead. func (*Agent) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{7} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{5} } func (x *Agent) GetName() string { @@ -8048,7 +5680,7 @@ type AiModel struct { func (x *AiModel) Reset() { *x = AiModel{} - mi := &file_api_entity_proto_msgTypes[8] + mi := &file_ocsf_v1_objects_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8060,7 +5692,7 @@ func (x *AiModel) String() string { func (*AiModel) ProtoMessage() {} func (x *AiModel) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[8] + mi := &file_ocsf_v1_objects_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8073,7 +5705,7 @@ func (x *AiModel) ProtoReflect() protoreflect.Message { // Deprecated: Use AiModel.ProtoReflect.Descriptor instead. func (*AiModel) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{8} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{6} } func (x *AiModel) GetAiProvider() string { @@ -8123,7 +5755,7 @@ type Analytic struct { func (x *Analytic) Reset() { *x = Analytic{} - mi := &file_api_entity_proto_msgTypes[9] + mi := &file_ocsf_v1_objects_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8135,7 +5767,7 @@ func (x *Analytic) String() string { func (*Analytic) ProtoMessage() {} func (x *Analytic) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[9] + mi := &file_ocsf_v1_objects_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8148,7 +5780,7 @@ func (x *Analytic) ProtoReflect() protoreflect.Message { // Deprecated: Use Analytic.ProtoReflect.Descriptor instead. func (*Analytic) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{9} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{7} } func (x *Analytic) GetAlgorithm() string { @@ -8243,7 +5875,7 @@ type Api struct { func (x *Api) Reset() { *x = Api{} - mi := &file_api_entity_proto_msgTypes[10] + mi := &file_ocsf_v1_objects_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8255,7 +5887,7 @@ func (x *Api) String() string { func (*Api) ProtoMessage() {} func (x *Api) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[10] + mi := &file_ocsf_v1_objects_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8268,7 +5900,7 @@ func (x *Api) ProtoReflect() protoreflect.Message { // Deprecated: Use Api.ProtoReflect.Descriptor instead. func (*Api) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{10} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{8} } func (x *Api) GetGroup() *Group { @@ -8348,7 +5980,7 @@ type Application struct { func (x *Application) Reset() { *x = Application{} - mi := &file_api_entity_proto_msgTypes[11] + mi := &file_ocsf_v1_objects_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8360,7 +5992,7 @@ func (x *Application) String() string { func (*Application) ProtoMessage() {} func (x *Application) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[11] + mi := &file_ocsf_v1_objects_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8373,7 +6005,7 @@ func (x *Application) ProtoReflect() protoreflect.Message { // Deprecated: Use Application.ProtoReflect.Descriptor instead. func (*Application) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{11} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{9} } func (x *Application) GetCriticality() string { @@ -8530,7 +6162,7 @@ type Attack struct { func (x *Attack) Reset() { *x = Attack{} - mi := &file_api_entity_proto_msgTypes[12] + mi := &file_ocsf_v1_objects_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8542,7 +6174,7 @@ func (x *Attack) String() string { func (*Attack) ProtoMessage() {} func (x *Attack) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[12] + mi := &file_ocsf_v1_objects_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8555,7 +6187,7 @@ func (x *Attack) ProtoReflect() protoreflect.Message { // Deprecated: Use Attack.ProtoReflect.Descriptor instead. func (*Attack) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{12} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{10} } func (x *Attack) GetMitigation() *Mitigation { @@ -8617,7 +6249,7 @@ type AuthFactor struct { func (x *AuthFactor) Reset() { *x = AuthFactor{} - mi := &file_api_entity_proto_msgTypes[13] + mi := &file_ocsf_v1_objects_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8629,7 +6261,7 @@ func (x *AuthFactor) String() string { func (*AuthFactor) ProtoMessage() {} func (x *AuthFactor) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[13] + mi := &file_ocsf_v1_objects_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8642,7 +6274,7 @@ func (x *AuthFactor) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthFactor.ProtoReflect.Descriptor instead. func (*AuthFactor) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{13} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{11} } func (x *AuthFactor) GetDevice() *Device { @@ -8718,7 +6350,7 @@ type Authorization struct { func (x *Authorization) Reset() { *x = Authorization{} - mi := &file_api_entity_proto_msgTypes[14] + mi := &file_ocsf_v1_objects_proto_msgTypes[12] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8730,7 +6362,7 @@ func (x *Authorization) String() string { func (*Authorization) ProtoMessage() {} func (x *Authorization) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[14] + mi := &file_ocsf_v1_objects_proto_msgTypes[12] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8743,7 +6375,7 @@ func (x *Authorization) ProtoReflect() protoreflect.Message { // Deprecated: Use Authorization.ProtoReflect.Descriptor instead. func (*Authorization) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{14} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{12} } func (x *Authorization) GetDecision() string { @@ -8770,7 +6402,7 @@ type AutonomousSystem struct { func (x *AutonomousSystem) Reset() { *x = AutonomousSystem{} - mi := &file_api_entity_proto_msgTypes[15] + mi := &file_ocsf_v1_objects_proto_msgTypes[13] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8782,7 +6414,7 @@ func (x *AutonomousSystem) String() string { func (*AutonomousSystem) ProtoMessage() {} func (x *AutonomousSystem) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[15] + mi := &file_ocsf_v1_objects_proto_msgTypes[13] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8795,7 +6427,7 @@ func (x *AutonomousSystem) ProtoReflect() protoreflect.Message { // Deprecated: Use AutonomousSystem.ProtoReflect.Descriptor instead. func (*AutonomousSystem) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{15} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{13} } func (x *AutonomousSystem) GetName() string { @@ -8821,7 +6453,7 @@ type Campaign struct { func (x *Campaign) Reset() { *x = Campaign{} - mi := &file_api_entity_proto_msgTypes[16] + mi := &file_ocsf_v1_objects_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8833,7 +6465,7 @@ func (x *Campaign) String() string { func (*Campaign) ProtoMessage() {} func (x *Campaign) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[16] + mi := &file_ocsf_v1_objects_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8846,7 +6478,7 @@ func (x *Campaign) ProtoReflect() protoreflect.Message { // Deprecated: Use Campaign.ProtoReflect.Descriptor instead. func (*Campaign) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{16} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{14} } func (x *Campaign) GetName() string { @@ -8876,7 +6508,7 @@ type Certificate struct { func (x *Certificate) Reset() { *x = Certificate{} - mi := &file_api_entity_proto_msgTypes[17] + mi := &file_ocsf_v1_objects_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8888,7 +6520,7 @@ func (x *Certificate) String() string { func (*Certificate) ProtoMessage() {} func (x *Certificate) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[17] + mi := &file_ocsf_v1_objects_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8901,7 +6533,7 @@ func (x *Certificate) ProtoReflect() protoreflect.Message { // Deprecated: Use Certificate.ProtoReflect.Descriptor instead. func (*Certificate) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{17} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{15} } func (x *Certificate) GetCreatedTime() int64 { @@ -8999,7 +6631,7 @@ type CisControl struct { func (x *CisControl) Reset() { *x = CisControl{} - mi := &file_api_entity_proto_msgTypes[18] + mi := &file_ocsf_v1_objects_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9011,7 +6643,7 @@ func (x *CisControl) String() string { func (*CisControl) ProtoMessage() {} func (x *CisControl) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[18] + mi := &file_ocsf_v1_objects_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9024,7 +6656,7 @@ func (x *CisControl) ProtoReflect() protoreflect.Message { // Deprecated: Use CisControl.ProtoReflect.Descriptor instead. func (*CisControl) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{18} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{16} } func (x *CisControl) GetDesc() string { @@ -9059,7 +6691,7 @@ type ClassifierDetails struct { func (x *ClassifierDetails) Reset() { *x = ClassifierDetails{} - mi := &file_api_entity_proto_msgTypes[19] + mi := &file_ocsf_v1_objects_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9071,7 +6703,7 @@ func (x *ClassifierDetails) String() string { func (*ClassifierDetails) ProtoMessage() {} func (x *ClassifierDetails) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[19] + mi := &file_ocsf_v1_objects_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9084,7 +6716,7 @@ func (x *ClassifierDetails) ProtoReflect() protoreflect.Message { // Deprecated: Use ClassifierDetails.ProtoReflect.Descriptor instead. func (*ClassifierDetails) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{19} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{17} } func (x *ClassifierDetails) GetName() string { @@ -9123,7 +6755,7 @@ type Cloud struct { func (x *Cloud) Reset() { *x = Cloud{} - mi := &file_api_entity_proto_msgTypes[20] + mi := &file_ocsf_v1_objects_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9135,7 +6767,7 @@ func (x *Cloud) String() string { func (*Cloud) ProtoMessage() {} func (x *Cloud) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[20] + mi := &file_ocsf_v1_objects_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9148,7 +6780,7 @@ func (x *Cloud) ProtoReflect() protoreflect.Message { // Deprecated: Use Cloud.ProtoReflect.Descriptor instead. func (*Cloud) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{20} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{18} } func (x *Cloud) GetAccount() *Account { @@ -9220,7 +6852,7 @@ type Container struct { func (x *Container) Reset() { *x = Container{} - mi := &file_api_entity_proto_msgTypes[21] + mi := &file_ocsf_v1_objects_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9232,7 +6864,7 @@ func (x *Container) String() string { func (*Container) ProtoMessage() {} func (x *Container) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[21] + mi := &file_ocsf_v1_objects_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9245,7 +6877,7 @@ func (x *Container) ProtoReflect() protoreflect.Message { // Deprecated: Use Container.ProtoReflect.Descriptor instead. func (*Container) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{21} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{19} } func (x *Container) GetHash() *Fingerprint { @@ -9356,7 +6988,7 @@ type Cve struct { func (x *Cve) Reset() { *x = Cve{} - mi := &file_api_entity_proto_msgTypes[22] + mi := &file_ocsf_v1_objects_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9368,7 +7000,7 @@ func (x *Cve) String() string { func (*Cve) ProtoMessage() {} func (x *Cve) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[22] + mi := &file_ocsf_v1_objects_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9381,7 +7013,7 @@ func (x *Cve) ProtoReflect() protoreflect.Message { // Deprecated: Use Cve.ProtoReflect.Descriptor instead. func (*Cve) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{22} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{20} } func (x *Cve) GetCreatedTime() int64 { @@ -9513,7 +7145,7 @@ type Cvss struct { func (x *Cvss) Reset() { *x = Cvss{} - mi := &file_api_entity_proto_msgTypes[23] + mi := &file_ocsf_v1_objects_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9525,7 +7157,7 @@ func (x *Cvss) String() string { func (*Cvss) ProtoMessage() {} func (x *Cvss) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[23] + mi := &file_ocsf_v1_objects_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9538,7 +7170,7 @@ func (x *Cvss) ProtoReflect() protoreflect.Message { // Deprecated: Use Cvss.ProtoReflect.Descriptor instead. func (*Cvss) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{23} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{21} } func (x *Cvss) GetBaseScore() float64 { @@ -9615,7 +7247,7 @@ type Cwe struct { func (x *Cwe) Reset() { *x = Cwe{} - mi := &file_api_entity_proto_msgTypes[24] + mi := &file_ocsf_v1_objects_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9627,7 +7259,7 @@ func (x *Cwe) String() string { func (*Cwe) ProtoMessage() {} func (x *Cwe) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[24] + mi := &file_ocsf_v1_objects_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9640,7 +7272,7 @@ func (x *Cwe) ProtoReflect() protoreflect.Message { // Deprecated: Use Cwe.ProtoReflect.Descriptor instead. func (*Cwe) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{24} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{22} } func (x *Cwe) GetCaption() string { @@ -9675,7 +7307,7 @@ type D3FTactic struct { func (x *D3FTactic) Reset() { *x = D3FTactic{} - mi := &file_api_entity_proto_msgTypes[25] + mi := &file_ocsf_v1_objects_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9687,7 +7319,7 @@ func (x *D3FTactic) String() string { func (*D3FTactic) ProtoMessage() {} func (x *D3FTactic) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[25] + mi := &file_ocsf_v1_objects_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9700,7 +7332,7 @@ func (x *D3FTactic) ProtoReflect() protoreflect.Message { // Deprecated: Use D3FTactic.ProtoReflect.Descriptor instead. func (*D3FTactic) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{25} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{23} } func (x *D3FTactic) GetName() string { @@ -9735,7 +7367,7 @@ type D3FTechnique struct { func (x *D3FTechnique) Reset() { *x = D3FTechnique{} - mi := &file_api_entity_proto_msgTypes[26] + mi := &file_ocsf_v1_objects_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9747,7 +7379,7 @@ func (x *D3FTechnique) String() string { func (*D3FTechnique) ProtoMessage() {} func (x *D3FTechnique) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[26] + mi := &file_ocsf_v1_objects_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9760,7 +7392,7 @@ func (x *D3FTechnique) ProtoReflect() protoreflect.Message { // Deprecated: Use D3FTechnique.ProtoReflect.Descriptor instead. func (*D3FTechnique) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{26} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{24} } func (x *D3FTechnique) GetName() string { @@ -9795,7 +7427,7 @@ type D3Fend struct { func (x *D3Fend) Reset() { *x = D3Fend{} - mi := &file_api_entity_proto_msgTypes[27] + mi := &file_ocsf_v1_objects_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9807,7 +7439,7 @@ func (x *D3Fend) String() string { func (*D3Fend) ProtoMessage() {} func (x *D3Fend) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[27] + mi := &file_ocsf_v1_objects_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9820,7 +7452,7 @@ func (x *D3Fend) ProtoReflect() protoreflect.Message { // Deprecated: Use D3Fend.ProtoReflect.Descriptor instead. func (*D3Fend) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{27} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{25} } func (x *D3Fend) GetD3FTactic() *D3FTactic { @@ -9866,7 +7498,7 @@ type DataClassification struct { func (x *DataClassification) Reset() { *x = DataClassification{} - mi := &file_api_entity_proto_msgTypes[28] + mi := &file_ocsf_v1_objects_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -9878,7 +7510,7 @@ func (x *DataClassification) String() string { func (*DataClassification) ProtoMessage() {} func (x *DataClassification) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[28] + mi := &file_ocsf_v1_objects_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -9891,7 +7523,7 @@ func (x *DataClassification) ProtoReflect() protoreflect.Message { // Deprecated: Use DataClassification.ProtoReflect.Descriptor instead. func (*DataClassification) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{28} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{26} } func (x *DataClassification) GetCategory() string { @@ -10065,7 +7697,7 @@ type Device struct { func (x *Device) Reset() { *x = Device{} - mi := &file_api_entity_proto_msgTypes[29] + mi := &file_ocsf_v1_objects_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10077,7 +7709,7 @@ func (x *Device) String() string { func (*Device) ProtoMessage() {} func (x *Device) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[29] + mi := &file_ocsf_v1_objects_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10090,7 +7722,7 @@ func (x *Device) ProtoReflect() protoreflect.Message { // Deprecated: Use Device.ProtoReflect.Descriptor instead. func (*Device) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{29} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{27} } func (x *Device) GetAgentList() []*Agent { @@ -10575,7 +8207,7 @@ type DeviceHwInfo struct { func (x *DeviceHwInfo) Reset() { *x = DeviceHwInfo{} - mi := &file_api_entity_proto_msgTypes[30] + mi := &file_ocsf_v1_objects_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10587,7 +8219,7 @@ func (x *DeviceHwInfo) String() string { func (*DeviceHwInfo) ProtoMessage() {} func (x *DeviceHwInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[30] + mi := &file_ocsf_v1_objects_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10600,7 +8232,7 @@ func (x *DeviceHwInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use DeviceHwInfo.ProtoReflect.Descriptor instead. func (*DeviceHwInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{30} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{28} } func (x *DeviceHwInfo) GetBiosDate() string { @@ -10753,7 +8385,7 @@ type DigitalSignature struct { func (x *DigitalSignature) Reset() { *x = DigitalSignature{} - mi := &file_api_entity_proto_msgTypes[31] + mi := &file_ocsf_v1_objects_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10765,7 +8397,7 @@ func (x *DigitalSignature) String() string { func (*DigitalSignature) ProtoMessage() {} func (x *DigitalSignature) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[31] + mi := &file_ocsf_v1_objects_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10778,7 +8410,7 @@ func (x *DigitalSignature) ProtoReflect() protoreflect.Message { // Deprecated: Use DigitalSignature.ProtoReflect.Descriptor instead. func (*DigitalSignature) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{31} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{29} } func (x *DigitalSignature) GetAlgorithm() string { @@ -10857,7 +8489,7 @@ type DiscoveryDetails struct { func (x *DiscoveryDetails) Reset() { *x = DiscoveryDetails{} - mi := &file_api_entity_proto_msgTypes[32] + mi := &file_ocsf_v1_objects_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10869,7 +8501,7 @@ func (x *DiscoveryDetails) String() string { func (*DiscoveryDetails) ProtoMessage() {} func (x *DiscoveryDetails) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[32] + mi := &file_ocsf_v1_objects_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10882,7 +8514,7 @@ func (x *DiscoveryDetails) ProtoReflect() protoreflect.Message { // Deprecated: Use DiscoveryDetails.ProtoReflect.Descriptor instead. func (*DiscoveryDetails) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{32} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{30} } func (x *DiscoveryDetails) GetCount() int32 { @@ -10933,7 +8565,7 @@ type Display struct { func (x *Display) Reset() { *x = Display{} - mi := &file_api_entity_proto_msgTypes[33] + mi := &file_ocsf_v1_objects_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -10945,7 +8577,7 @@ func (x *Display) String() string { func (*Display) ProtoMessage() {} func (x *Display) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[33] + mi := &file_ocsf_v1_objects_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -10958,7 +8590,7 @@ func (x *Display) ProtoReflect() protoreflect.Message { // Deprecated: Use Display.ProtoReflect.Descriptor instead. func (*Display) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{33} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{31} } func (x *Display) GetColorDepth() int32 { @@ -11011,7 +8643,7 @@ type DnsAnswer struct { func (x *DnsAnswer) Reset() { *x = DnsAnswer{} - mi := &file_api_entity_proto_msgTypes[34] + mi := &file_ocsf_v1_objects_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11023,7 +8655,7 @@ func (x *DnsAnswer) String() string { func (*DnsAnswer) ProtoMessage() {} func (x *DnsAnswer) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[34] + mi := &file_ocsf_v1_objects_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11036,7 +8668,7 @@ func (x *DnsAnswer) ProtoReflect() protoreflect.Message { // Deprecated: Use DnsAnswer.ProtoReflect.Descriptor instead. func (*DnsAnswer) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{34} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{32} } func (x *DnsAnswer) GetClass() string { @@ -11103,7 +8735,7 @@ type DomainContact struct { func (x *DomainContact) Reset() { *x = DomainContact{} - mi := &file_api_entity_proto_msgTypes[35] + mi := &file_ocsf_v1_objects_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11115,7 +8747,7 @@ func (x *DomainContact) String() string { func (*DomainContact) ProtoMessage() {} func (x *DomainContact) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[35] + mi := &file_ocsf_v1_objects_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11128,7 +8760,7 @@ func (x *DomainContact) ProtoReflect() protoreflect.Message { // Deprecated: Use DomainContact.ProtoReflect.Descriptor instead. func (*DomainContact) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{35} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{33} } func (x *DomainContact) GetEmailAddr() string { @@ -11195,7 +8827,7 @@ type Edge struct { func (x *Edge) Reset() { *x = Edge{} - mi := &file_api_entity_proto_msgTypes[36] + mi := &file_ocsf_v1_objects_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11207,7 +8839,7 @@ func (x *Edge) String() string { func (*Edge) ProtoMessage() {} func (x *Edge) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[36] + mi := &file_ocsf_v1_objects_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11220,7 +8852,7 @@ func (x *Edge) ProtoReflect() protoreflect.Message { // Deprecated: Use Edge.ProtoReflect.Descriptor instead. func (*Edge) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{36} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{34} } func (x *Edge) GetData() *structpb.Value { @@ -11310,7 +8942,7 @@ type Email struct { func (x *Email) Reset() { *x = Email{} - mi := &file_api_entity_proto_msgTypes[37] + mi := &file_ocsf_v1_objects_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11322,7 +8954,7 @@ func (x *Email) String() string { func (*Email) ProtoMessage() {} func (x *Email) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[37] + mi := &file_ocsf_v1_objects_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11335,7 +8967,7 @@ func (x *Email) ProtoReflect() protoreflect.Message { // Deprecated: Use Email.ProtoReflect.Descriptor instead. func (*Email) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{37} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{35} } func (x *Email) GetCc() []string { @@ -11563,7 +9195,7 @@ type EmailAuth struct { func (x *EmailAuth) Reset() { *x = EmailAuth{} - mi := &file_api_entity_proto_msgTypes[38] + mi := &file_ocsf_v1_objects_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11575,7 +9207,7 @@ func (x *EmailAuth) String() string { func (*EmailAuth) ProtoMessage() {} func (x *EmailAuth) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[38] + mi := &file_ocsf_v1_objects_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11588,7 +9220,7 @@ func (x *EmailAuth) ProtoReflect() protoreflect.Message { // Deprecated: Use EmailAuth.ProtoReflect.Descriptor instead. func (*EmailAuth) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{38} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{36} } func (x *EmailAuth) GetDkim() string { @@ -11653,7 +9285,7 @@ type EncryptionDetails struct { func (x *EncryptionDetails) Reset() { *x = EncryptionDetails{} - mi := &file_api_entity_proto_msgTypes[39] + mi := &file_ocsf_v1_objects_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11665,7 +9297,7 @@ func (x *EncryptionDetails) String() string { func (*EncryptionDetails) ProtoMessage() {} func (x *EncryptionDetails) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[39] + mi := &file_ocsf_v1_objects_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11678,7 +9310,7 @@ func (x *EncryptionDetails) ProtoReflect() protoreflect.Message { // Deprecated: Use EncryptionDetails.ProtoReflect.Descriptor instead. func (*EncryptionDetails) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{39} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{37} } func (x *EncryptionDetails) GetAlgorithm() string { @@ -11735,7 +9367,7 @@ type Enrichment struct { func (x *Enrichment) Reset() { *x = Enrichment{} - mi := &file_api_entity_proto_msgTypes[40] + mi := &file_ocsf_v1_objects_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11747,7 +9379,7 @@ func (x *Enrichment) String() string { func (*Enrichment) ProtoMessage() {} func (x *Enrichment) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[40] + mi := &file_ocsf_v1_objects_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11760,7 +9392,7 @@ func (x *Enrichment) ProtoReflect() protoreflect.Message { // Deprecated: Use Enrichment.ProtoReflect.Descriptor instead. func (*Enrichment) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{40} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{38} } func (x *Enrichment) GetCreatedTime() int64 { @@ -11850,7 +9482,7 @@ type EnvironmentVariable struct { func (x *EnvironmentVariable) Reset() { *x = EnvironmentVariable{} - mi := &file_api_entity_proto_msgTypes[41] + mi := &file_ocsf_v1_objects_proto_msgTypes[39] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11862,7 +9494,7 @@ func (x *EnvironmentVariable) String() string { func (*EnvironmentVariable) ProtoMessage() {} func (x *EnvironmentVariable) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[41] + mi := &file_ocsf_v1_objects_proto_msgTypes[39] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11875,7 +9507,7 @@ func (x *EnvironmentVariable) ProtoReflect() protoreflect.Message { // Deprecated: Use EnvironmentVariable.ProtoReflect.Descriptor instead. func (*EnvironmentVariable) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{41} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{39} } func (x *EnvironmentVariable) GetName() string { @@ -11905,7 +9537,7 @@ type Epss struct { func (x *Epss) Reset() { *x = Epss{} - mi := &file_api_entity_proto_msgTypes[42] + mi := &file_ocsf_v1_objects_proto_msgTypes[40] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11917,7 +9549,7 @@ func (x *Epss) String() string { func (*Epss) ProtoMessage() {} func (x *Epss) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[42] + mi := &file_ocsf_v1_objects_proto_msgTypes[40] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11930,7 +9562,7 @@ func (x *Epss) ProtoReflect() protoreflect.Message { // Deprecated: Use Epss.ProtoReflect.Descriptor instead. func (*Epss) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{42} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{40} } func (x *Epss) GetCreatedTime() int64 { @@ -11979,7 +9611,7 @@ type Extension struct { func (x *Extension) Reset() { *x = Extension{} - mi := &file_api_entity_proto_msgTypes[43] + mi := &file_ocsf_v1_objects_proto_msgTypes[41] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11991,7 +9623,7 @@ func (x *Extension) String() string { func (*Extension) ProtoMessage() {} func (x *Extension) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[43] + mi := &file_ocsf_v1_objects_proto_msgTypes[41] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12004,7 +9636,7 @@ func (x *Extension) ProtoReflect() protoreflect.Message { // Deprecated: Use Extension.ProtoReflect.Descriptor instead. func (*Extension) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{43} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{41} } func (x *Extension) GetName() string { @@ -12039,7 +9671,7 @@ type Feature struct { func (x *Feature) Reset() { *x = Feature{} - mi := &file_api_entity_proto_msgTypes[44] + mi := &file_ocsf_v1_objects_proto_msgTypes[42] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12051,7 +9683,7 @@ func (x *Feature) String() string { func (*Feature) ProtoMessage() {} func (x *Feature) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[44] + mi := &file_ocsf_v1_objects_proto_msgTypes[42] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12064,7 +9696,7 @@ func (x *Feature) ProtoReflect() protoreflect.Message { // Deprecated: Use Feature.ProtoReflect.Descriptor instead. func (*Feature) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{44} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{42} } func (x *Feature) GetName() string { @@ -12144,7 +9776,7 @@ type File struct { func (x *File) Reset() { *x = File{} - mi := &file_api_entity_proto_msgTypes[45] + mi := &file_ocsf_v1_objects_proto_msgTypes[43] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12156,7 +9788,7 @@ func (x *File) String() string { func (*File) ProtoMessage() {} func (x *File) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[45] + mi := &file_ocsf_v1_objects_proto_msgTypes[43] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12169,7 +9801,7 @@ func (x *File) ProtoReflect() protoreflect.Message { // Deprecated: Use File.ProtoReflect.Descriptor instead. func (*File) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{45} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{43} } func (x *File) GetAccessedTime() int64 { @@ -12519,7 +10151,7 @@ type Fingerprint struct { func (x *Fingerprint) Reset() { *x = Fingerprint{} - mi := &file_api_entity_proto_msgTypes[46] + mi := &file_ocsf_v1_objects_proto_msgTypes[44] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12531,7 +10163,7 @@ func (x *Fingerprint) String() string { func (*Fingerprint) ProtoMessage() {} func (x *Fingerprint) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[46] + mi := &file_ocsf_v1_objects_proto_msgTypes[44] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12544,7 +10176,7 @@ func (x *Fingerprint) ProtoReflect() protoreflect.Message { // Deprecated: Use Fingerprint.ProtoReflect.Descriptor instead. func (*Fingerprint) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{46} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{44} } func (x *Fingerprint) GetAlgorithm() string { @@ -12588,7 +10220,7 @@ type FirewallRule struct { func (x *FirewallRule) Reset() { *x = FirewallRule{} - mi := &file_api_entity_proto_msgTypes[47] + mi := &file_ocsf_v1_objects_proto_msgTypes[45] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12600,7 +10232,7 @@ func (x *FirewallRule) String() string { func (*FirewallRule) ProtoMessage() {} func (x *FirewallRule) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[47] + mi := &file_ocsf_v1_objects_proto_msgTypes[45] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12613,7 +10245,7 @@ func (x *FirewallRule) ProtoReflect() protoreflect.Message { // Deprecated: Use FirewallRule.ProtoReflect.Descriptor instead. func (*FirewallRule) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{47} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{45} } func (x *FirewallRule) GetCategory() string { @@ -12716,7 +10348,7 @@ type GpuInfo struct { func (x *GpuInfo) Reset() { *x = GpuInfo{} - mi := &file_api_entity_proto_msgTypes[48] + mi := &file_ocsf_v1_objects_proto_msgTypes[46] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12728,7 +10360,7 @@ func (x *GpuInfo) String() string { func (*GpuInfo) ProtoMessage() {} func (x *GpuInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[48] + mi := &file_ocsf_v1_objects_proto_msgTypes[46] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12741,7 +10373,7 @@ func (x *GpuInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use GpuInfo.ProtoReflect.Descriptor instead. func (*GpuInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{48} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{46} } func (x *GpuInfo) GetBusType() string { @@ -12817,7 +10449,7 @@ type Graph struct { func (x *Graph) Reset() { *x = Graph{} - mi := &file_api_entity_proto_msgTypes[49] + mi := &file_ocsf_v1_objects_proto_msgTypes[47] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12829,7 +10461,7 @@ func (x *Graph) String() string { func (*Graph) ProtoMessage() {} func (x *Graph) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[49] + mi := &file_ocsf_v1_objects_proto_msgTypes[47] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12842,7 +10474,7 @@ func (x *Graph) ProtoReflect() protoreflect.Message { // Deprecated: Use Graph.ProtoReflect.Descriptor instead. func (*Graph) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{49} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{47} } func (x *Graph) GetDesc() string { @@ -12923,7 +10555,7 @@ type Group struct { func (x *Group) Reset() { *x = Group{} - mi := &file_api_entity_proto_msgTypes[50] + mi := &file_ocsf_v1_objects_proto_msgTypes[48] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12935,7 +10567,7 @@ func (x *Group) String() string { func (*Group) ProtoMessage() {} func (x *Group) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[50] + mi := &file_ocsf_v1_objects_proto_msgTypes[48] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12948,7 +10580,7 @@ func (x *Group) ProtoReflect() protoreflect.Message { // Deprecated: Use Group.ProtoReflect.Descriptor instead. func (*Group) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{50} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{48} } func (x *Group) GetDesc() string { @@ -13010,7 +10642,7 @@ type HttpHeader struct { func (x *HttpHeader) Reset() { *x = HttpHeader{} - mi := &file_api_entity_proto_msgTypes[51] + mi := &file_ocsf_v1_objects_proto_msgTypes[49] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13022,7 +10654,7 @@ func (x *HttpHeader) String() string { func (*HttpHeader) ProtoMessage() {} func (x *HttpHeader) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[51] + mi := &file_ocsf_v1_objects_proto_msgTypes[49] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13035,7 +10667,7 @@ func (x *HttpHeader) ProtoReflect() protoreflect.Message { // Deprecated: Use HttpHeader.ProtoReflect.Descriptor instead. func (*HttpHeader) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{51} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{49} } func (x *HttpHeader) GetName() string { @@ -13071,7 +10703,7 @@ type HttpRequest struct { func (x *HttpRequest) Reset() { *x = HttpRequest{} - mi := &file_api_entity_proto_msgTypes[52] + mi := &file_ocsf_v1_objects_proto_msgTypes[50] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13083,7 +10715,7 @@ func (x *HttpRequest) String() string { func (*HttpRequest) ProtoMessage() {} func (x *HttpRequest) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[52] + mi := &file_ocsf_v1_objects_proto_msgTypes[50] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13096,7 +10728,7 @@ func (x *HttpRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use HttpRequest.ProtoReflect.Descriptor instead. func (*HttpRequest) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{52} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{50} } func (x *HttpRequest) GetArgs() string { @@ -13192,7 +10824,7 @@ type HttpResponse struct { func (x *HttpResponse) Reset() { *x = HttpResponse{} - mi := &file_api_entity_proto_msgTypes[53] + mi := &file_ocsf_v1_objects_proto_msgTypes[51] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13204,7 +10836,7 @@ func (x *HttpResponse) String() string { func (*HttpResponse) ProtoMessage() {} func (x *HttpResponse) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[53] + mi := &file_ocsf_v1_objects_proto_msgTypes[51] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13217,7 +10849,7 @@ func (x *HttpResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use HttpResponse.ProtoReflect.Descriptor instead. func (*HttpResponse) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{53} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{51} } func (x *HttpResponse) GetBodyLength() int32 { @@ -13298,7 +10930,7 @@ type Idp struct { func (x *Idp) Reset() { *x = Idp{} - mi := &file_api_entity_proto_msgTypes[54] + mi := &file_ocsf_v1_objects_proto_msgTypes[52] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13310,7 +10942,7 @@ func (x *Idp) String() string { func (*Idp) ProtoMessage() {} func (x *Idp) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[54] + mi := &file_ocsf_v1_objects_proto_msgTypes[52] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13323,7 +10955,7 @@ func (x *Idp) ProtoReflect() protoreflect.Message { // Deprecated: Use Idp.ProtoReflect.Descriptor instead. func (*Idp) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{54} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{52} } func (x *Idp) GetAuthFactors() []*AuthFactor { @@ -13438,7 +11070,7 @@ type Image struct { func (x *Image) Reset() { *x = Image{} - mi := &file_api_entity_proto_msgTypes[55] + mi := &file_ocsf_v1_objects_proto_msgTypes[53] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13450,7 +11082,7 @@ func (x *Image) String() string { func (*Image) ProtoMessage() {} func (x *Image) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[55] + mi := &file_ocsf_v1_objects_proto_msgTypes[53] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13463,7 +11095,7 @@ func (x *Image) ProtoReflect() protoreflect.Message { // Deprecated: Use Image.ProtoReflect.Descriptor instead. func (*Image) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{55} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{53} } func (x *Image) GetLabels() []string { @@ -13531,7 +11163,7 @@ type KbArticle struct { func (x *KbArticle) Reset() { *x = KbArticle{} - mi := &file_api_entity_proto_msgTypes[56] + mi := &file_ocsf_v1_objects_proto_msgTypes[54] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13543,7 +11175,7 @@ func (x *KbArticle) String() string { func (*KbArticle) ProtoMessage() {} func (x *KbArticle) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[56] + mi := &file_ocsf_v1_objects_proto_msgTypes[54] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13556,7 +11188,7 @@ func (x *KbArticle) ProtoReflect() protoreflect.Message { // Deprecated: Use KbArticle.ProtoReflect.Descriptor instead. func (*KbArticle) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{56} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{54} } func (x *KbArticle) GetAvgTimespan() *Timespan { @@ -13675,7 +11307,7 @@ type KeyValueObject struct { func (x *KeyValueObject) Reset() { *x = KeyValueObject{} - mi := &file_api_entity_proto_msgTypes[57] + mi := &file_ocsf_v1_objects_proto_msgTypes[55] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13687,7 +11319,7 @@ func (x *KeyValueObject) String() string { func (*KeyValueObject) ProtoMessage() {} func (x *KeyValueObject) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[57] + mi := &file_ocsf_v1_objects_proto_msgTypes[55] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13700,7 +11332,7 @@ func (x *KeyValueObject) ProtoReflect() protoreflect.Message { // Deprecated: Use KeyValueObject.ProtoReflect.Descriptor instead. func (*KeyValueObject) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{57} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{55} } func (x *KeyValueObject) GetName() string { @@ -13737,7 +11369,7 @@ type KeyboardInfo struct { func (x *KeyboardInfo) Reset() { *x = KeyboardInfo{} - mi := &file_api_entity_proto_msgTypes[58] + mi := &file_ocsf_v1_objects_proto_msgTypes[56] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13749,7 +11381,7 @@ func (x *KeyboardInfo) String() string { func (*KeyboardInfo) ProtoMessage() {} func (x *KeyboardInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[58] + mi := &file_ocsf_v1_objects_proto_msgTypes[56] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13762,7 +11394,7 @@ func (x *KeyboardInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use KeyboardInfo.ProtoReflect.Descriptor instead. func (*KeyboardInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{58} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{56} } func (x *KeyboardInfo) GetFunctionKeys() int32 { @@ -13810,7 +11442,7 @@ type KillChainPhase struct { func (x *KillChainPhase) Reset() { *x = KillChainPhase{} - mi := &file_api_entity_proto_msgTypes[59] + mi := &file_ocsf_v1_objects_proto_msgTypes[57] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13822,7 +11454,7 @@ func (x *KillChainPhase) String() string { func (*KillChainPhase) ProtoMessage() {} func (x *KillChainPhase) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[59] + mi := &file_ocsf_v1_objects_proto_msgTypes[57] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13835,7 +11467,7 @@ func (x *KillChainPhase) ProtoReflect() protoreflect.Message { // Deprecated: Use KillChainPhase.ProtoReflect.Descriptor instead. func (*KillChainPhase) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{59} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{57} } func (x *KillChainPhase) GetPhase() string { @@ -13888,7 +11520,7 @@ type LdapPerson struct { func (x *LdapPerson) Reset() { *x = LdapPerson{} - mi := &file_api_entity_proto_msgTypes[60] + mi := &file_ocsf_v1_objects_proto_msgTypes[58] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13900,7 +11532,7 @@ func (x *LdapPerson) String() string { func (*LdapPerson) ProtoMessage() {} func (x *LdapPerson) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[60] + mi := &file_ocsf_v1_objects_proto_msgTypes[58] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13913,7 +11545,7 @@ func (x *LdapPerson) ProtoReflect() protoreflect.Message { // Deprecated: Use LdapPerson.ProtoReflect.Descriptor instead. func (*LdapPerson) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{60} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{58} } func (x *LdapPerson) GetCostCenter() string { @@ -14138,7 +11770,7 @@ type Location struct { func (x *Location) Reset() { *x = Location{} - mi := &file_api_entity_proto_msgTypes[61] + mi := &file_ocsf_v1_objects_proto_msgTypes[59] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14150,7 +11782,7 @@ func (x *Location) String() string { func (*Location) ProtoMessage() {} func (x *Location) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[61] + mi := &file_ocsf_v1_objects_proto_msgTypes[59] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14163,7 +11795,7 @@ func (x *Location) ProtoReflect() protoreflect.Message { // Deprecated: Use Location.ProtoReflect.Descriptor instead. func (*Location) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{61} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{59} } func (x *Location) GetAerialHeight() string { @@ -14317,7 +11949,7 @@ type Logger struct { func (x *Logger) Reset() { *x = Logger{} - mi := &file_api_entity_proto_msgTypes[62] + mi := &file_ocsf_v1_objects_proto_msgTypes[60] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14329,7 +11961,7 @@ func (x *Logger) String() string { func (*Logger) ProtoMessage() {} func (x *Logger) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[62] + mi := &file_ocsf_v1_objects_proto_msgTypes[60] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14342,7 +11974,7 @@ func (x *Logger) ProtoReflect() protoreflect.Message { // Deprecated: Use Logger.ProtoReflect.Descriptor instead. func (*Logger) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{62} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{60} } func (x *Logger) GetDevice() *Device { @@ -14475,7 +12107,7 @@ type LongString struct { func (x *LongString) Reset() { *x = LongString{} - mi := &file_api_entity_proto_msgTypes[63] + mi := &file_ocsf_v1_objects_proto_msgTypes[61] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14487,7 +12119,7 @@ func (x *LongString) String() string { func (*LongString) ProtoMessage() {} func (x *LongString) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[63] + mi := &file_ocsf_v1_objects_proto_msgTypes[61] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14500,7 +12132,7 @@ func (x *LongString) ProtoReflect() protoreflect.Message { // Deprecated: Use LongString.ProtoReflect.Descriptor instead. func (*LongString) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{63} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{61} } func (x *LongString) GetIsTruncated() bool { @@ -14543,7 +12175,7 @@ type Malware struct { func (x *Malware) Reset() { *x = Malware{} - mi := &file_api_entity_proto_msgTypes[64] + mi := &file_ocsf_v1_objects_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14555,7 +12187,7 @@ func (x *Malware) String() string { func (*Malware) ProtoMessage() {} func (x *Malware) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[64] + mi := &file_ocsf_v1_objects_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14568,7 +12200,7 @@ func (x *Malware) ProtoReflect() protoreflect.Message { // Deprecated: Use Malware.ProtoReflect.Descriptor instead. func (*Malware) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{64} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{62} } func (x *Malware) GetClassificationIds() []Malware_ClassificationIds { @@ -14669,7 +12301,7 @@ type MalwareScanInfo struct { func (x *MalwareScanInfo) Reset() { *x = MalwareScanInfo{} - mi := &file_api_entity_proto_msgTypes[65] + mi := &file_ocsf_v1_objects_proto_msgTypes[63] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14681,7 +12313,7 @@ func (x *MalwareScanInfo) String() string { func (*MalwareScanInfo) ProtoMessage() {} func (x *MalwareScanInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[65] + mi := &file_ocsf_v1_objects_proto_msgTypes[63] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14694,7 +12326,7 @@ func (x *MalwareScanInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use MalwareScanInfo.ProtoReflect.Descriptor instead. func (*MalwareScanInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{65} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{63} } func (x *MalwareScanInfo) GetEndTime() int64 { @@ -14809,7 +12441,7 @@ type ManagedEntity struct { func (x *ManagedEntity) Reset() { *x = ManagedEntity{} - mi := &file_api_entity_proto_msgTypes[66] + mi := &file_ocsf_v1_objects_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14821,7 +12453,7 @@ func (x *ManagedEntity) String() string { func (*ManagedEntity) ProtoMessage() {} func (x *ManagedEntity) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[66] + mi := &file_ocsf_v1_objects_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14834,7 +12466,7 @@ func (x *ManagedEntity) ProtoReflect() protoreflect.Message { // Deprecated: Use ManagedEntity.ProtoReflect.Descriptor instead. func (*ManagedEntity) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{66} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{64} } func (x *ManagedEntity) GetData() *structpb.Value { @@ -14945,7 +12577,7 @@ type MessageContext struct { func (x *MessageContext) Reset() { *x = MessageContext{} - mi := &file_api_entity_proto_msgTypes[67] + mi := &file_ocsf_v1_objects_proto_msgTypes[65] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14957,7 +12589,7 @@ func (x *MessageContext) String() string { func (*MessageContext) ProtoMessage() {} func (x *MessageContext) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[67] + mi := &file_ocsf_v1_objects_proto_msgTypes[65] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14970,7 +12602,7 @@ func (x *MessageContext) ProtoReflect() protoreflect.Message { // Deprecated: Use MessageContext.ProtoReflect.Descriptor instead. func (*MessageContext) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{67} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{65} } func (x *MessageContext) GetAiRole() string { @@ -15083,7 +12715,7 @@ type Metadata struct { func (x *Metadata) Reset() { *x = Metadata{} - mi := &file_api_entity_proto_msgTypes[68] + mi := &file_ocsf_v1_objects_proto_msgTypes[66] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15095,7 +12727,7 @@ func (x *Metadata) String() string { func (*Metadata) ProtoMessage() {} func (x *Metadata) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[68] + mi := &file_ocsf_v1_objects_proto_msgTypes[66] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15108,7 +12740,7 @@ func (x *Metadata) ProtoReflect() protoreflect.Message { // Deprecated: Use Metadata.ProtoReflect.Descriptor instead. func (*Metadata) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{68} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{66} } func (x *Metadata) GetCorrelationUid() string { @@ -15394,7 +13026,7 @@ type Metric struct { func (x *Metric) Reset() { *x = Metric{} - mi := &file_api_entity_proto_msgTypes[69] + mi := &file_ocsf_v1_objects_proto_msgTypes[67] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15406,7 +13038,7 @@ func (x *Metric) String() string { func (*Metric) ProtoMessage() {} func (x *Metric) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[69] + mi := &file_ocsf_v1_objects_proto_msgTypes[67] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15419,7 +13051,7 @@ func (x *Metric) ProtoReflect() protoreflect.Message { // Deprecated: Use Metric.ProtoReflect.Descriptor instead. func (*Metric) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{69} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{67} } func (x *Metric) GetName() string { @@ -15448,7 +13080,7 @@ type Mitigation struct { func (x *Mitigation) Reset() { *x = Mitigation{} - mi := &file_api_entity_proto_msgTypes[70] + mi := &file_ocsf_v1_objects_proto_msgTypes[68] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15460,7 +13092,7 @@ func (x *Mitigation) String() string { func (*Mitigation) ProtoMessage() {} func (x *Mitigation) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[70] + mi := &file_ocsf_v1_objects_proto_msgTypes[68] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15473,7 +13105,7 @@ func (x *Mitigation) ProtoReflect() protoreflect.Message { // Deprecated: Use Mitigation.ProtoReflect.Descriptor instead. func (*Mitigation) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{70} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{68} } func (x *Mitigation) GetCountermeasures() []*D3Fend { @@ -15546,7 +13178,7 @@ type NetworkEndpoint struct { func (x *NetworkEndpoint) Reset() { *x = NetworkEndpoint{} - mi := &file_api_entity_proto_msgTypes[71] + mi := &file_ocsf_v1_objects_proto_msgTypes[69] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15558,7 +13190,7 @@ func (x *NetworkEndpoint) String() string { func (*NetworkEndpoint) ProtoMessage() {} func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[71] + mi := &file_ocsf_v1_objects_proto_msgTypes[69] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15571,7 +13203,7 @@ func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead. func (*NetworkEndpoint) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{71} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{69} } func (x *NetworkEndpoint) GetAgentList() []*Agent { @@ -15830,7 +13462,7 @@ type NetworkInterface struct { func (x *NetworkInterface) Reset() { *x = NetworkInterface{} - mi := &file_api_entity_proto_msgTypes[72] + mi := &file_ocsf_v1_objects_proto_msgTypes[70] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15842,7 +13474,7 @@ func (x *NetworkInterface) String() string { func (*NetworkInterface) ProtoMessage() {} func (x *NetworkInterface) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[72] + mi := &file_ocsf_v1_objects_proto_msgTypes[70] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15855,7 +13487,7 @@ func (x *NetworkInterface) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkInterface.ProtoReflect.Descriptor instead. func (*NetworkInterface) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{72} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{70} } func (x *NetworkInterface) GetHostname() string { @@ -15970,7 +13602,7 @@ type NetworkProxy struct { func (x *NetworkProxy) Reset() { *x = NetworkProxy{} - mi := &file_api_entity_proto_msgTypes[73] + mi := &file_ocsf_v1_objects_proto_msgTypes[71] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15982,7 +13614,7 @@ func (x *NetworkProxy) String() string { func (*NetworkProxy) ProtoMessage() {} func (x *NetworkProxy) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[73] + mi := &file_ocsf_v1_objects_proto_msgTypes[71] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15995,7 +13627,7 @@ func (x *NetworkProxy) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkProxy.ProtoReflect.Descriptor instead. func (*NetworkProxy) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{73} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{71} } func (x *NetworkProxy) GetAgentList() []*Agent { @@ -16249,7 +13881,7 @@ type Node struct { func (x *Node) Reset() { *x = Node{} - mi := &file_api_entity_proto_msgTypes[74] + mi := &file_ocsf_v1_objects_proto_msgTypes[72] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16261,7 +13893,7 @@ func (x *Node) String() string { func (*Node) ProtoMessage() {} func (x *Node) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[74] + mi := &file_ocsf_v1_objects_proto_msgTypes[72] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16274,7 +13906,7 @@ func (x *Node) ProtoReflect() protoreflect.Message { // Deprecated: Use Node.ProtoReflect.Descriptor instead. func (*Node) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{74} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{72} } func (x *Node) GetData() *structpb.Value { @@ -16327,7 +13959,7 @@ type Observable struct { func (x *Observable) Reset() { *x = Observable{} - mi := &file_api_entity_proto_msgTypes[75] + mi := &file_ocsf_v1_objects_proto_msgTypes[73] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16339,7 +13971,7 @@ func (x *Observable) String() string { func (*Observable) ProtoMessage() {} func (x *Observable) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[75] + mi := &file_ocsf_v1_objects_proto_msgTypes[73] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16352,7 +13984,7 @@ func (x *Observable) ProtoReflect() protoreflect.Message { // Deprecated: Use Observable.ProtoReflect.Descriptor instead. func (*Observable) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{75} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{73} } func (x *Observable) GetEventUid() string { @@ -16421,7 +14053,7 @@ type OccurrenceDetails struct { func (x *OccurrenceDetails) Reset() { *x = OccurrenceDetails{} - mi := &file_api_entity_proto_msgTypes[76] + mi := &file_ocsf_v1_objects_proto_msgTypes[74] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16433,7 +14065,7 @@ func (x *OccurrenceDetails) String() string { func (*OccurrenceDetails) ProtoMessage() {} func (x *OccurrenceDetails) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[76] + mi := &file_ocsf_v1_objects_proto_msgTypes[74] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16446,7 +14078,7 @@ func (x *OccurrenceDetails) ProtoReflect() protoreflect.Message { // Deprecated: Use OccurrenceDetails.ProtoReflect.Descriptor instead. func (*OccurrenceDetails) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{76} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{74} } func (x *OccurrenceDetails) GetCellName() string { @@ -16524,7 +14156,7 @@ type Organization struct { func (x *Organization) Reset() { *x = Organization{} - mi := &file_api_entity_proto_msgTypes[77] + mi := &file_ocsf_v1_objects_proto_msgTypes[75] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16536,7 +14168,7 @@ func (x *Organization) String() string { func (*Organization) ProtoMessage() {} func (x *Organization) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[77] + mi := &file_ocsf_v1_objects_proto_msgTypes[75] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16549,7 +14181,7 @@ func (x *Organization) ProtoReflect() protoreflect.Message { // Deprecated: Use Organization.ProtoReflect.Descriptor instead. func (*Organization) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{77} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{75} } func (x *Organization) GetName() string { @@ -16601,7 +14233,7 @@ type Os struct { func (x *Os) Reset() { *x = Os{} - mi := &file_api_entity_proto_msgTypes[78] + mi := &file_ocsf_v1_objects_proto_msgTypes[76] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16613,7 +14245,7 @@ func (x *Os) String() string { func (*Os) ProtoMessage() {} func (x *Os) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[78] + mi := &file_ocsf_v1_objects_proto_msgTypes[76] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16626,7 +14258,7 @@ func (x *Os) ProtoReflect() protoreflect.Message { // Deprecated: Use Os.ProtoReflect.Descriptor instead. func (*Os) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{78} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{76} } func (x *Os) GetBuild() string { @@ -16779,7 +14411,7 @@ type Osint struct { func (x *Osint) Reset() { *x = Osint{} - mi := &file_api_entity_proto_msgTypes[79] + mi := &file_ocsf_v1_objects_proto_msgTypes[77] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16791,7 +14423,7 @@ func (x *Osint) String() string { func (*Osint) ProtoMessage() {} func (x *Osint) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[79] + mi := &file_ocsf_v1_objects_proto_msgTypes[77] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16804,7 +14436,7 @@ func (x *Osint) ProtoReflect() protoreflect.Message { // Deprecated: Use Osint.ProtoReflect.Descriptor instead. func (*Osint) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{79} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{77} } func (x *Osint) GetAnswers() []*DnsAnswer { @@ -17189,7 +14821,7 @@ type Package struct { func (x *Package) Reset() { *x = Package{} - mi := &file_api_entity_proto_msgTypes[80] + mi := &file_ocsf_v1_objects_proto_msgTypes[78] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17201,7 +14833,7 @@ func (x *Package) String() string { func (*Package) ProtoMessage() {} func (x *Package) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[80] + mi := &file_ocsf_v1_objects_proto_msgTypes[78] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17214,7 +14846,7 @@ func (x *Package) ProtoReflect() protoreflect.Message { // Deprecated: Use Package.ProtoReflect.Descriptor instead. func (*Package) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{80} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{78} } func (x *Package) GetArchitecture() string { @@ -17352,7 +14984,7 @@ type Policy struct { func (x *Policy) Reset() { *x = Policy{} - mi := &file_api_entity_proto_msgTypes[81] + mi := &file_ocsf_v1_objects_proto_msgTypes[79] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17364,7 +14996,7 @@ func (x *Policy) String() string { func (*Policy) ProtoMessage() {} func (x *Policy) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[81] + mi := &file_ocsf_v1_objects_proto_msgTypes[79] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17377,7 +15009,7 @@ func (x *Policy) ProtoReflect() protoreflect.Message { // Deprecated: Use Policy.ProtoReflect.Descriptor instead. func (*Policy) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{81} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{79} } func (x *Policy) GetData() *structpb.Value { @@ -17447,7 +15079,7 @@ type PortInfo struct { func (x *PortInfo) Reset() { *x = PortInfo{} - mi := &file_api_entity_proto_msgTypes[82] + mi := &file_ocsf_v1_objects_proto_msgTypes[80] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17459,7 +15091,7 @@ func (x *PortInfo) String() string { func (*PortInfo) ProtoMessage() {} func (x *PortInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[82] + mi := &file_ocsf_v1_objects_proto_msgTypes[80] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17472,7 +15104,7 @@ func (x *PortInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use PortInfo.ProtoReflect.Descriptor instead. func (*PortInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{82} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{80} } func (x *PortInfo) GetPort() int32 { @@ -17536,7 +15168,7 @@ type Process struct { func (x *Process) Reset() { *x = Process{} - mi := &file_api_entity_proto_msgTypes[83] + mi := &file_ocsf_v1_objects_proto_msgTypes[81] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17548,7 +15180,7 @@ func (x *Process) String() string { func (*Process) ProtoMessage() {} func (x *Process) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[83] + mi := &file_ocsf_v1_objects_proto_msgTypes[81] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17561,7 +15193,7 @@ func (x *Process) ProtoReflect() protoreflect.Message { // Deprecated: Use Process.ProtoReflect.Descriptor instead. func (*Process) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{83} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{81} } func (x *Process) GetAncestry() []*ProcessEntity { @@ -17804,7 +15436,7 @@ type ProcessEntity struct { func (x *ProcessEntity) Reset() { *x = ProcessEntity{} - mi := &file_api_entity_proto_msgTypes[84] + mi := &file_ocsf_v1_objects_proto_msgTypes[82] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17816,7 +15448,7 @@ func (x *ProcessEntity) String() string { func (*ProcessEntity) ProtoMessage() {} func (x *ProcessEntity) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[84] + mi := &file_ocsf_v1_objects_proto_msgTypes[82] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17829,7 +15461,7 @@ func (x *ProcessEntity) ProtoReflect() protoreflect.Message { // Deprecated: Use ProcessEntity.ProtoReflect.Descriptor instead. func (*ProcessEntity) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{84} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{82} } func (x *ProcessEntity) GetCmdLine() string { @@ -17907,7 +15539,7 @@ type Product struct { func (x *Product) Reset() { *x = Product{} - mi := &file_api_entity_proto_msgTypes[85] + mi := &file_ocsf_v1_objects_proto_msgTypes[83] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17919,7 +15551,7 @@ func (x *Product) String() string { func (*Product) ProtoMessage() {} func (x *Product) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[85] + mi := &file_ocsf_v1_objects_proto_msgTypes[83] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17932,7 +15564,7 @@ func (x *Product) ProtoReflect() protoreflect.Message { // Deprecated: Use Product.ProtoReflect.Descriptor instead. func (*Product) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{85} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{83} } func (x *Product) GetCpeName() string { @@ -18024,7 +15656,7 @@ type ProgrammaticCredential struct { func (x *ProgrammaticCredential) Reset() { *x = ProgrammaticCredential{} - mi := &file_api_entity_proto_msgTypes[86] + mi := &file_ocsf_v1_objects_proto_msgTypes[84] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18036,7 +15668,7 @@ func (x *ProgrammaticCredential) String() string { func (*ProgrammaticCredential) ProtoMessage() {} func (x *ProgrammaticCredential) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[86] + mi := &file_ocsf_v1_objects_proto_msgTypes[84] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18049,7 +15681,7 @@ func (x *ProgrammaticCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use ProgrammaticCredential.ProtoReflect.Descriptor instead. func (*ProgrammaticCredential) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{86} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{84} } func (x *ProgrammaticCredential) GetLastUsedTime() int64 { @@ -18093,7 +15725,7 @@ type Remediation struct { func (x *Remediation) Reset() { *x = Remediation{} - mi := &file_api_entity_proto_msgTypes[87] + mi := &file_ocsf_v1_objects_proto_msgTypes[85] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18105,7 +15737,7 @@ func (x *Remediation) String() string { func (*Remediation) ProtoMessage() {} func (x *Remediation) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[87] + mi := &file_ocsf_v1_objects_proto_msgTypes[85] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18118,7 +15750,7 @@ func (x *Remediation) ProtoReflect() protoreflect.Message { // Deprecated: Use Remediation.ProtoReflect.Descriptor instead. func (*Remediation) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{87} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{85} } func (x *Remediation) GetCisControls() []*CisControl { @@ -18169,7 +15801,7 @@ type Reporter struct { func (x *Reporter) Reset() { *x = Reporter{} - mi := &file_api_entity_proto_msgTypes[88] + mi := &file_ocsf_v1_objects_proto_msgTypes[86] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18181,7 +15813,7 @@ func (x *Reporter) String() string { func (*Reporter) ProtoMessage() {} func (x *Reporter) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[88] + mi := &file_ocsf_v1_objects_proto_msgTypes[86] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18194,7 +15826,7 @@ func (x *Reporter) ProtoReflect() protoreflect.Message { // Deprecated: Use Reporter.ProtoReflect.Descriptor instead. func (*Reporter) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{88} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{86} } func (x *Reporter) GetHostname() string { @@ -18244,7 +15876,7 @@ type Reputation struct { func (x *Reputation) Reset() { *x = Reputation{} - mi := &file_api_entity_proto_msgTypes[89] + mi := &file_ocsf_v1_objects_proto_msgTypes[87] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18256,7 +15888,7 @@ func (x *Reputation) String() string { func (*Reputation) ProtoMessage() {} func (x *Reputation) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[89] + mi := &file_ocsf_v1_objects_proto_msgTypes[87] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18269,7 +15901,7 @@ func (x *Reputation) ProtoReflect() protoreflect.Message { // Deprecated: Use Reputation.ProtoReflect.Descriptor instead. func (*Reputation) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{89} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{87} } func (x *Reputation) GetBaseScore() float64 { @@ -18312,7 +15944,7 @@ type Request struct { func (x *Request) Reset() { *x = Request{} - mi := &file_api_entity_proto_msgTypes[90] + mi := &file_ocsf_v1_objects_proto_msgTypes[88] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18324,7 +15956,7 @@ func (x *Request) String() string { func (*Request) ProtoMessage() {} func (x *Request) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[90] + mi := &file_ocsf_v1_objects_proto_msgTypes[88] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18337,7 +15969,7 @@ func (x *Request) ProtoReflect() protoreflect.Message { // Deprecated: Use Request.ProtoReflect.Descriptor instead. func (*Request) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{90} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{88} } func (x *Request) GetContainers() []*Container { @@ -18405,7 +16037,7 @@ type ResourceDetails struct { func (x *ResourceDetails) Reset() { *x = ResourceDetails{} - mi := &file_api_entity_proto_msgTypes[91] + mi := &file_ocsf_v1_objects_proto_msgTypes[89] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18417,7 +16049,7 @@ func (x *ResourceDetails) String() string { func (*ResourceDetails) ProtoMessage() {} func (x *ResourceDetails) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[91] + mi := &file_ocsf_v1_objects_proto_msgTypes[89] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18430,7 +16062,7 @@ func (x *ResourceDetails) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceDetails.ProtoReflect.Descriptor instead. func (*ResourceDetails) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{91} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{89} } func (x *ResourceDetails) GetAgentList() []*Agent { @@ -18651,7 +16283,7 @@ type Response struct { func (x *Response) Reset() { *x = Response{} - mi := &file_api_entity_proto_msgTypes[92] + mi := &file_ocsf_v1_objects_proto_msgTypes[90] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18663,7 +16295,7 @@ func (x *Response) String() string { func (*Response) ProtoMessage() {} func (x *Response) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[92] + mi := &file_ocsf_v1_objects_proto_msgTypes[90] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18676,7 +16308,7 @@ func (x *Response) ProtoReflect() protoreflect.Message { // Deprecated: Use Response.ProtoReflect.Descriptor instead. func (*Response) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{92} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{90} } func (x *Response) GetCode() int32 { @@ -18742,7 +16374,7 @@ type Rule struct { func (x *Rule) Reset() { *x = Rule{} - mi := &file_api_entity_proto_msgTypes[93] + mi := &file_ocsf_v1_objects_proto_msgTypes[91] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18754,7 +16386,7 @@ func (x *Rule) String() string { func (*Rule) ProtoMessage() {} func (x *Rule) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[93] + mi := &file_ocsf_v1_objects_proto_msgTypes[91] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18767,7 +16399,7 @@ func (x *Rule) ProtoReflect() protoreflect.Message { // Deprecated: Use Rule.ProtoReflect.Descriptor instead. func (*Rule) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{93} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{91} } func (x *Rule) GetCategory() string { @@ -18822,7 +16454,7 @@ type San struct { func (x *San) Reset() { *x = San{} - mi := &file_api_entity_proto_msgTypes[94] + mi := &file_ocsf_v1_objects_proto_msgTypes[92] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18834,7 +16466,7 @@ func (x *San) String() string { func (*San) ProtoMessage() {} func (x *San) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[94] + mi := &file_ocsf_v1_objects_proto_msgTypes[92] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18847,7 +16479,7 @@ func (x *San) ProtoReflect() protoreflect.Message { // Deprecated: Use San.ProtoReflect.Descriptor instead. func (*San) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{94} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{92} } func (x *San) GetName() string { @@ -18881,7 +16513,7 @@ type Sbom struct { func (x *Sbom) Reset() { *x = Sbom{} - mi := &file_api_entity_proto_msgTypes[95] + mi := &file_ocsf_v1_objects_proto_msgTypes[93] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18893,7 +16525,7 @@ func (x *Sbom) String() string { func (*Sbom) ProtoMessage() {} func (x *Sbom) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[95] + mi := &file_ocsf_v1_objects_proto_msgTypes[93] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18906,7 +16538,7 @@ func (x *Sbom) ProtoReflect() protoreflect.Message { // Deprecated: Use Sbom.ProtoReflect.Descriptor instead. func (*Sbom) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{95} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{93} } func (x *Sbom) GetCreatedTime() int64 { @@ -19003,7 +16635,7 @@ type Scim struct { func (x *Scim) Reset() { *x = Scim{} - mi := &file_api_entity_proto_msgTypes[96] + mi := &file_ocsf_v1_objects_proto_msgTypes[94] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19015,7 +16647,7 @@ func (x *Scim) String() string { func (*Scim) ProtoMessage() {} func (x *Scim) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[96] + mi := &file_ocsf_v1_objects_proto_msgTypes[94] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19028,7 +16660,7 @@ func (x *Scim) ProtoReflect() protoreflect.Message { // Deprecated: Use Scim.ProtoReflect.Descriptor instead. func (*Scim) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{96} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{94} } func (x *Scim) GetAuthProtocol() string { @@ -19208,7 +16840,7 @@ type Script struct { func (x *Script) Reset() { *x = Script{} - mi := &file_api_entity_proto_msgTypes[97] + mi := &file_ocsf_v1_objects_proto_msgTypes[95] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19220,7 +16852,7 @@ func (x *Script) String() string { func (*Script) ProtoMessage() {} func (x *Script) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[97] + mi := &file_ocsf_v1_objects_proto_msgTypes[95] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19233,7 +16865,7 @@ func (x *Script) ProtoReflect() protoreflect.Message { // Deprecated: Use Script.ProtoReflect.Descriptor instead. func (*Script) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{97} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{95} } func (x *Script) GetFile() *File { @@ -19305,7 +16937,7 @@ type Service struct { func (x *Service) Reset() { *x = Service{} - mi := &file_api_entity_proto_msgTypes[98] + mi := &file_ocsf_v1_objects_proto_msgTypes[96] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19317,7 +16949,7 @@ func (x *Service) String() string { func (*Service) ProtoMessage() {} func (x *Service) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[98] + mi := &file_ocsf_v1_objects_proto_msgTypes[96] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19330,7 +16962,7 @@ func (x *Service) ProtoReflect() protoreflect.Message { // Deprecated: Use Service.ProtoReflect.Descriptor instead. func (*Service) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{98} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{96} } func (x *Service) GetLabels() []string { @@ -19391,7 +17023,7 @@ type Session struct { func (x *Session) Reset() { *x = Session{} - mi := &file_api_entity_proto_msgTypes[99] + mi := &file_ocsf_v1_objects_proto_msgTypes[97] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19403,7 +17035,7 @@ func (x *Session) String() string { func (*Session) ProtoMessage() {} func (x *Session) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[99] + mi := &file_ocsf_v1_objects_proto_msgTypes[97] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19416,7 +17048,7 @@ func (x *Session) ProtoReflect() protoreflect.Message { // Deprecated: Use Session.ProtoReflect.Descriptor instead. func (*Session) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{99} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{97} } func (x *Session) GetCount() int32 { @@ -19543,7 +17175,7 @@ type SoftwareComponent struct { func (x *SoftwareComponent) Reset() { *x = SoftwareComponent{} - mi := &file_api_entity_proto_msgTypes[100] + mi := &file_ocsf_v1_objects_proto_msgTypes[98] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19555,7 +17187,7 @@ func (x *SoftwareComponent) String() string { func (*SoftwareComponent) ProtoMessage() {} func (x *SoftwareComponent) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[100] + mi := &file_ocsf_v1_objects_proto_msgTypes[98] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19568,7 +17200,7 @@ func (x *SoftwareComponent) ProtoReflect() protoreflect.Message { // Deprecated: Use SoftwareComponent.ProtoReflect.Descriptor instead. func (*SoftwareComponent) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{100} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{98} } func (x *SoftwareComponent) GetAuthor() string { @@ -19667,7 +17299,7 @@ type Span struct { func (x *Span) Reset() { *x = Span{} - mi := &file_api_entity_proto_msgTypes[101] + mi := &file_ocsf_v1_objects_proto_msgTypes[99] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19679,7 +17311,7 @@ func (x *Span) String() string { func (*Span) ProtoMessage() {} func (x *Span) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[101] + mi := &file_ocsf_v1_objects_proto_msgTypes[99] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19692,7 +17324,7 @@ func (x *Span) ProtoReflect() protoreflect.Message { // Deprecated: Use Span.ProtoReflect.Descriptor instead. func (*Span) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{101} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{99} } func (x *Span) GetDuration() int64 { @@ -19797,7 +17429,7 @@ type Sso struct { func (x *Sso) Reset() { *x = Sso{} - mi := &file_api_entity_proto_msgTypes[102] + mi := &file_ocsf_v1_objects_proto_msgTypes[100] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19809,7 +17441,7 @@ func (x *Sso) String() string { func (*Sso) ProtoMessage() {} func (x *Sso) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[102] + mi := &file_ocsf_v1_objects_proto_msgTypes[100] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19822,7 +17454,7 @@ func (x *Sso) ProtoReflect() protoreflect.Message { // Deprecated: Use Sso.ProtoReflect.Descriptor instead. func (*Sso) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{102} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{100} } func (x *Sso) GetAuthProtocol() string { @@ -19955,7 +17587,7 @@ type SubTechnique struct { func (x *SubTechnique) Reset() { *x = SubTechnique{} - mi := &file_api_entity_proto_msgTypes[103] + mi := &file_ocsf_v1_objects_proto_msgTypes[101] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19967,7 +17599,7 @@ func (x *SubTechnique) String() string { func (*SubTechnique) ProtoMessage() {} func (x *SubTechnique) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[103] + mi := &file_ocsf_v1_objects_proto_msgTypes[101] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19980,7 +17612,7 @@ func (x *SubTechnique) ProtoReflect() protoreflect.Message { // Deprecated: Use SubTechnique.ProtoReflect.Descriptor instead. func (*SubTechnique) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{103} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{101} } func (x *SubTechnique) GetName() string { @@ -20015,7 +17647,7 @@ type Tactic struct { func (x *Tactic) Reset() { *x = Tactic{} - mi := &file_api_entity_proto_msgTypes[104] + mi := &file_ocsf_v1_objects_proto_msgTypes[102] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20027,7 +17659,7 @@ func (x *Tactic) String() string { func (*Tactic) ProtoMessage() {} func (x *Tactic) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[104] + mi := &file_ocsf_v1_objects_proto_msgTypes[102] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20040,7 +17672,7 @@ func (x *Tactic) ProtoReflect() protoreflect.Message { // Deprecated: Use Tactic.ProtoReflect.Descriptor instead. func (*Tactic) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{104} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{102} } func (x *Tactic) GetName() string { @@ -20075,7 +17707,7 @@ type Technique struct { func (x *Technique) Reset() { *x = Technique{} - mi := &file_api_entity_proto_msgTypes[105] + mi := &file_ocsf_v1_objects_proto_msgTypes[103] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20087,7 +17719,7 @@ func (x *Technique) String() string { func (*Technique) ProtoMessage() {} func (x *Technique) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[105] + mi := &file_ocsf_v1_objects_proto_msgTypes[103] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20100,7 +17732,7 @@ func (x *Technique) ProtoReflect() protoreflect.Message { // Deprecated: Use Technique.ProtoReflect.Descriptor instead. func (*Technique) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{105} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{103} } func (x *Technique) GetName() string { @@ -20135,7 +17767,7 @@ type ThreatActor struct { func (x *ThreatActor) Reset() { *x = ThreatActor{} - mi := &file_api_entity_proto_msgTypes[106] + mi := &file_ocsf_v1_objects_proto_msgTypes[104] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20147,7 +17779,7 @@ func (x *ThreatActor) String() string { func (*ThreatActor) ProtoMessage() {} func (x *ThreatActor) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[106] + mi := &file_ocsf_v1_objects_proto_msgTypes[104] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20160,7 +17792,7 @@ func (x *ThreatActor) ProtoReflect() protoreflect.Message { // Deprecated: Use ThreatActor.ProtoReflect.Descriptor instead. func (*ThreatActor) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{106} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{104} } func (x *ThreatActor) GetName() string { @@ -20206,7 +17838,7 @@ type Timespan struct { func (x *Timespan) Reset() { *x = Timespan{} - mi := &file_api_entity_proto_msgTypes[107] + mi := &file_ocsf_v1_objects_proto_msgTypes[105] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20218,7 +17850,7 @@ func (x *Timespan) String() string { func (*Timespan) ProtoMessage() {} func (x *Timespan) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[107] + mi := &file_ocsf_v1_objects_proto_msgTypes[105] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20231,7 +17863,7 @@ func (x *Timespan) ProtoReflect() protoreflect.Message { // Deprecated: Use Timespan.ProtoReflect.Descriptor instead. func (*Timespan) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{107} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{105} } func (x *Timespan) GetDuration() int64 { @@ -20353,7 +17985,7 @@ type Token struct { func (x *Token) Reset() { *x = Token{} - mi := &file_api_entity_proto_msgTypes[108] + mi := &file_ocsf_v1_objects_proto_msgTypes[106] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20365,7 +17997,7 @@ func (x *Token) String() string { func (*Token) ProtoMessage() {} func (x *Token) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[108] + mi := &file_ocsf_v1_objects_proto_msgTypes[106] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20378,7 +18010,7 @@ func (x *Token) ProtoReflect() protoreflect.Message { // Deprecated: Use Token.ProtoReflect.Descriptor instead. func (*Token) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{108} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{106} } func (x *Token) GetCreatedTime() int64 { @@ -20489,7 +18121,7 @@ type Trace struct { func (x *Trace) Reset() { *x = Trace{} - mi := &file_api_entity_proto_msgTypes[109] + mi := &file_ocsf_v1_objects_proto_msgTypes[107] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20501,7 +18133,7 @@ func (x *Trace) String() string { func (*Trace) ProtoMessage() {} func (x *Trace) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[109] + mi := &file_ocsf_v1_objects_proto_msgTypes[107] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20514,7 +18146,7 @@ func (x *Trace) ProtoReflect() protoreflect.Message { // Deprecated: Use Trace.ProtoReflect.Descriptor instead. func (*Trace) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{109} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{107} } func (x *Trace) GetDuration() int64 { @@ -20595,7 +18227,7 @@ type TransformationInfo struct { func (x *TransformationInfo) Reset() { *x = TransformationInfo{} - mi := &file_api_entity_proto_msgTypes[110] + mi := &file_ocsf_v1_objects_proto_msgTypes[108] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20607,7 +18239,7 @@ func (x *TransformationInfo) String() string { func (*TransformationInfo) ProtoMessage() {} func (x *TransformationInfo) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[110] + mi := &file_ocsf_v1_objects_proto_msgTypes[108] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20620,7 +18252,7 @@ func (x *TransformationInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use TransformationInfo.ProtoReflect.Descriptor instead. func (*TransformationInfo) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{110} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{108} } func (x *TransformationInfo) GetLang() string { @@ -20691,7 +18323,7 @@ type Url struct { func (x *Url) Reset() { *x = Url{} - mi := &file_api_entity_proto_msgTypes[111] + mi := &file_ocsf_v1_objects_proto_msgTypes[109] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20703,7 +18335,7 @@ func (x *Url) String() string { func (*Url) ProtoMessage() {} func (x *Url) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[111] + mi := &file_ocsf_v1_objects_proto_msgTypes[109] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20716,7 +18348,7 @@ func (x *Url) ProtoReflect() protoreflect.Message { // Deprecated: Use Url.ProtoReflect.Descriptor instead. func (*Url) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{111} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{109} } func (x *Url) GetCategories() []string { @@ -20825,7 +18457,7 @@ type User struct { func (x *User) Reset() { *x = User{} - mi := &file_api_entity_proto_msgTypes[112] + mi := &file_ocsf_v1_objects_proto_msgTypes[110] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -20837,7 +18469,7 @@ func (x *User) String() string { func (*User) ProtoMessage() {} func (x *User) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[112] + mi := &file_ocsf_v1_objects_proto_msgTypes[110] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -20850,7 +18482,7 @@ func (x *User) ProtoReflect() protoreflect.Message { // Deprecated: Use User.ProtoReflect.Descriptor instead. func (*User) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{112} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{110} } func (x *User) GetAccount() *Account { @@ -21039,7 +18671,7 @@ type Vulnerability struct { func (x *Vulnerability) Reset() { *x = Vulnerability{} - mi := &file_api_entity_proto_msgTypes[113] + mi := &file_ocsf_v1_objects_proto_msgTypes[111] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -21051,7 +18683,7 @@ func (x *Vulnerability) String() string { func (*Vulnerability) ProtoMessage() {} func (x *Vulnerability) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[113] + mi := &file_ocsf_v1_objects_proto_msgTypes[111] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -21064,7 +18696,7 @@ func (x *Vulnerability) ProtoReflect() protoreflect.Message { // Deprecated: Use Vulnerability.ProtoReflect.Descriptor instead. func (*Vulnerability) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{113} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{111} } func (x *Vulnerability) GetAdvisory() *Advisory { @@ -21310,7 +18942,7 @@ type Whois struct { func (x *Whois) Reset() { *x = Whois{} - mi := &file_api_entity_proto_msgTypes[114] + mi := &file_ocsf_v1_objects_proto_msgTypes[112] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -21322,7 +18954,7 @@ func (x *Whois) String() string { func (*Whois) ProtoMessage() {} func (x *Whois) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[114] + mi := &file_ocsf_v1_objects_proto_msgTypes[112] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -21335,7 +18967,7 @@ func (x *Whois) ProtoReflect() protoreflect.Message { // Deprecated: Use Whois.ProtoReflect.Descriptor instead. func (*Whois) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{114} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{112} } func (x *Whois) GetAutonomousSystem() *AutonomousSystem { @@ -21492,7 +19124,7 @@ type WinService struct { func (x *WinService) Reset() { *x = WinService{} - mi := &file_api_entity_proto_msgTypes[115] + mi := &file_ocsf_v1_objects_proto_msgTypes[113] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -21504,7 +19136,7 @@ func (x *WinService) String() string { func (*WinService) ProtoMessage() {} func (x *WinService) ProtoReflect() protoreflect.Message { - mi := &file_api_entity_proto_msgTypes[115] + mi := &file_ocsf_v1_objects_proto_msgTypes[113] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -21517,7 +19149,7 @@ func (x *WinService) ProtoReflect() protoreflect.Message { // Deprecated: Use WinService.ProtoReflect.Descriptor instead. func (*WinService) Descriptor() ([]byte, []int) { - return file_api_entity_proto_rawDescGZIP(), []int{115} + return file_ocsf_v1_objects_proto_rawDescGZIP(), []int{113} } func (x *WinService) GetCmdLine() string { @@ -21660,354 +19292,11 @@ func (x *WinService) GetVersion() string { return "" } -var File_api_entity_proto protoreflect.FileDescriptor +var File_ocsf_v1_objects_proto protoreflect.FileDescriptor -const file_api_entity_proto_rawDesc = "" + - "\n" + - "\x10api_entity.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\"\xa5'\n" + - "\vApiActivity\x12\x16\n" + - "\x06action\x18\x01 \x01(\tR\x06action\x12:\n" + - "\taction_id\x18\x02 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ActionIdR\bactionId\x12H\n" + - "\vactivity_id\x18\x03 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + - "activityId\x12#\n" + - "\ractivity_name\x18\x04 \x01(\tR\factivityName\x12,\n" + - "\x05actor\x18\x05 \x01(\v2\x0e.ocsf.v1.ActorB\x06\xbaH\x03\xc8\x01\x01R\x05actor\x12+\n" + - "\bai_model\x18\x06 \x01(\v2\x10.ocsf.v1.AiModelR\aaiModel\x12&\n" + - "\x03api\x18\a \x01(\v2\f.ocsf.v1.ApiB\x06\xbaH\x03\xc8\x01\x01R\x03api\x12)\n" + - "\aattacks\x18\b \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + - "\x0eauthorizations\x18\t \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + - "\rcategory_name\x18\n" + - " \x01(\tR\fcategoryName\x12K\n" + - "\fcategory_uid\x18\v \x01(\x0e2 .ocsf.v1.ApiActivity.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + - "\n" + - "class_name\x18\f \x01(\tR\tclassName\x12B\n" + - "\tclass_uid\x18\r \x01(\x0e2\x1d.ocsf.v1.ApiActivity.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + - "\x05cloud\x18\x0e \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x1e\n" + - "\n" + - "confidence\x18\x0f \x01(\tR\n" + - "confidence\x12F\n" + - "\rconfidence_id\x18\x10 \x01(\x0e2!.ocsf.v1.ApiActivity.ConfidenceIdR\fconfidenceId\x12)\n" + - "\x10confidence_score\x18\x11 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + - "\x05count\x18\x12 \x01(\x05R\x05count\x12'\n" + - "\x06device\x18\x13 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + - "\vdisposition\x18\x14 \x01(\tR\vdisposition\x12I\n" + - "\x0edisposition_id\x18\x15 \x01(\x0e2\".ocsf.v1.ApiActivity.DispositionIdR\rdispositionId\x12;\n" + - "\fdst_endpoint\x18\x16 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vdstEndpoint\x12\x1a\n" + - "\bduration\x18\x17 \x01(\x03R\bduration\x12\x19\n" + - "\bend_time\x18\x18 \x01(\x03R\aendTime\x12\x1e\n" + - "\vend_time_dt\x18\x19 \x01(\tR\tendTimeDt\x125\n" + - "\venrichments\x18\x1a \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x12:\n" + - "\rfirewall_rule\x18\x1b \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + - "\fhttp_request\x18\x1c \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + - "\rhttp_response\x18\x1d \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + - "\bis_alert\x18\x1e \x01(\bR\aisAlert\x12*\n" + - "\amalware\x18\x1f \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + - "\x11malware_scan_info\x18 \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + - "\amessage\x18! \x01(\tR\amessage\x12@\n" + - "\x0fmessage_context\x18\" \x01(\v2\x17.ocsf.v1.MessageContextR\x0emessageContext\x125\n" + - "\bmetadata\x18# \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + - "\vobservables\x18$ \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + - "\x05osint\x18% \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + - "\x06policy\x18& \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + - "\braw_data\x18' \x01(\tR\arawData\x128\n" + - "\rraw_data_hash\x18( \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + - "\rraw_data_size\x18) \x01(\x03R\vrawDataSize\x126\n" + - "\tresources\x18* \x03(\v2\x18.ocsf.v1.ResourceDetailsR\tresources\x12!\n" + - "\frisk_details\x18+ \x01(\tR\vriskDetails\x12\x1d\n" + - "\n" + - "risk_level\x18, \x01(\tR\triskLevel\x12D\n" + - "\rrisk_level_id\x18- \x01(\x0e2 .ocsf.v1.ApiActivity.RiskLevelIdR\vriskLevelId\x12\x1d\n" + - "\n" + - "risk_score\x18. \x01(\x05R\triskScore\x12\x1a\n" + - "\bseverity\x18/ \x01(\tR\bseverity\x12H\n" + - "\vseverity_id\x180 \x01(\x0e2\x1f.ocsf.v1.ApiActivity.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + - "severityId\x12C\n" + - "\fsrc_endpoint\x181 \x01(\v2\x18.ocsf.v1.NetworkEndpointB\x06\xbaH\x03\xc8\x01\x01R\vsrcEndpoint\x12\x1d\n" + - "\n" + - "start_time\x182 \x01(\x03R\tstartTime\x12\"\n" + - "\rstart_time_dt\x183 \x01(\tR\vstartTimeDt\x12\x16\n" + - "\x06status\x184 \x01(\tR\x06status\x12\x1f\n" + - "\vstatus_code\x185 \x01(\tR\n" + - "statusCode\x12#\n" + - "\rstatus_detail\x186 \x01(\tR\fstatusDetail\x12:\n" + - "\tstatus_id\x187 \x01(\x0e2\x1d.ocsf.v1.ApiActivity.StatusIdR\bstatusId\x12\x1a\n" + - "\x04time\x188 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + - "\atime_dt\x189 \x01(\tR\x06timeDt\x12'\n" + - "\x0ftimezone_offset\x18: \x01(\x05R\x0etimezoneOffset\x12$\n" + - "\x05trace\x18; \x01(\v2\x0e.ocsf.v1.TraceR\x05trace\x12\x1b\n" + - "\ttype_name\x18< \x01(\tR\btypeName\x12?\n" + - "\btype_uid\x18= \x01(\x0e2\x1c.ocsf.v1.ApiActivity.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + - "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + - "\bActionId\x12\x15\n" + - "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + - "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + - "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + - "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + - "\x0fACTION_ID_OTHER\x10c\"\x9a\x01\n" + - "\n" + - "ActivityId\x12\x17\n" + - "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + - "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + - "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + - "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + - "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x15\n" + - "\x11ACTIVITY_ID_OTHER\x10c\"N\n" + - "\vCategoryUid\x12\x18\n" + - "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12%\n" + - "!CATEGORY_UID_APPLICATION_ACTIVITY\x10\x06\">\n" + - "\bClassUid\x12\x15\n" + - "\x11CLASS_UID_UNKNOWN\x10\x00\x12\x1b\n" + - "\x16CLASS_UID_API_ACTIVITY\x10\xf3.\"\x8b\x01\n" + - "\fConfidenceId\x12\x19\n" + - "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + - "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + - "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + - "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + - "\rDispositionId\x12\x1a\n" + - "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + - "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + - "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + - "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + - "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + - "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + - "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + - "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + - "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + - "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + - "\x19DISPOSITION_ID_EXONERATED\x10\n" + - "\x12\x1c\n" + - "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + - "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + - "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + - "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + - "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + - "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + - "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + - "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + - "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + - "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + - "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + - "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + - "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + - "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + - "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + - "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + - "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + - "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + - "\vRiskLevelId\x12\x16\n" + - "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + - "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + - "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + - "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + - "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + - "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + - "\n" + - "SeverityId\x12\x17\n" + - "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + - "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + - "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + - "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + - "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + - "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + - "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + - "\x11SEVERITY_ID_OTHER\x10c\"d\n" + - "\bStatusId\x12\x15\n" + - "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + - "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + - "\x0fSTATUS_ID_OTHER\x10c\"\xf5\x01\n" + - "\aTypeUid\x12\x14\n" + - "\x10TYPE_UID_UNKNOWN\x10\x00\x12#\n" + - "\x1dTYPE_UID_API_ACTIVITY_UNKNOWN\x10\xec\xd1$\x12\"\n" + - "\x1cTYPE_UID_API_ACTIVITY_CREATE\x10\xed\xd1$\x12 \n" + - "\x1aTYPE_UID_API_ACTIVITY_READ\x10\xee\xd1$\x12\"\n" + - "\x1cTYPE_UID_API_ACTIVITY_UPDATE\x10\xef\xd1$\x12\"\n" + - "\x1cTYPE_UID_API_ACTIVITY_DELETE\x10\xf0\xd1$\x12!\n" + - "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$\"\x8d,\n" + - "\x10EntityManagement\x12\x1f\n" + - "\vaccess_list\x18\x01 \x03(\tR\n" + - "accessList\x12\x1f\n" + - "\vaccess_mask\x18\x02 \x01(\x05R\n" + - "accessMask\x12\x16\n" + - "\x06action\x18\x03 \x01(\tR\x06action\x12?\n" + - "\taction_id\x18\x04 \x01(\x0e2\".ocsf.v1.EntityManagement.ActionIdR\bactionId\x12M\n" + - "\vactivity_id\x18\x05 \x01(\x0e2$.ocsf.v1.EntityManagement.ActivityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + - "activityId\x12#\n" + - "\ractivity_name\x18\x06 \x01(\tR\factivityName\x12$\n" + - "\x05actor\x18\a \x01(\v2\x0e.ocsf.v1.ActorR\x05actor\x12\x1e\n" + - "\x03api\x18\b \x01(\v2\f.ocsf.v1.ApiR\x03api\x12)\n" + - "\aattacks\x18\t \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + - "\x0eauthorizations\x18\n" + - " \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + - "\rcategory_name\x18\v \x01(\tR\fcategoryName\x12P\n" + - "\fcategory_uid\x18\f \x01(\x0e2%.ocsf.v1.EntityManagement.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + - "\n" + - "class_name\x18\r \x01(\tR\tclassName\x12G\n" + - "\tclass_uid\x18\x0e \x01(\x0e2\".ocsf.v1.EntityManagement.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + - "\x05cloud\x18\x0f \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x18\n" + - "\acomment\x18\x10 \x01(\tR\acomment\x12\x1e\n" + - "\n" + - "confidence\x18\x11 \x01(\tR\n" + - "confidence\x12K\n" + - "\rconfidence_id\x18\x12 \x01(\x0e2&.ocsf.v1.EntityManagement.ConfidenceIdR\fconfidenceId\x12)\n" + - "\x10confidence_score\x18\x13 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + - "\x05count\x18\x14 \x01(\x05R\x05count\x12'\n" + - "\x06device\x18\x15 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + - "\vdisposition\x18\x16 \x01(\tR\vdisposition\x12N\n" + - "\x0edisposition_id\x18\x17 \x01(\x0e2'.ocsf.v1.EntityManagement.DispositionIdR\rdispositionId\x12\x1a\n" + - "\bduration\x18\x18 \x01(\x03R\bduration\x12\x19\n" + - "\bend_time\x18\x19 \x01(\x03R\aendTime\x12\x1e\n" + - "\vend_time_dt\x18\x1a \x01(\tR\tendTimeDt\x125\n" + - "\venrichments\x18\x1b \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x126\n" + - "\x06entity\x18\x1c \x01(\v2\x16.ocsf.v1.ManagedEntityB\x06\xbaH\x03\xc8\x01\x01R\x06entity\x12;\n" + - "\rentity_result\x18\x1d \x01(\v2\x16.ocsf.v1.ManagedEntityR\fentityResult\x12:\n" + - "\rfirewall_rule\x18\x1e \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + - "\fhttp_request\x18\x1f \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + - "\rhttp_response\x18 \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + - "\bis_alert\x18! \x01(\bR\aisAlert\x12*\n" + - "\amalware\x18\" \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + - "\x11malware_scan_info\x18# \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + - "\amessage\x18$ \x01(\tR\amessage\x125\n" + - "\bmetadata\x18% \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + - "\vobservables\x18& \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + - "\x05osint\x18' \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + - "\x06policy\x18( \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + - "\braw_data\x18) \x01(\tR\arawData\x128\n" + - "\rraw_data_hash\x18* \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + - "\rraw_data_size\x18+ \x01(\x03R\vrawDataSize\x12!\n" + - "\frisk_details\x18, \x01(\tR\vriskDetails\x12\x1d\n" + - "\n" + - "risk_level\x18- \x01(\tR\triskLevel\x12I\n" + - "\rrisk_level_id\x18. \x01(\x0e2%.ocsf.v1.EntityManagement.RiskLevelIdR\vriskLevelId\x12\x1d\n" + - "\n" + - "risk_score\x18/ \x01(\x05R\triskScore\x12\x1a\n" + - "\bseverity\x180 \x01(\tR\bseverity\x12M\n" + - "\vseverity_id\x181 \x01(\x0e2$.ocsf.v1.EntityManagement.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + - "severityId\x12;\n" + - "\fsrc_endpoint\x182 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vsrcEndpoint\x12\x1d\n" + - "\n" + - "start_time\x183 \x01(\x03R\tstartTime\x12\"\n" + - "\rstart_time_dt\x184 \x01(\tR\vstartTimeDt\x12\x16\n" + - "\x06status\x185 \x01(\tR\x06status\x12\x1f\n" + - "\vstatus_code\x186 \x01(\tR\n" + - "statusCode\x12#\n" + - "\rstatus_detail\x187 \x01(\tR\fstatusDetail\x12?\n" + - "\tstatus_id\x188 \x01(\x0e2\".ocsf.v1.EntityManagement.StatusIdR\bstatusId\x12\x1a\n" + - "\x04time\x189 \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + - "\atime_dt\x18: \x01(\tR\x06timeDt\x12'\n" + - "\x0ftimezone_offset\x18; \x01(\x05R\x0etimezoneOffset\x12\x1b\n" + - "\ttype_name\x18< \x01(\tR\btypeName\x12D\n" + - "\btype_uid\x18= \x01(\x0e2!.ocsf.v1.EntityManagement.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + - "\bunmapped\x18> \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + - "\bActionId\x12\x15\n" + - "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + - "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + - "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + - "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + - "\x0fACTION_ID_OTHER\x10c\"\xfa\x02\n" + - "\n" + - "ActivityId\x12\x17\n" + - "\x13ACTIVITY_ID_UNKNOWN\x10\x00\x12\x16\n" + - "\x12ACTIVITY_ID_CREATE\x10\x01\x12\x14\n" + - "\x10ACTIVITY_ID_READ\x10\x02\x12\x16\n" + - "\x12ACTIVITY_ID_UPDATE\x10\x03\x12\x16\n" + - "\x12ACTIVITY_ID_DELETE\x10\x04\x12\x14\n" + - "\x10ACTIVITY_ID_MOVE\x10\x05\x12\x16\n" + - "\x12ACTIVITY_ID_ENROLL\x10\x06\x12\x18\n" + - "\x14ACTIVITY_ID_UNENROLL\x10\a\x12\x16\n" + - "\x12ACTIVITY_ID_ENABLE\x10\b\x12\x17\n" + - "\x13ACTIVITY_ID_DISABLE\x10\t\x12\x18\n" + - "\x14ACTIVITY_ID_ACTIVATE\x10\n" + - "\x12\x1a\n" + - "\x16ACTIVITY_ID_DEACTIVATE\x10\v\x12\x17\n" + - "\x13ACTIVITY_ID_SUSPEND\x10\f\x12\x16\n" + - "\x12ACTIVITY_ID_RESUME\x10\r\x12\x15\n" + - "\x11ACTIVITY_ID_OTHER\x10c\"T\n" + - "\vCategoryUid\x12\x18\n" + - "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12+\n" + - "'CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT\x10\x03\"C\n" + - "\bClassUid\x12\x15\n" + - "\x11CLASS_UID_UNKNOWN\x10\x00\x12 \n" + - "\x1bCLASS_UID_ENTITY_MANAGEMENT\x10\xbc\x17\"\x8b\x01\n" + - "\fConfidenceId\x12\x19\n" + - "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + - "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + - "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + - "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + - "\rDispositionId\x12\x1a\n" + - "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + - "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + - "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + - "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + - "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + - "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + - "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + - "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + - "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + - "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + - "\x19DISPOSITION_ID_EXONERATED\x10\n" + - "\x12\x1c\n" + - "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + - "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + - "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + - "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + - "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + - "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + - "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + - "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + - "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + - "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + - "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + - "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + - "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + - "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + - "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + - "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + - "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + - "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + - "\vRiskLevelId\x12\x16\n" + - "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + - "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + - "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + - "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + - "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + - "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + +const file_ocsf_v1_objects_proto_rawDesc = "" + "\n" + - "SeverityId\x12\x17\n" + - "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + - "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + - "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + - "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + - "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + - "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + - "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + - "\x11SEVERITY_ID_OTHER\x10c\"d\n" + - "\bStatusId\x12\x15\n" + - "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + - "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + - "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + - "\x0fSTATUS_ID_OTHER\x10c\"\x8c\x05\n" + - "\aTypeUid\x12\x14\n" + - "\x10TYPE_UID_UNKNOWN\x10\x00\x12(\n" + - "\"TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN\x10\xf0\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_CREATE\x10\xf1\xaa\x12\x12%\n" + - "\x1fTYPE_UID_ENTITY_MANAGEMENT_READ\x10\xf2\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_UPDATE\x10\xf3\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_DELETE\x10\xf4\xaa\x12\x12%\n" + - "\x1fTYPE_UID_ENTITY_MANAGEMENT_MOVE\x10\xf5\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_ENROLL\x10\xf6\xaa\x12\x12)\n" + - "#TYPE_UID_ENTITY_MANAGEMENT_UNENROLL\x10\xf7\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_ENABLE\x10\xf8\xaa\x12\x12(\n" + - "\"TYPE_UID_ENTITY_MANAGEMENT_DISABLE\x10\xf9\xaa\x12\x12)\n" + - "#TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE\x10\xfa\xaa\x12\x12+\n" + - "%TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE\x10\xfb\xaa\x12\x12(\n" + - "\"TYPE_UID_ENTITY_MANAGEMENT_SUSPEND\x10\xfc\xaa\x12\x12'\n" + - "!TYPE_UID_ENTITY_MANAGEMENT_RESUME\x10\xfd\xaa\x12\x12&\n" + - " TYPE_UID_ENTITY_MANAGEMENT_OTHER\x10ӫ\x12\"\xeb\a\n" + + "\x15ocsf/v1/objects.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\"\xeb\a\n" + "\aAccount\x12\x1f\n" + "\vis_disabled\x18\x01 \x01(\bR\n" + "isDisabled\x12\x1b\n" + @@ -24476,632 +21765,545 @@ const file_api_entity_proto_rawDesc = "" + "\x17WinService.at_least_one\x12\xa7\x01at least one of [cmd_line, service_category_id, service_dependencies, service_error_control_id, service_start_name, service_start_type_id, service_type_id] must be set\x1a\xdb\x01has(this.cmd_line) || has(this.service_category_id) || has(this.service_dependencies) || has(this.service_error_control_id) || has(this.service_start_name) || has(this.service_start_type_id) || has(this.service_type_id)b\x06proto3" var ( - file_api_entity_proto_rawDescOnce sync.Once - file_api_entity_proto_rawDescData []byte + file_ocsf_v1_objects_proto_rawDescOnce sync.Once + file_ocsf_v1_objects_proto_rawDescData []byte ) -func file_api_entity_proto_rawDescGZIP() []byte { - file_api_entity_proto_rawDescOnce.Do(func() { - file_api_entity_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_entity_proto_rawDesc), len(file_api_entity_proto_rawDesc))) +func file_ocsf_v1_objects_proto_rawDescGZIP() []byte { + file_ocsf_v1_objects_proto_rawDescOnce.Do(func() { + file_ocsf_v1_objects_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ocsf_v1_objects_proto_rawDesc), len(file_ocsf_v1_objects_proto_rawDesc))) }) - return file_api_entity_proto_rawDescData -} - -var file_api_entity_proto_enumTypes = make([]protoimpl.EnumInfo, 88) -var file_api_entity_proto_msgTypes = make([]protoimpl.MessageInfo, 116) -var file_api_entity_proto_goTypes = []any{ - (ApiActivity_ActionId)(0), // 0: ocsf.v1.ApiActivity.ActionId - (ApiActivity_ActivityId)(0), // 1: ocsf.v1.ApiActivity.ActivityId - (ApiActivity_CategoryUid)(0), // 2: ocsf.v1.ApiActivity.CategoryUid - (ApiActivity_ClassUid)(0), // 3: ocsf.v1.ApiActivity.ClassUid - (ApiActivity_ConfidenceId)(0), // 4: ocsf.v1.ApiActivity.ConfidenceId - (ApiActivity_DispositionId)(0), // 5: ocsf.v1.ApiActivity.DispositionId - (ApiActivity_RiskLevelId)(0), // 6: ocsf.v1.ApiActivity.RiskLevelId - (ApiActivity_SeverityId)(0), // 7: ocsf.v1.ApiActivity.SeverityId - (ApiActivity_StatusId)(0), // 8: ocsf.v1.ApiActivity.StatusId - (ApiActivity_TypeUid)(0), // 9: ocsf.v1.ApiActivity.TypeUid - (EntityManagement_ActionId)(0), // 10: ocsf.v1.EntityManagement.ActionId - (EntityManagement_ActivityId)(0), // 11: ocsf.v1.EntityManagement.ActivityId - (EntityManagement_CategoryUid)(0), // 12: ocsf.v1.EntityManagement.CategoryUid - (EntityManagement_ClassUid)(0), // 13: ocsf.v1.EntityManagement.ClassUid - (EntityManagement_ConfidenceId)(0), // 14: ocsf.v1.EntityManagement.ConfidenceId - (EntityManagement_DispositionId)(0), // 15: ocsf.v1.EntityManagement.DispositionId - (EntityManagement_RiskLevelId)(0), // 16: ocsf.v1.EntityManagement.RiskLevelId - (EntityManagement_SeverityId)(0), // 17: ocsf.v1.EntityManagement.SeverityId - (EntityManagement_StatusId)(0), // 18: ocsf.v1.EntityManagement.StatusId - (EntityManagement_TypeUid)(0), // 19: ocsf.v1.EntityManagement.TypeUid - (Account_TypeId)(0), // 20: ocsf.v1.Account.TypeId - (Advisory_InstallStateId)(0), // 21: ocsf.v1.Advisory.InstallStateId - (AffectedPackage_TypeId)(0), // 22: ocsf.v1.AffectedPackage.TypeId - (Agent_TypeId)(0), // 23: ocsf.v1.Agent.TypeId - (Analytic_StateId)(0), // 24: ocsf.v1.Analytic.StateId - (Analytic_TypeId)(0), // 25: ocsf.v1.Analytic.TypeId - (Application_RiskLevelId)(0), // 26: ocsf.v1.Application.RiskLevelId - (AuthFactor_FactorTypeId)(0), // 27: ocsf.v1.AuthFactor.FactorTypeId - (DataClassification_CategoryId)(0), // 28: ocsf.v1.DataClassification.CategoryId - (DataClassification_ConfidentialityId)(0), // 29: ocsf.v1.DataClassification.ConfidentialityId - (DataClassification_StatusId)(0), // 30: ocsf.v1.DataClassification.StatusId - (Device_RiskLevelId)(0), // 31: ocsf.v1.Device.RiskLevelId - (Device_TypeId)(0), // 32: ocsf.v1.Device.TypeId - (DeviceHwInfo_CpuArchitectureId)(0), // 33: ocsf.v1.DeviceHwInfo.CpuArchitectureId - (DigitalSignature_AlgorithmId)(0), // 34: ocsf.v1.DigitalSignature.AlgorithmId - (DigitalSignature_StateId)(0), // 35: ocsf.v1.DigitalSignature.StateId - (DnsAnswer_FlagIds)(0), // 36: ocsf.v1.DnsAnswer.FlagIds - (DomainContact_TypeId)(0), // 37: ocsf.v1.DomainContact.TypeId - (EncryptionDetails_AlgorithmId)(0), // 38: ocsf.v1.EncryptionDetails.AlgorithmId - (File_ConfidentialityId)(0), // 39: ocsf.v1.File.ConfidentialityId - (File_DriveTypeId)(0), // 40: ocsf.v1.File.DriveTypeId - (File_TypeId)(0), // 41: ocsf.v1.File.TypeId - (Fingerprint_AlgorithmId)(0), // 42: ocsf.v1.Fingerprint.AlgorithmId - (GpuInfo_BusTypeId)(0), // 43: ocsf.v1.GpuInfo.BusTypeId - (GpuInfo_VramModeId)(0), // 44: ocsf.v1.GpuInfo.VramModeId - (Graph_QueryLanguageId)(0), // 45: ocsf.v1.Graph.QueryLanguageId - (Idp_StateId)(0), // 46: ocsf.v1.Idp.StateId - (KbArticle_InstallStateId)(0), // 47: ocsf.v1.KbArticle.InstallStateId - (KillChainPhase_PhaseId)(0), // 48: ocsf.v1.KillChainPhase.PhaseId - (Malware_ClassificationIds)(0), // 49: ocsf.v1.Malware.ClassificationIds - (Malware_SeverityId)(0), // 50: ocsf.v1.Malware.SeverityId - (MalwareScanInfo_TypeId)(0), // 51: ocsf.v1.MalwareScanInfo.TypeId - (ManagedEntity_TypeId)(0), // 52: ocsf.v1.ManagedEntity.TypeId - (MessageContext_AiRoleId)(0), // 53: ocsf.v1.MessageContext.AiRoleId - (NetworkEndpoint_NetworkScopeId)(0), // 54: ocsf.v1.NetworkEndpoint.NetworkScopeId - (NetworkEndpoint_TypeId)(0), // 55: ocsf.v1.NetworkEndpoint.TypeId - (NetworkInterface_TypeId)(0), // 56: ocsf.v1.NetworkInterface.TypeId - (NetworkProxy_NetworkScopeId)(0), // 57: ocsf.v1.NetworkProxy.NetworkScopeId - (NetworkProxy_TypeId)(0), // 58: ocsf.v1.NetworkProxy.TypeId - (Observable_TypeId)(0), // 59: ocsf.v1.Observable.TypeId - (Os_TypeId)(0), // 60: ocsf.v1.Os.TypeId - (Osint_ConfidenceId)(0), // 61: ocsf.v1.Osint.ConfidenceId - (Osint_DetectionPatternTypeId)(0), // 62: ocsf.v1.Osint.DetectionPatternTypeId - (Osint_SeverityId)(0), // 63: ocsf.v1.Osint.SeverityId - (Osint_TypeId)(0), // 64: ocsf.v1.Osint.TypeId - (Package_TypeId)(0), // 65: ocsf.v1.Package.TypeId - (Process_IntegrityId)(0), // 66: ocsf.v1.Process.IntegrityId - (Reputation_ScoreId)(0), // 67: ocsf.v1.Reputation.ScoreId - (ResourceDetails_RoleId)(0), // 68: ocsf.v1.ResourceDetails.RoleId - (Sbom_TypeId)(0), // 69: ocsf.v1.Sbom.TypeId - (Scim_AuthProtocolId)(0), // 70: ocsf.v1.Scim.AuthProtocolId - (Scim_StateId)(0), // 71: ocsf.v1.Scim.StateId - (Script_TypeId)(0), // 72: ocsf.v1.Script.TypeId - (SoftwareComponent_RelationshipId)(0), // 73: ocsf.v1.SoftwareComponent.RelationshipId - (SoftwareComponent_TypeId)(0), // 74: ocsf.v1.SoftwareComponent.TypeId - (Sso_AuthProtocolId)(0), // 75: ocsf.v1.Sso.AuthProtocolId - (ThreatActor_TypeId)(0), // 76: ocsf.v1.ThreatActor.TypeId - (Timespan_TypeId)(0), // 77: ocsf.v1.Timespan.TypeId - (Token_TypeId)(0), // 78: ocsf.v1.Token.TypeId - (Url_CategoryIds)(0), // 79: ocsf.v1.Url.CategoryIds - (User_RiskLevelId)(0), // 80: ocsf.v1.User.RiskLevelId - (User_TypeId)(0), // 81: ocsf.v1.User.TypeId - (Vulnerability_FixCoverageId)(0), // 82: ocsf.v1.Vulnerability.FixCoverageId - (Whois_DnssecStatusId)(0), // 83: ocsf.v1.Whois.DnssecStatusId - (WinService_ServiceCategoryId)(0), // 84: ocsf.v1.WinService.ServiceCategoryId - (WinService_ServiceErrorControlId)(0), // 85: ocsf.v1.WinService.ServiceErrorControlId - (WinService_ServiceStartTypeId)(0), // 86: ocsf.v1.WinService.ServiceStartTypeId - (WinService_ServiceTypeId)(0), // 87: ocsf.v1.WinService.ServiceTypeId - (*ApiActivity)(nil), // 88: ocsf.v1.ApiActivity - (*EntityManagement)(nil), // 89: ocsf.v1.EntityManagement - (*Account)(nil), // 90: ocsf.v1.Account - (*Actor)(nil), // 91: ocsf.v1.Actor - (*Advisory)(nil), // 92: ocsf.v1.Advisory - (*AffectedCode)(nil), // 93: ocsf.v1.AffectedCode - (*AffectedPackage)(nil), // 94: ocsf.v1.AffectedPackage - (*Agent)(nil), // 95: ocsf.v1.Agent - (*AiModel)(nil), // 96: ocsf.v1.AiModel - (*Analytic)(nil), // 97: ocsf.v1.Analytic - (*Api)(nil), // 98: ocsf.v1.Api - (*Application)(nil), // 99: ocsf.v1.Application - (*Attack)(nil), // 100: ocsf.v1.Attack - (*AuthFactor)(nil), // 101: ocsf.v1.AuthFactor - (*Authorization)(nil), // 102: ocsf.v1.Authorization - (*AutonomousSystem)(nil), // 103: ocsf.v1.AutonomousSystem - (*Campaign)(nil), // 104: ocsf.v1.Campaign - (*Certificate)(nil), // 105: ocsf.v1.Certificate - (*CisControl)(nil), // 106: ocsf.v1.CisControl - (*ClassifierDetails)(nil), // 107: ocsf.v1.ClassifierDetails - (*Cloud)(nil), // 108: ocsf.v1.Cloud - (*Container)(nil), // 109: ocsf.v1.Container - (*Cve)(nil), // 110: ocsf.v1.Cve - (*Cvss)(nil), // 111: ocsf.v1.Cvss - (*Cwe)(nil), // 112: ocsf.v1.Cwe - (*D3FTactic)(nil), // 113: ocsf.v1.D3fTactic - (*D3FTechnique)(nil), // 114: ocsf.v1.D3fTechnique - (*D3Fend)(nil), // 115: ocsf.v1.D3fend - (*DataClassification)(nil), // 116: ocsf.v1.DataClassification - (*Device)(nil), // 117: ocsf.v1.Device - (*DeviceHwInfo)(nil), // 118: ocsf.v1.DeviceHwInfo - (*DigitalSignature)(nil), // 119: ocsf.v1.DigitalSignature - (*DiscoveryDetails)(nil), // 120: ocsf.v1.DiscoveryDetails - (*Display)(nil), // 121: ocsf.v1.Display - (*DnsAnswer)(nil), // 122: ocsf.v1.DnsAnswer - (*DomainContact)(nil), // 123: ocsf.v1.DomainContact - (*Edge)(nil), // 124: ocsf.v1.Edge - (*Email)(nil), // 125: ocsf.v1.Email - (*EmailAuth)(nil), // 126: ocsf.v1.EmailAuth - (*EncryptionDetails)(nil), // 127: ocsf.v1.EncryptionDetails - (*Enrichment)(nil), // 128: ocsf.v1.Enrichment - (*EnvironmentVariable)(nil), // 129: ocsf.v1.EnvironmentVariable - (*Epss)(nil), // 130: ocsf.v1.Epss - (*Extension)(nil), // 131: ocsf.v1.Extension - (*Feature)(nil), // 132: ocsf.v1.Feature - (*File)(nil), // 133: ocsf.v1.File - (*Fingerprint)(nil), // 134: ocsf.v1.Fingerprint - (*FirewallRule)(nil), // 135: ocsf.v1.FirewallRule - (*GpuInfo)(nil), // 136: ocsf.v1.GpuInfo - (*Graph)(nil), // 137: ocsf.v1.Graph - (*Group)(nil), // 138: ocsf.v1.Group - (*HttpHeader)(nil), // 139: ocsf.v1.HttpHeader - (*HttpRequest)(nil), // 140: ocsf.v1.HttpRequest - (*HttpResponse)(nil), // 141: ocsf.v1.HttpResponse - (*Idp)(nil), // 142: ocsf.v1.Idp - (*Image)(nil), // 143: ocsf.v1.Image - (*KbArticle)(nil), // 144: ocsf.v1.KbArticle - (*KeyValueObject)(nil), // 145: ocsf.v1.KeyValueObject - (*KeyboardInfo)(nil), // 146: ocsf.v1.KeyboardInfo - (*KillChainPhase)(nil), // 147: ocsf.v1.KillChainPhase - (*LdapPerson)(nil), // 148: ocsf.v1.LdapPerson - (*Location)(nil), // 149: ocsf.v1.Location - (*Logger)(nil), // 150: ocsf.v1.Logger - (*LongString)(nil), // 151: ocsf.v1.LongString - (*Malware)(nil), // 152: ocsf.v1.Malware - (*MalwareScanInfo)(nil), // 153: ocsf.v1.MalwareScanInfo - (*ManagedEntity)(nil), // 154: ocsf.v1.ManagedEntity - (*MessageContext)(nil), // 155: ocsf.v1.MessageContext - (*Metadata)(nil), // 156: ocsf.v1.Metadata - (*Metric)(nil), // 157: ocsf.v1.Metric - (*Mitigation)(nil), // 158: ocsf.v1.Mitigation - (*NetworkEndpoint)(nil), // 159: ocsf.v1.NetworkEndpoint - (*NetworkInterface)(nil), // 160: ocsf.v1.NetworkInterface - (*NetworkProxy)(nil), // 161: ocsf.v1.NetworkProxy - (*Node)(nil), // 162: ocsf.v1.Node - (*Observable)(nil), // 163: ocsf.v1.Observable - (*OccurrenceDetails)(nil), // 164: ocsf.v1.OccurrenceDetails - (*Organization)(nil), // 165: ocsf.v1.Organization - (*Os)(nil), // 166: ocsf.v1.Os - (*Osint)(nil), // 167: ocsf.v1.Osint - (*Package)(nil), // 168: ocsf.v1.Package - (*Policy)(nil), // 169: ocsf.v1.Policy - (*PortInfo)(nil), // 170: ocsf.v1.PortInfo - (*Process)(nil), // 171: ocsf.v1.Process - (*ProcessEntity)(nil), // 172: ocsf.v1.ProcessEntity - (*Product)(nil), // 173: ocsf.v1.Product - (*ProgrammaticCredential)(nil), // 174: ocsf.v1.ProgrammaticCredential - (*Remediation)(nil), // 175: ocsf.v1.Remediation - (*Reporter)(nil), // 176: ocsf.v1.Reporter - (*Reputation)(nil), // 177: ocsf.v1.Reputation - (*Request)(nil), // 178: ocsf.v1.Request - (*ResourceDetails)(nil), // 179: ocsf.v1.ResourceDetails - (*Response)(nil), // 180: ocsf.v1.Response - (*Rule)(nil), // 181: ocsf.v1.Rule - (*San)(nil), // 182: ocsf.v1.San - (*Sbom)(nil), // 183: ocsf.v1.Sbom - (*Scim)(nil), // 184: ocsf.v1.Scim - (*Script)(nil), // 185: ocsf.v1.Script - (*Service)(nil), // 186: ocsf.v1.Service - (*Session)(nil), // 187: ocsf.v1.Session - (*SoftwareComponent)(nil), // 188: ocsf.v1.SoftwareComponent - (*Span)(nil), // 189: ocsf.v1.Span - (*Sso)(nil), // 190: ocsf.v1.Sso - (*SubTechnique)(nil), // 191: ocsf.v1.SubTechnique - (*Tactic)(nil), // 192: ocsf.v1.Tactic - (*Technique)(nil), // 193: ocsf.v1.Technique - (*ThreatActor)(nil), // 194: ocsf.v1.ThreatActor - (*Timespan)(nil), // 195: ocsf.v1.Timespan - (*Token)(nil), // 196: ocsf.v1.Token - (*Trace)(nil), // 197: ocsf.v1.Trace - (*TransformationInfo)(nil), // 198: ocsf.v1.TransformationInfo - (*Url)(nil), // 199: ocsf.v1.Url - (*User)(nil), // 200: ocsf.v1.User - (*Vulnerability)(nil), // 201: ocsf.v1.Vulnerability - (*Whois)(nil), // 202: ocsf.v1.Whois - (*WinService)(nil), // 203: ocsf.v1.WinService - (*structpb.Value)(nil), // 204: google.protobuf.Value -} -var file_api_entity_proto_depIdxs = []int32{ - 0, // 0: ocsf.v1.ApiActivity.action_id:type_name -> ocsf.v1.ApiActivity.ActionId - 1, // 1: ocsf.v1.ApiActivity.activity_id:type_name -> ocsf.v1.ApiActivity.ActivityId - 91, // 2: ocsf.v1.ApiActivity.actor:type_name -> ocsf.v1.Actor - 96, // 3: ocsf.v1.ApiActivity.ai_model:type_name -> ocsf.v1.AiModel - 98, // 4: ocsf.v1.ApiActivity.api:type_name -> ocsf.v1.Api - 100, // 5: ocsf.v1.ApiActivity.attacks:type_name -> ocsf.v1.Attack - 102, // 6: ocsf.v1.ApiActivity.authorizations:type_name -> ocsf.v1.Authorization - 2, // 7: ocsf.v1.ApiActivity.category_uid:type_name -> ocsf.v1.ApiActivity.CategoryUid - 3, // 8: ocsf.v1.ApiActivity.class_uid:type_name -> ocsf.v1.ApiActivity.ClassUid - 108, // 9: ocsf.v1.ApiActivity.cloud:type_name -> ocsf.v1.Cloud - 4, // 10: ocsf.v1.ApiActivity.confidence_id:type_name -> ocsf.v1.ApiActivity.ConfidenceId - 117, // 11: ocsf.v1.ApiActivity.device:type_name -> ocsf.v1.Device - 5, // 12: ocsf.v1.ApiActivity.disposition_id:type_name -> ocsf.v1.ApiActivity.DispositionId - 159, // 13: ocsf.v1.ApiActivity.dst_endpoint:type_name -> ocsf.v1.NetworkEndpoint - 128, // 14: ocsf.v1.ApiActivity.enrichments:type_name -> ocsf.v1.Enrichment - 135, // 15: ocsf.v1.ApiActivity.firewall_rule:type_name -> ocsf.v1.FirewallRule - 140, // 16: ocsf.v1.ApiActivity.http_request:type_name -> ocsf.v1.HttpRequest - 141, // 17: ocsf.v1.ApiActivity.http_response:type_name -> ocsf.v1.HttpResponse - 152, // 18: ocsf.v1.ApiActivity.malware:type_name -> ocsf.v1.Malware - 153, // 19: ocsf.v1.ApiActivity.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo - 155, // 20: ocsf.v1.ApiActivity.message_context:type_name -> ocsf.v1.MessageContext - 156, // 21: ocsf.v1.ApiActivity.metadata:type_name -> ocsf.v1.Metadata - 163, // 22: ocsf.v1.ApiActivity.observables:type_name -> ocsf.v1.Observable - 167, // 23: ocsf.v1.ApiActivity.osint:type_name -> ocsf.v1.Osint - 169, // 24: ocsf.v1.ApiActivity.policy:type_name -> ocsf.v1.Policy - 134, // 25: ocsf.v1.ApiActivity.raw_data_hash:type_name -> ocsf.v1.Fingerprint - 179, // 26: ocsf.v1.ApiActivity.resources:type_name -> ocsf.v1.ResourceDetails - 6, // 27: ocsf.v1.ApiActivity.risk_level_id:type_name -> ocsf.v1.ApiActivity.RiskLevelId - 7, // 28: ocsf.v1.ApiActivity.severity_id:type_name -> ocsf.v1.ApiActivity.SeverityId - 159, // 29: ocsf.v1.ApiActivity.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint - 8, // 30: ocsf.v1.ApiActivity.status_id:type_name -> ocsf.v1.ApiActivity.StatusId - 197, // 31: ocsf.v1.ApiActivity.trace:type_name -> ocsf.v1.Trace - 9, // 32: ocsf.v1.ApiActivity.type_uid:type_name -> ocsf.v1.ApiActivity.TypeUid - 204, // 33: ocsf.v1.ApiActivity.unmapped:type_name -> google.protobuf.Value - 10, // 34: ocsf.v1.EntityManagement.action_id:type_name -> ocsf.v1.EntityManagement.ActionId - 11, // 35: ocsf.v1.EntityManagement.activity_id:type_name -> ocsf.v1.EntityManagement.ActivityId - 91, // 36: ocsf.v1.EntityManagement.actor:type_name -> ocsf.v1.Actor - 98, // 37: ocsf.v1.EntityManagement.api:type_name -> ocsf.v1.Api - 100, // 38: ocsf.v1.EntityManagement.attacks:type_name -> ocsf.v1.Attack - 102, // 39: ocsf.v1.EntityManagement.authorizations:type_name -> ocsf.v1.Authorization - 12, // 40: ocsf.v1.EntityManagement.category_uid:type_name -> ocsf.v1.EntityManagement.CategoryUid - 13, // 41: ocsf.v1.EntityManagement.class_uid:type_name -> ocsf.v1.EntityManagement.ClassUid - 108, // 42: ocsf.v1.EntityManagement.cloud:type_name -> ocsf.v1.Cloud - 14, // 43: ocsf.v1.EntityManagement.confidence_id:type_name -> ocsf.v1.EntityManagement.ConfidenceId - 117, // 44: ocsf.v1.EntityManagement.device:type_name -> ocsf.v1.Device - 15, // 45: ocsf.v1.EntityManagement.disposition_id:type_name -> ocsf.v1.EntityManagement.DispositionId - 128, // 46: ocsf.v1.EntityManagement.enrichments:type_name -> ocsf.v1.Enrichment - 154, // 47: ocsf.v1.EntityManagement.entity:type_name -> ocsf.v1.ManagedEntity - 154, // 48: ocsf.v1.EntityManagement.entity_result:type_name -> ocsf.v1.ManagedEntity - 135, // 49: ocsf.v1.EntityManagement.firewall_rule:type_name -> ocsf.v1.FirewallRule - 140, // 50: ocsf.v1.EntityManagement.http_request:type_name -> ocsf.v1.HttpRequest - 141, // 51: ocsf.v1.EntityManagement.http_response:type_name -> ocsf.v1.HttpResponse - 152, // 52: ocsf.v1.EntityManagement.malware:type_name -> ocsf.v1.Malware - 153, // 53: ocsf.v1.EntityManagement.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo - 156, // 54: ocsf.v1.EntityManagement.metadata:type_name -> ocsf.v1.Metadata - 163, // 55: ocsf.v1.EntityManagement.observables:type_name -> ocsf.v1.Observable - 167, // 56: ocsf.v1.EntityManagement.osint:type_name -> ocsf.v1.Osint - 169, // 57: ocsf.v1.EntityManagement.policy:type_name -> ocsf.v1.Policy - 134, // 58: ocsf.v1.EntityManagement.raw_data_hash:type_name -> ocsf.v1.Fingerprint - 16, // 59: ocsf.v1.EntityManagement.risk_level_id:type_name -> ocsf.v1.EntityManagement.RiskLevelId - 17, // 60: ocsf.v1.EntityManagement.severity_id:type_name -> ocsf.v1.EntityManagement.SeverityId - 159, // 61: ocsf.v1.EntityManagement.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint - 18, // 62: ocsf.v1.EntityManagement.status_id:type_name -> ocsf.v1.EntityManagement.StatusId - 19, // 63: ocsf.v1.EntityManagement.type_uid:type_name -> ocsf.v1.EntityManagement.TypeUid - 204, // 64: ocsf.v1.EntityManagement.unmapped:type_name -> google.protobuf.Value - 145, // 65: ocsf.v1.Account.tags:type_name -> ocsf.v1.KeyValueObject - 20, // 66: ocsf.v1.Account.type_id:type_name -> ocsf.v1.Account.TypeId - 102, // 67: ocsf.v1.Actor.authorizations:type_name -> ocsf.v1.Authorization - 142, // 68: ocsf.v1.Actor.idp:type_name -> ocsf.v1.Idp - 171, // 69: ocsf.v1.Actor.process:type_name -> ocsf.v1.Process - 187, // 70: ocsf.v1.Actor.session:type_name -> ocsf.v1.Session - 200, // 71: ocsf.v1.Actor.user:type_name -> ocsf.v1.User - 195, // 72: ocsf.v1.Advisory.avg_timespan:type_name -> ocsf.v1.Timespan - 21, // 73: ocsf.v1.Advisory.install_state_id:type_name -> ocsf.v1.Advisory.InstallStateId - 166, // 74: ocsf.v1.Advisory.os:type_name -> ocsf.v1.Os - 173, // 75: ocsf.v1.Advisory.product:type_name -> ocsf.v1.Product - 110, // 76: ocsf.v1.Advisory.related_cves:type_name -> ocsf.v1.Cve - 112, // 77: ocsf.v1.Advisory.related_cwes:type_name -> ocsf.v1.Cwe - 133, // 78: ocsf.v1.AffectedCode.file:type_name -> ocsf.v1.File - 200, // 79: ocsf.v1.AffectedCode.owner:type_name -> ocsf.v1.User - 175, // 80: ocsf.v1.AffectedCode.remediation:type_name -> ocsf.v1.Remediation - 181, // 81: ocsf.v1.AffectedCode.rule:type_name -> ocsf.v1.Rule - 134, // 82: ocsf.v1.AffectedPackage.hash:type_name -> ocsf.v1.Fingerprint - 175, // 83: ocsf.v1.AffectedPackage.remediation:type_name -> ocsf.v1.Remediation - 22, // 84: ocsf.v1.AffectedPackage.type_id:type_name -> ocsf.v1.AffectedPackage.TypeId - 169, // 85: ocsf.v1.Agent.policies:type_name -> ocsf.v1.Policy - 23, // 86: ocsf.v1.Agent.type_id:type_name -> ocsf.v1.Agent.TypeId - 97, // 87: ocsf.v1.Analytic.related_analytics:type_name -> ocsf.v1.Analytic - 24, // 88: ocsf.v1.Analytic.state_id:type_name -> ocsf.v1.Analytic.StateId - 25, // 89: ocsf.v1.Analytic.type_id:type_name -> ocsf.v1.Analytic.TypeId - 138, // 90: ocsf.v1.Api.group:type_name -> ocsf.v1.Group - 178, // 91: ocsf.v1.Api.request:type_name -> ocsf.v1.Request - 180, // 92: ocsf.v1.Api.response:type_name -> ocsf.v1.Response - 186, // 93: ocsf.v1.Api.service:type_name -> ocsf.v1.Service - 196, // 94: ocsf.v1.Api.token:type_name -> ocsf.v1.Token - 204, // 95: ocsf.v1.Application.data:type_name -> google.protobuf.Value - 138, // 96: ocsf.v1.Application.group:type_name -> ocsf.v1.Group - 200, // 97: ocsf.v1.Application.owner:type_name -> ocsf.v1.User - 137, // 98: ocsf.v1.Application.resource_relationship:type_name -> ocsf.v1.Graph - 26, // 99: ocsf.v1.Application.risk_level_id:type_name -> ocsf.v1.Application.RiskLevelId - 183, // 100: ocsf.v1.Application.sbom:type_name -> ocsf.v1.Sbom - 145, // 101: ocsf.v1.Application.tags:type_name -> ocsf.v1.KeyValueObject - 199, // 102: ocsf.v1.Application.url:type_name -> ocsf.v1.Url - 158, // 103: ocsf.v1.Attack.mitigation:type_name -> ocsf.v1.Mitigation - 191, // 104: ocsf.v1.Attack.sub_technique:type_name -> ocsf.v1.SubTechnique - 192, // 105: ocsf.v1.Attack.tactic:type_name -> ocsf.v1.Tactic - 192, // 106: ocsf.v1.Attack.tactics:type_name -> ocsf.v1.Tactic - 193, // 107: ocsf.v1.Attack.technique:type_name -> ocsf.v1.Technique - 117, // 108: ocsf.v1.AuthFactor.device:type_name -> ocsf.v1.Device - 27, // 109: ocsf.v1.AuthFactor.factor_type_id:type_name -> ocsf.v1.AuthFactor.FactorTypeId - 169, // 110: ocsf.v1.Authorization.policy:type_name -> ocsf.v1.Policy - 134, // 111: ocsf.v1.Certificate.fingerprints:type_name -> ocsf.v1.Fingerprint - 182, // 112: ocsf.v1.Certificate.sans:type_name -> ocsf.v1.San - 90, // 113: ocsf.v1.Cloud.account:type_name -> ocsf.v1.Account - 165, // 114: ocsf.v1.Cloud.org:type_name -> ocsf.v1.Organization - 134, // 115: ocsf.v1.Container.hash:type_name -> ocsf.v1.Fingerprint - 143, // 116: ocsf.v1.Container.image:type_name -> ocsf.v1.Image - 145, // 117: ocsf.v1.Container.tags:type_name -> ocsf.v1.KeyValueObject - 111, // 118: ocsf.v1.Cve.cvss:type_name -> ocsf.v1.Cvss - 112, // 119: ocsf.v1.Cve.cwe:type_name -> ocsf.v1.Cwe - 130, // 120: ocsf.v1.Cve.epss:type_name -> ocsf.v1.Epss - 173, // 121: ocsf.v1.Cve.product:type_name -> ocsf.v1.Product - 112, // 122: ocsf.v1.Cve.related_cwes:type_name -> ocsf.v1.Cwe - 157, // 123: ocsf.v1.Cvss.metrics:type_name -> ocsf.v1.Metric - 113, // 124: ocsf.v1.D3fend.d3f_tactic:type_name -> ocsf.v1.D3fTactic - 114, // 125: ocsf.v1.D3fend.d3f_technique:type_name -> ocsf.v1.D3fTechnique - 28, // 126: ocsf.v1.DataClassification.category_id:type_name -> ocsf.v1.DataClassification.CategoryId - 107, // 127: ocsf.v1.DataClassification.classifier_details:type_name -> ocsf.v1.ClassifierDetails - 29, // 128: ocsf.v1.DataClassification.confidentiality_id:type_name -> ocsf.v1.DataClassification.ConfidentialityId - 120, // 129: ocsf.v1.DataClassification.discovery_details:type_name -> ocsf.v1.DiscoveryDetails - 169, // 130: ocsf.v1.DataClassification.policy:type_name -> ocsf.v1.Policy - 30, // 131: ocsf.v1.DataClassification.status_id:type_name -> ocsf.v1.DataClassification.StatusId - 95, // 132: ocsf.v1.Device.agent_list:type_name -> ocsf.v1.Agent - 109, // 133: ocsf.v1.Device.container:type_name -> ocsf.v1.Container - 138, // 134: ocsf.v1.Device.groups:type_name -> ocsf.v1.Group - 118, // 135: ocsf.v1.Device.hw_info:type_name -> ocsf.v1.DeviceHwInfo - 143, // 136: ocsf.v1.Device.image:type_name -> ocsf.v1.Image - 149, // 137: ocsf.v1.Device.location:type_name -> ocsf.v1.Location - 160, // 138: ocsf.v1.Device.network_interfaces:type_name -> ocsf.v1.NetworkInterface - 165, // 139: ocsf.v1.Device.org:type_name -> ocsf.v1.Organization - 166, // 140: ocsf.v1.Device.os:type_name -> ocsf.v1.Os - 200, // 141: ocsf.v1.Device.owner:type_name -> ocsf.v1.User - 138, // 142: ocsf.v1.Device.pool:type_name -> ocsf.v1.Group - 31, // 143: ocsf.v1.Device.risk_level_id:type_name -> ocsf.v1.Device.RiskLevelId - 32, // 144: ocsf.v1.Device.type_id:type_name -> ocsf.v1.Device.TypeId - 33, // 145: ocsf.v1.DeviceHwInfo.cpu_architecture_id:type_name -> ocsf.v1.DeviceHwInfo.CpuArchitectureId - 121, // 146: ocsf.v1.DeviceHwInfo.desktop_display:type_name -> ocsf.v1.Display - 136, // 147: ocsf.v1.DeviceHwInfo.gpu_info_list:type_name -> ocsf.v1.GpuInfo - 146, // 148: ocsf.v1.DeviceHwInfo.keyboard_info:type_name -> ocsf.v1.KeyboardInfo - 34, // 149: ocsf.v1.DigitalSignature.algorithm_id:type_name -> ocsf.v1.DigitalSignature.AlgorithmId - 105, // 150: ocsf.v1.DigitalSignature.certificate:type_name -> ocsf.v1.Certificate - 134, // 151: ocsf.v1.DigitalSignature.digest:type_name -> ocsf.v1.Fingerprint - 35, // 152: ocsf.v1.DigitalSignature.state_id:type_name -> ocsf.v1.DigitalSignature.StateId - 164, // 153: ocsf.v1.DiscoveryDetails.occurrence_details:type_name -> ocsf.v1.OccurrenceDetails - 164, // 154: ocsf.v1.DiscoveryDetails.occurrences:type_name -> ocsf.v1.OccurrenceDetails - 36, // 155: ocsf.v1.DnsAnswer.flag_ids:type_name -> ocsf.v1.DnsAnswer.FlagIds - 149, // 156: ocsf.v1.DomainContact.location:type_name -> ocsf.v1.Location - 37, // 157: ocsf.v1.DomainContact.type_id:type_name -> ocsf.v1.DomainContact.TypeId - 204, // 158: ocsf.v1.Edge.data:type_name -> google.protobuf.Value - 116, // 159: ocsf.v1.Email.data_classification:type_name -> ocsf.v1.DataClassification - 116, // 160: ocsf.v1.Email.data_classifications:type_name -> ocsf.v1.DataClassification - 133, // 161: ocsf.v1.Email.files:type_name -> ocsf.v1.File - 139, // 162: ocsf.v1.Email.http_headers:type_name -> ocsf.v1.HttpHeader - 199, // 163: ocsf.v1.Email.urls:type_name -> ocsf.v1.Url - 38, // 164: ocsf.v1.EncryptionDetails.algorithm_id:type_name -> ocsf.v1.EncryptionDetails.AlgorithmId - 204, // 165: ocsf.v1.Enrichment.data:type_name -> google.protobuf.Value - 177, // 166: ocsf.v1.Enrichment.reputation:type_name -> ocsf.v1.Reputation - 200, // 167: ocsf.v1.File.accessor:type_name -> ocsf.v1.User - 39, // 168: ocsf.v1.File.confidentiality_id:type_name -> ocsf.v1.File.ConfidentialityId - 200, // 169: ocsf.v1.File.creator:type_name -> ocsf.v1.User - 116, // 170: ocsf.v1.File.data_classification:type_name -> ocsf.v1.DataClassification - 116, // 171: ocsf.v1.File.data_classifications:type_name -> ocsf.v1.DataClassification - 40, // 172: ocsf.v1.File.drive_type_id:type_name -> ocsf.v1.File.DriveTypeId - 127, // 173: ocsf.v1.File.encryption_details:type_name -> ocsf.v1.EncryptionDetails - 134, // 174: ocsf.v1.File.hashes:type_name -> ocsf.v1.Fingerprint - 200, // 175: ocsf.v1.File.modifier:type_name -> ocsf.v1.User - 200, // 176: ocsf.v1.File.owner:type_name -> ocsf.v1.User - 173, // 177: ocsf.v1.File.product:type_name -> ocsf.v1.Product - 119, // 178: ocsf.v1.File.signature:type_name -> ocsf.v1.DigitalSignature - 119, // 179: ocsf.v1.File.signatures:type_name -> ocsf.v1.DigitalSignature - 145, // 180: ocsf.v1.File.tags:type_name -> ocsf.v1.KeyValueObject - 41, // 181: ocsf.v1.File.type_id:type_name -> ocsf.v1.File.TypeId - 199, // 182: ocsf.v1.File.url:type_name -> ocsf.v1.Url - 204, // 183: ocsf.v1.File.xattributes:type_name -> google.protobuf.Value - 42, // 184: ocsf.v1.Fingerprint.algorithm_id:type_name -> ocsf.v1.Fingerprint.AlgorithmId - 43, // 185: ocsf.v1.GpuInfo.bus_type_id:type_name -> ocsf.v1.GpuInfo.BusTypeId - 44, // 186: ocsf.v1.GpuInfo.vram_mode_id:type_name -> ocsf.v1.GpuInfo.VramModeId - 124, // 187: ocsf.v1.Graph.edges:type_name -> ocsf.v1.Edge - 162, // 188: ocsf.v1.Graph.nodes:type_name -> ocsf.v1.Node - 45, // 189: ocsf.v1.Graph.query_language_id:type_name -> ocsf.v1.Graph.QueryLanguageId - 139, // 190: ocsf.v1.HttpRequest.http_headers:type_name -> ocsf.v1.HttpHeader - 199, // 191: ocsf.v1.HttpRequest.url:type_name -> ocsf.v1.Url - 139, // 192: ocsf.v1.HttpResponse.http_headers:type_name -> ocsf.v1.HttpHeader - 101, // 193: ocsf.v1.Idp.auth_factors:type_name -> ocsf.v1.AuthFactor - 134, // 194: ocsf.v1.Idp.fingerprint:type_name -> ocsf.v1.Fingerprint - 184, // 195: ocsf.v1.Idp.scim:type_name -> ocsf.v1.Scim - 190, // 196: ocsf.v1.Idp.sso:type_name -> ocsf.v1.Sso - 46, // 197: ocsf.v1.Idp.state_id:type_name -> ocsf.v1.Idp.StateId - 145, // 198: ocsf.v1.Image.tags:type_name -> ocsf.v1.KeyValueObject - 195, // 199: ocsf.v1.KbArticle.avg_timespan:type_name -> ocsf.v1.Timespan - 47, // 200: ocsf.v1.KbArticle.install_state_id:type_name -> ocsf.v1.KbArticle.InstallStateId - 166, // 201: ocsf.v1.KbArticle.os:type_name -> ocsf.v1.Os - 173, // 202: ocsf.v1.KbArticle.product:type_name -> ocsf.v1.Product - 48, // 203: ocsf.v1.KillChainPhase.phase_id:type_name -> ocsf.v1.KillChainPhase.PhaseId - 149, // 204: ocsf.v1.LdapPerson.location:type_name -> ocsf.v1.Location - 200, // 205: ocsf.v1.LdapPerson.manager:type_name -> ocsf.v1.User - 145, // 206: ocsf.v1.LdapPerson.tags:type_name -> ocsf.v1.KeyValueObject - 117, // 207: ocsf.v1.Logger.device:type_name -> ocsf.v1.Device - 173, // 208: ocsf.v1.Logger.product:type_name -> ocsf.v1.Product - 49, // 209: ocsf.v1.Malware.classification_ids:type_name -> ocsf.v1.Malware.ClassificationIds - 110, // 210: ocsf.v1.Malware.cves:type_name -> ocsf.v1.Cve - 133, // 211: ocsf.v1.Malware.files:type_name -> ocsf.v1.File - 50, // 212: ocsf.v1.Malware.severity_id:type_name -> ocsf.v1.Malware.SeverityId - 51, // 213: ocsf.v1.MalwareScanInfo.type_id:type_name -> ocsf.v1.MalwareScanInfo.TypeId - 204, // 214: ocsf.v1.ManagedEntity.data:type_name -> google.protobuf.Value - 117, // 215: ocsf.v1.ManagedEntity.device:type_name -> ocsf.v1.Device - 125, // 216: ocsf.v1.ManagedEntity.email:type_name -> ocsf.v1.Email - 138, // 217: ocsf.v1.ManagedEntity.group:type_name -> ocsf.v1.Group - 149, // 218: ocsf.v1.ManagedEntity.location:type_name -> ocsf.v1.Location - 165, // 219: ocsf.v1.ManagedEntity.org:type_name -> ocsf.v1.Organization - 169, // 220: ocsf.v1.ManagedEntity.policy:type_name -> ocsf.v1.Policy - 52, // 221: ocsf.v1.ManagedEntity.type_id:type_name -> ocsf.v1.ManagedEntity.TypeId - 200, // 222: ocsf.v1.ManagedEntity.user:type_name -> ocsf.v1.User - 53, // 223: ocsf.v1.MessageContext.ai_role_id:type_name -> ocsf.v1.MessageContext.AiRoleId - 99, // 224: ocsf.v1.MessageContext.application:type_name -> ocsf.v1.Application - 186, // 225: ocsf.v1.MessageContext.service:type_name -> ocsf.v1.Service - 116, // 226: ocsf.v1.Metadata.data_classification:type_name -> ocsf.v1.DataClassification - 116, // 227: ocsf.v1.Metadata.data_classifications:type_name -> ocsf.v1.DataClassification - 131, // 228: ocsf.v1.Metadata.extension:type_name -> ocsf.v1.Extension - 131, // 229: ocsf.v1.Metadata.extensions:type_name -> ocsf.v1.Extension - 150, // 230: ocsf.v1.Metadata.loggers:type_name -> ocsf.v1.Logger - 173, // 231: ocsf.v1.Metadata.product:type_name -> ocsf.v1.Product - 176, // 232: ocsf.v1.Metadata.reporter:type_name -> ocsf.v1.Reporter - 145, // 233: ocsf.v1.Metadata.tags:type_name -> ocsf.v1.KeyValueObject - 195, // 234: ocsf.v1.Metadata.total_queued_duration:type_name -> ocsf.v1.Timespan - 198, // 235: ocsf.v1.Metadata.transformation_info_list:type_name -> ocsf.v1.TransformationInfo - 115, // 236: ocsf.v1.Mitigation.countermeasures:type_name -> ocsf.v1.D3fend - 95, // 237: ocsf.v1.NetworkEndpoint.agent_list:type_name -> ocsf.v1.Agent - 103, // 238: ocsf.v1.NetworkEndpoint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem - 109, // 239: ocsf.v1.NetworkEndpoint.container:type_name -> ocsf.v1.Container - 134, // 240: ocsf.v1.NetworkEndpoint.fingerprints:type_name -> ocsf.v1.Fingerprint - 118, // 241: ocsf.v1.NetworkEndpoint.hw_info:type_name -> ocsf.v1.DeviceHwInfo - 149, // 242: ocsf.v1.NetworkEndpoint.location:type_name -> ocsf.v1.Location - 54, // 243: ocsf.v1.NetworkEndpoint.network_scope_id:type_name -> ocsf.v1.NetworkEndpoint.NetworkScopeId - 166, // 244: ocsf.v1.NetworkEndpoint.os:type_name -> ocsf.v1.Os - 200, // 245: ocsf.v1.NetworkEndpoint.owner:type_name -> ocsf.v1.User - 138, // 246: ocsf.v1.NetworkEndpoint.pool:type_name -> ocsf.v1.Group - 161, // 247: ocsf.v1.NetworkEndpoint.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy - 55, // 248: ocsf.v1.NetworkEndpoint.type_id:type_name -> ocsf.v1.NetworkEndpoint.TypeId - 170, // 249: ocsf.v1.NetworkInterface.open_ports:type_name -> ocsf.v1.PortInfo - 56, // 250: ocsf.v1.NetworkInterface.type_id:type_name -> ocsf.v1.NetworkInterface.TypeId - 95, // 251: ocsf.v1.NetworkProxy.agent_list:type_name -> ocsf.v1.Agent - 103, // 252: ocsf.v1.NetworkProxy.autonomous_system:type_name -> ocsf.v1.AutonomousSystem - 109, // 253: ocsf.v1.NetworkProxy.container:type_name -> ocsf.v1.Container - 134, // 254: ocsf.v1.NetworkProxy.fingerprints:type_name -> ocsf.v1.Fingerprint - 118, // 255: ocsf.v1.NetworkProxy.hw_info:type_name -> ocsf.v1.DeviceHwInfo - 149, // 256: ocsf.v1.NetworkProxy.location:type_name -> ocsf.v1.Location - 57, // 257: ocsf.v1.NetworkProxy.network_scope_id:type_name -> ocsf.v1.NetworkProxy.NetworkScopeId - 166, // 258: ocsf.v1.NetworkProxy.os:type_name -> ocsf.v1.Os - 200, // 259: ocsf.v1.NetworkProxy.owner:type_name -> ocsf.v1.User - 138, // 260: ocsf.v1.NetworkProxy.pool:type_name -> ocsf.v1.Group - 161, // 261: ocsf.v1.NetworkProxy.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy - 58, // 262: ocsf.v1.NetworkProxy.type_id:type_name -> ocsf.v1.NetworkProxy.TypeId - 204, // 263: ocsf.v1.Node.data:type_name -> google.protobuf.Value - 177, // 264: ocsf.v1.Observable.reputation:type_name -> ocsf.v1.Reputation - 59, // 265: ocsf.v1.Observable.type_id:type_name -> ocsf.v1.Observable.TypeId - 60, // 266: ocsf.v1.Os.type_id:type_name -> ocsf.v1.Os.TypeId - 122, // 267: ocsf.v1.Osint.answers:type_name -> ocsf.v1.DnsAnswer - 100, // 268: ocsf.v1.Osint.attacks:type_name -> ocsf.v1.Attack - 103, // 269: ocsf.v1.Osint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem - 104, // 270: ocsf.v1.Osint.campaign:type_name -> ocsf.v1.Campaign - 61, // 271: ocsf.v1.Osint.confidence_id:type_name -> ocsf.v1.Osint.ConfidenceId - 200, // 272: ocsf.v1.Osint.creator:type_name -> ocsf.v1.User - 62, // 273: ocsf.v1.Osint.detection_pattern_type_id:type_name -> ocsf.v1.Osint.DetectionPatternTypeId - 125, // 274: ocsf.v1.Osint.email:type_name -> ocsf.v1.Email - 126, // 275: ocsf.v1.Osint.email_auth:type_name -> ocsf.v1.EmailAuth - 133, // 276: ocsf.v1.Osint.file:type_name -> ocsf.v1.File - 147, // 277: ocsf.v1.Osint.kill_chain:type_name -> ocsf.v1.KillChainPhase - 149, // 278: ocsf.v1.Osint.location:type_name -> ocsf.v1.Location - 152, // 279: ocsf.v1.Osint.malware:type_name -> ocsf.v1.Malware - 97, // 280: ocsf.v1.Osint.related_analytics:type_name -> ocsf.v1.Analytic - 177, // 281: ocsf.v1.Osint.reputation:type_name -> ocsf.v1.Reputation - 185, // 282: ocsf.v1.Osint.script:type_name -> ocsf.v1.Script - 63, // 283: ocsf.v1.Osint.severity_id:type_name -> ocsf.v1.Osint.SeverityId - 119, // 284: ocsf.v1.Osint.signatures:type_name -> ocsf.v1.DigitalSignature - 194, // 285: ocsf.v1.Osint.threat_actor:type_name -> ocsf.v1.ThreatActor - 64, // 286: ocsf.v1.Osint.type_id:type_name -> ocsf.v1.Osint.TypeId - 201, // 287: ocsf.v1.Osint.vulnerabilities:type_name -> ocsf.v1.Vulnerability - 202, // 288: ocsf.v1.Osint.whois:type_name -> ocsf.v1.Whois - 134, // 289: ocsf.v1.Package.hash:type_name -> ocsf.v1.Fingerprint - 65, // 290: ocsf.v1.Package.type_id:type_name -> ocsf.v1.Package.TypeId - 204, // 291: ocsf.v1.Policy.data:type_name -> google.protobuf.Value - 138, // 292: ocsf.v1.Policy.group:type_name -> ocsf.v1.Group - 172, // 293: ocsf.v1.Process.ancestry:type_name -> ocsf.v1.ProcessEntity - 109, // 294: ocsf.v1.Process.container:type_name -> ocsf.v1.Container - 129, // 295: ocsf.v1.Process.environment_variables:type_name -> ocsf.v1.EnvironmentVariable - 133, // 296: ocsf.v1.Process.file:type_name -> ocsf.v1.File - 138, // 297: ocsf.v1.Process.group:type_name -> ocsf.v1.Group - 203, // 298: ocsf.v1.Process.hosted_services:type_name -> ocsf.v1.WinService - 66, // 299: ocsf.v1.Process.integrity_id:type_name -> ocsf.v1.Process.IntegrityId - 171, // 300: ocsf.v1.Process.parent_process:type_name -> ocsf.v1.Process - 187, // 301: ocsf.v1.Process.session:type_name -> ocsf.v1.Session - 200, // 302: ocsf.v1.Process.user:type_name -> ocsf.v1.User - 204, // 303: ocsf.v1.Process.xattributes:type_name -> google.protobuf.Value - 116, // 304: ocsf.v1.Product.data_classification:type_name -> ocsf.v1.DataClassification - 116, // 305: ocsf.v1.Product.data_classifications:type_name -> ocsf.v1.DataClassification - 132, // 306: ocsf.v1.Product.feature:type_name -> ocsf.v1.Feature - 106, // 307: ocsf.v1.Remediation.cis_controls:type_name -> ocsf.v1.CisControl - 144, // 308: ocsf.v1.Remediation.kb_article_list:type_name -> ocsf.v1.KbArticle - 165, // 309: ocsf.v1.Reporter.org:type_name -> ocsf.v1.Organization - 67, // 310: ocsf.v1.Reputation.score_id:type_name -> ocsf.v1.Reputation.ScoreId - 109, // 311: ocsf.v1.Request.containers:type_name -> ocsf.v1.Container - 204, // 312: ocsf.v1.Request.data:type_name -> google.protobuf.Value - 95, // 313: ocsf.v1.ResourceDetails.agent_list:type_name -> ocsf.v1.Agent - 204, // 314: ocsf.v1.ResourceDetails.data:type_name -> google.protobuf.Value - 116, // 315: ocsf.v1.ResourceDetails.data_classification:type_name -> ocsf.v1.DataClassification - 116, // 316: ocsf.v1.ResourceDetails.data_classifications:type_name -> ocsf.v1.DataClassification - 138, // 317: ocsf.v1.ResourceDetails.group:type_name -> ocsf.v1.Group - 200, // 318: ocsf.v1.ResourceDetails.owner:type_name -> ocsf.v1.User - 137, // 319: ocsf.v1.ResourceDetails.resource_relationship:type_name -> ocsf.v1.Graph - 68, // 320: ocsf.v1.ResourceDetails.role_id:type_name -> ocsf.v1.ResourceDetails.RoleId - 145, // 321: ocsf.v1.ResourceDetails.tags:type_name -> ocsf.v1.KeyValueObject - 109, // 322: ocsf.v1.Response.containers:type_name -> ocsf.v1.Container - 204, // 323: ocsf.v1.Response.data:type_name -> google.protobuf.Value - 168, // 324: ocsf.v1.Sbom.package:type_name -> ocsf.v1.Package - 173, // 325: ocsf.v1.Sbom.product:type_name -> ocsf.v1.Product - 188, // 326: ocsf.v1.Sbom.software_components:type_name -> ocsf.v1.SoftwareComponent - 69, // 327: ocsf.v1.Sbom.type_id:type_name -> ocsf.v1.Sbom.TypeId - 70, // 328: ocsf.v1.Scim.auth_protocol_id:type_name -> ocsf.v1.Scim.AuthProtocolId - 204, // 329: ocsf.v1.Scim.scim_group_schema:type_name -> google.protobuf.Value - 204, // 330: ocsf.v1.Scim.scim_user_schema:type_name -> google.protobuf.Value - 71, // 331: ocsf.v1.Scim.state_id:type_name -> ocsf.v1.Scim.StateId - 133, // 332: ocsf.v1.Script.file:type_name -> ocsf.v1.File - 134, // 333: ocsf.v1.Script.hashes:type_name -> ocsf.v1.Fingerprint - 151, // 334: ocsf.v1.Script.script_content:type_name -> ocsf.v1.LongString - 72, // 335: ocsf.v1.Script.type_id:type_name -> ocsf.v1.Script.TypeId - 145, // 336: ocsf.v1.Service.tags:type_name -> ocsf.v1.KeyValueObject - 134, // 337: ocsf.v1.SoftwareComponent.hash:type_name -> ocsf.v1.Fingerprint - 73, // 338: ocsf.v1.SoftwareComponent.relationship_id:type_name -> ocsf.v1.SoftwareComponent.RelationshipId - 74, // 339: ocsf.v1.SoftwareComponent.type_id:type_name -> ocsf.v1.SoftwareComponent.TypeId - 186, // 340: ocsf.v1.Span.service:type_name -> ocsf.v1.Service - 75, // 341: ocsf.v1.Sso.auth_protocol_id:type_name -> ocsf.v1.Sso.AuthProtocolId - 105, // 342: ocsf.v1.Sso.certificate:type_name -> ocsf.v1.Certificate - 76, // 343: ocsf.v1.ThreatActor.type_id:type_name -> ocsf.v1.ThreatActor.TypeId - 77, // 344: ocsf.v1.Timespan.type_id:type_name -> ocsf.v1.Timespan.TypeId - 78, // 345: ocsf.v1.Token.type_id:type_name -> ocsf.v1.Token.TypeId - 186, // 346: ocsf.v1.Trace.service:type_name -> ocsf.v1.Service - 189, // 347: ocsf.v1.Trace.span:type_name -> ocsf.v1.Span - 173, // 348: ocsf.v1.TransformationInfo.product:type_name -> ocsf.v1.Product - 79, // 349: ocsf.v1.Url.category_ids:type_name -> ocsf.v1.Url.CategoryIds - 90, // 350: ocsf.v1.User.account:type_name -> ocsf.v1.Account - 138, // 351: ocsf.v1.User.groups:type_name -> ocsf.v1.Group - 148, // 352: ocsf.v1.User.ldap_person:type_name -> ocsf.v1.LdapPerson - 165, // 353: ocsf.v1.User.org:type_name -> ocsf.v1.Organization - 174, // 354: ocsf.v1.User.programmatic_credentials:type_name -> ocsf.v1.ProgrammaticCredential - 80, // 355: ocsf.v1.User.risk_level_id:type_name -> ocsf.v1.User.RiskLevelId - 81, // 356: ocsf.v1.User.type_id:type_name -> ocsf.v1.User.TypeId - 92, // 357: ocsf.v1.Vulnerability.advisory:type_name -> ocsf.v1.Advisory - 93, // 358: ocsf.v1.Vulnerability.affected_code:type_name -> ocsf.v1.AffectedCode - 94, // 359: ocsf.v1.Vulnerability.affected_packages:type_name -> ocsf.v1.AffectedPackage - 110, // 360: ocsf.v1.Vulnerability.cve:type_name -> ocsf.v1.Cve - 112, // 361: ocsf.v1.Vulnerability.cwe:type_name -> ocsf.v1.Cwe - 82, // 362: ocsf.v1.Vulnerability.fix_coverage_id:type_name -> ocsf.v1.Vulnerability.FixCoverageId - 144, // 363: ocsf.v1.Vulnerability.kb_article_list:type_name -> ocsf.v1.KbArticle - 168, // 364: ocsf.v1.Vulnerability.packages:type_name -> ocsf.v1.Package - 175, // 365: ocsf.v1.Vulnerability.remediation:type_name -> ocsf.v1.Remediation - 103, // 366: ocsf.v1.Whois.autonomous_system:type_name -> ocsf.v1.AutonomousSystem - 83, // 367: ocsf.v1.Whois.dnssec_status_id:type_name -> ocsf.v1.Whois.DnssecStatusId - 123, // 368: ocsf.v1.Whois.domain_contacts:type_name -> ocsf.v1.DomainContact - 172, // 369: ocsf.v1.WinService.hosting_process:type_name -> ocsf.v1.ProcessEntity - 84, // 370: ocsf.v1.WinService.service_category_id:type_name -> ocsf.v1.WinService.ServiceCategoryId - 133, // 371: ocsf.v1.WinService.service_dll_file:type_name -> ocsf.v1.File - 85, // 372: ocsf.v1.WinService.service_error_control_id:type_name -> ocsf.v1.WinService.ServiceErrorControlId - 133, // 373: ocsf.v1.WinService.service_file:type_name -> ocsf.v1.File - 86, // 374: ocsf.v1.WinService.service_start_type_id:type_name -> ocsf.v1.WinService.ServiceStartTypeId - 87, // 375: ocsf.v1.WinService.service_type_id:type_name -> ocsf.v1.WinService.ServiceTypeId - 145, // 376: ocsf.v1.WinService.tags:type_name -> ocsf.v1.KeyValueObject - 377, // [377:377] is the sub-list for method output_type - 377, // [377:377] is the sub-list for method input_type - 377, // [377:377] is the sub-list for extension type_name - 377, // [377:377] is the sub-list for extension extendee - 0, // [0:377] is the sub-list for field type_name -} - -func init() { file_api_entity_proto_init() } -func file_api_entity_proto_init() { - if File_api_entity_proto != nil { + return file_ocsf_v1_objects_proto_rawDescData +} + +var file_ocsf_v1_objects_proto_enumTypes = make([]protoimpl.EnumInfo, 68) +var file_ocsf_v1_objects_proto_msgTypes = make([]protoimpl.MessageInfo, 114) +var file_ocsf_v1_objects_proto_goTypes = []any{ + (Account_TypeId)(0), // 0: ocsf.v1.Account.TypeId + (Advisory_InstallStateId)(0), // 1: ocsf.v1.Advisory.InstallStateId + (AffectedPackage_TypeId)(0), // 2: ocsf.v1.AffectedPackage.TypeId + (Agent_TypeId)(0), // 3: ocsf.v1.Agent.TypeId + (Analytic_StateId)(0), // 4: ocsf.v1.Analytic.StateId + (Analytic_TypeId)(0), // 5: ocsf.v1.Analytic.TypeId + (Application_RiskLevelId)(0), // 6: ocsf.v1.Application.RiskLevelId + (AuthFactor_FactorTypeId)(0), // 7: ocsf.v1.AuthFactor.FactorTypeId + (DataClassification_CategoryId)(0), // 8: ocsf.v1.DataClassification.CategoryId + (DataClassification_ConfidentialityId)(0), // 9: ocsf.v1.DataClassification.ConfidentialityId + (DataClassification_StatusId)(0), // 10: ocsf.v1.DataClassification.StatusId + (Device_RiskLevelId)(0), // 11: ocsf.v1.Device.RiskLevelId + (Device_TypeId)(0), // 12: ocsf.v1.Device.TypeId + (DeviceHwInfo_CpuArchitectureId)(0), // 13: ocsf.v1.DeviceHwInfo.CpuArchitectureId + (DigitalSignature_AlgorithmId)(0), // 14: ocsf.v1.DigitalSignature.AlgorithmId + (DigitalSignature_StateId)(0), // 15: ocsf.v1.DigitalSignature.StateId + (DnsAnswer_FlagIds)(0), // 16: ocsf.v1.DnsAnswer.FlagIds + (DomainContact_TypeId)(0), // 17: ocsf.v1.DomainContact.TypeId + (EncryptionDetails_AlgorithmId)(0), // 18: ocsf.v1.EncryptionDetails.AlgorithmId + (File_ConfidentialityId)(0), // 19: ocsf.v1.File.ConfidentialityId + (File_DriveTypeId)(0), // 20: ocsf.v1.File.DriveTypeId + (File_TypeId)(0), // 21: ocsf.v1.File.TypeId + (Fingerprint_AlgorithmId)(0), // 22: ocsf.v1.Fingerprint.AlgorithmId + (GpuInfo_BusTypeId)(0), // 23: ocsf.v1.GpuInfo.BusTypeId + (GpuInfo_VramModeId)(0), // 24: ocsf.v1.GpuInfo.VramModeId + (Graph_QueryLanguageId)(0), // 25: ocsf.v1.Graph.QueryLanguageId + (Idp_StateId)(0), // 26: ocsf.v1.Idp.StateId + (KbArticle_InstallStateId)(0), // 27: ocsf.v1.KbArticle.InstallStateId + (KillChainPhase_PhaseId)(0), // 28: ocsf.v1.KillChainPhase.PhaseId + (Malware_ClassificationIds)(0), // 29: ocsf.v1.Malware.ClassificationIds + (Malware_SeverityId)(0), // 30: ocsf.v1.Malware.SeverityId + (MalwareScanInfo_TypeId)(0), // 31: ocsf.v1.MalwareScanInfo.TypeId + (ManagedEntity_TypeId)(0), // 32: ocsf.v1.ManagedEntity.TypeId + (MessageContext_AiRoleId)(0), // 33: ocsf.v1.MessageContext.AiRoleId + (NetworkEndpoint_NetworkScopeId)(0), // 34: ocsf.v1.NetworkEndpoint.NetworkScopeId + (NetworkEndpoint_TypeId)(0), // 35: ocsf.v1.NetworkEndpoint.TypeId + (NetworkInterface_TypeId)(0), // 36: ocsf.v1.NetworkInterface.TypeId + (NetworkProxy_NetworkScopeId)(0), // 37: ocsf.v1.NetworkProxy.NetworkScopeId + (NetworkProxy_TypeId)(0), // 38: ocsf.v1.NetworkProxy.TypeId + (Observable_TypeId)(0), // 39: ocsf.v1.Observable.TypeId + (Os_TypeId)(0), // 40: ocsf.v1.Os.TypeId + (Osint_ConfidenceId)(0), // 41: ocsf.v1.Osint.ConfidenceId + (Osint_DetectionPatternTypeId)(0), // 42: ocsf.v1.Osint.DetectionPatternTypeId + (Osint_SeverityId)(0), // 43: ocsf.v1.Osint.SeverityId + (Osint_TypeId)(0), // 44: ocsf.v1.Osint.TypeId + (Package_TypeId)(0), // 45: ocsf.v1.Package.TypeId + (Process_IntegrityId)(0), // 46: ocsf.v1.Process.IntegrityId + (Reputation_ScoreId)(0), // 47: ocsf.v1.Reputation.ScoreId + (ResourceDetails_RoleId)(0), // 48: ocsf.v1.ResourceDetails.RoleId + (Sbom_TypeId)(0), // 49: ocsf.v1.Sbom.TypeId + (Scim_AuthProtocolId)(0), // 50: ocsf.v1.Scim.AuthProtocolId + (Scim_StateId)(0), // 51: ocsf.v1.Scim.StateId + (Script_TypeId)(0), // 52: ocsf.v1.Script.TypeId + (SoftwareComponent_RelationshipId)(0), // 53: ocsf.v1.SoftwareComponent.RelationshipId + (SoftwareComponent_TypeId)(0), // 54: ocsf.v1.SoftwareComponent.TypeId + (Sso_AuthProtocolId)(0), // 55: ocsf.v1.Sso.AuthProtocolId + (ThreatActor_TypeId)(0), // 56: ocsf.v1.ThreatActor.TypeId + (Timespan_TypeId)(0), // 57: ocsf.v1.Timespan.TypeId + (Token_TypeId)(0), // 58: ocsf.v1.Token.TypeId + (Url_CategoryIds)(0), // 59: ocsf.v1.Url.CategoryIds + (User_RiskLevelId)(0), // 60: ocsf.v1.User.RiskLevelId + (User_TypeId)(0), // 61: ocsf.v1.User.TypeId + (Vulnerability_FixCoverageId)(0), // 62: ocsf.v1.Vulnerability.FixCoverageId + (Whois_DnssecStatusId)(0), // 63: ocsf.v1.Whois.DnssecStatusId + (WinService_ServiceCategoryId)(0), // 64: ocsf.v1.WinService.ServiceCategoryId + (WinService_ServiceErrorControlId)(0), // 65: ocsf.v1.WinService.ServiceErrorControlId + (WinService_ServiceStartTypeId)(0), // 66: ocsf.v1.WinService.ServiceStartTypeId + (WinService_ServiceTypeId)(0), // 67: ocsf.v1.WinService.ServiceTypeId + (*Account)(nil), // 68: ocsf.v1.Account + (*Actor)(nil), // 69: ocsf.v1.Actor + (*Advisory)(nil), // 70: ocsf.v1.Advisory + (*AffectedCode)(nil), // 71: ocsf.v1.AffectedCode + (*AffectedPackage)(nil), // 72: ocsf.v1.AffectedPackage + (*Agent)(nil), // 73: ocsf.v1.Agent + (*AiModel)(nil), // 74: ocsf.v1.AiModel + (*Analytic)(nil), // 75: ocsf.v1.Analytic + (*Api)(nil), // 76: ocsf.v1.Api + (*Application)(nil), // 77: ocsf.v1.Application + (*Attack)(nil), // 78: ocsf.v1.Attack + (*AuthFactor)(nil), // 79: ocsf.v1.AuthFactor + (*Authorization)(nil), // 80: ocsf.v1.Authorization + (*AutonomousSystem)(nil), // 81: ocsf.v1.AutonomousSystem + (*Campaign)(nil), // 82: ocsf.v1.Campaign + (*Certificate)(nil), // 83: ocsf.v1.Certificate + (*CisControl)(nil), // 84: ocsf.v1.CisControl + (*ClassifierDetails)(nil), // 85: ocsf.v1.ClassifierDetails + (*Cloud)(nil), // 86: ocsf.v1.Cloud + (*Container)(nil), // 87: ocsf.v1.Container + (*Cve)(nil), // 88: ocsf.v1.Cve + (*Cvss)(nil), // 89: ocsf.v1.Cvss + (*Cwe)(nil), // 90: ocsf.v1.Cwe + (*D3FTactic)(nil), // 91: ocsf.v1.D3fTactic + (*D3FTechnique)(nil), // 92: ocsf.v1.D3fTechnique + (*D3Fend)(nil), // 93: ocsf.v1.D3fend + (*DataClassification)(nil), // 94: ocsf.v1.DataClassification + (*Device)(nil), // 95: ocsf.v1.Device + (*DeviceHwInfo)(nil), // 96: ocsf.v1.DeviceHwInfo + (*DigitalSignature)(nil), // 97: ocsf.v1.DigitalSignature + (*DiscoveryDetails)(nil), // 98: ocsf.v1.DiscoveryDetails + (*Display)(nil), // 99: ocsf.v1.Display + (*DnsAnswer)(nil), // 100: ocsf.v1.DnsAnswer + (*DomainContact)(nil), // 101: ocsf.v1.DomainContact + (*Edge)(nil), // 102: ocsf.v1.Edge + (*Email)(nil), // 103: ocsf.v1.Email + (*EmailAuth)(nil), // 104: ocsf.v1.EmailAuth + (*EncryptionDetails)(nil), // 105: ocsf.v1.EncryptionDetails + (*Enrichment)(nil), // 106: ocsf.v1.Enrichment + (*EnvironmentVariable)(nil), // 107: ocsf.v1.EnvironmentVariable + (*Epss)(nil), // 108: ocsf.v1.Epss + (*Extension)(nil), // 109: ocsf.v1.Extension + (*Feature)(nil), // 110: ocsf.v1.Feature + (*File)(nil), // 111: ocsf.v1.File + (*Fingerprint)(nil), // 112: ocsf.v1.Fingerprint + (*FirewallRule)(nil), // 113: ocsf.v1.FirewallRule + (*GpuInfo)(nil), // 114: ocsf.v1.GpuInfo + (*Graph)(nil), // 115: ocsf.v1.Graph + (*Group)(nil), // 116: ocsf.v1.Group + (*HttpHeader)(nil), // 117: ocsf.v1.HttpHeader + (*HttpRequest)(nil), // 118: ocsf.v1.HttpRequest + (*HttpResponse)(nil), // 119: ocsf.v1.HttpResponse + (*Idp)(nil), // 120: ocsf.v1.Idp + (*Image)(nil), // 121: ocsf.v1.Image + (*KbArticle)(nil), // 122: ocsf.v1.KbArticle + (*KeyValueObject)(nil), // 123: ocsf.v1.KeyValueObject + (*KeyboardInfo)(nil), // 124: ocsf.v1.KeyboardInfo + (*KillChainPhase)(nil), // 125: ocsf.v1.KillChainPhase + (*LdapPerson)(nil), // 126: ocsf.v1.LdapPerson + (*Location)(nil), // 127: ocsf.v1.Location + (*Logger)(nil), // 128: ocsf.v1.Logger + (*LongString)(nil), // 129: ocsf.v1.LongString + (*Malware)(nil), // 130: ocsf.v1.Malware + (*MalwareScanInfo)(nil), // 131: ocsf.v1.MalwareScanInfo + (*ManagedEntity)(nil), // 132: ocsf.v1.ManagedEntity + (*MessageContext)(nil), // 133: ocsf.v1.MessageContext + (*Metadata)(nil), // 134: ocsf.v1.Metadata + (*Metric)(nil), // 135: ocsf.v1.Metric + (*Mitigation)(nil), // 136: ocsf.v1.Mitigation + (*NetworkEndpoint)(nil), // 137: ocsf.v1.NetworkEndpoint + (*NetworkInterface)(nil), // 138: ocsf.v1.NetworkInterface + (*NetworkProxy)(nil), // 139: ocsf.v1.NetworkProxy + (*Node)(nil), // 140: ocsf.v1.Node + (*Observable)(nil), // 141: ocsf.v1.Observable + (*OccurrenceDetails)(nil), // 142: ocsf.v1.OccurrenceDetails + (*Organization)(nil), // 143: ocsf.v1.Organization + (*Os)(nil), // 144: ocsf.v1.Os + (*Osint)(nil), // 145: ocsf.v1.Osint + (*Package)(nil), // 146: ocsf.v1.Package + (*Policy)(nil), // 147: ocsf.v1.Policy + (*PortInfo)(nil), // 148: ocsf.v1.PortInfo + (*Process)(nil), // 149: ocsf.v1.Process + (*ProcessEntity)(nil), // 150: ocsf.v1.ProcessEntity + (*Product)(nil), // 151: ocsf.v1.Product + (*ProgrammaticCredential)(nil), // 152: ocsf.v1.ProgrammaticCredential + (*Remediation)(nil), // 153: ocsf.v1.Remediation + (*Reporter)(nil), // 154: ocsf.v1.Reporter + (*Reputation)(nil), // 155: ocsf.v1.Reputation + (*Request)(nil), // 156: ocsf.v1.Request + (*ResourceDetails)(nil), // 157: ocsf.v1.ResourceDetails + (*Response)(nil), // 158: ocsf.v1.Response + (*Rule)(nil), // 159: ocsf.v1.Rule + (*San)(nil), // 160: ocsf.v1.San + (*Sbom)(nil), // 161: ocsf.v1.Sbom + (*Scim)(nil), // 162: ocsf.v1.Scim + (*Script)(nil), // 163: ocsf.v1.Script + (*Service)(nil), // 164: ocsf.v1.Service + (*Session)(nil), // 165: ocsf.v1.Session + (*SoftwareComponent)(nil), // 166: ocsf.v1.SoftwareComponent + (*Span)(nil), // 167: ocsf.v1.Span + (*Sso)(nil), // 168: ocsf.v1.Sso + (*SubTechnique)(nil), // 169: ocsf.v1.SubTechnique + (*Tactic)(nil), // 170: ocsf.v1.Tactic + (*Technique)(nil), // 171: ocsf.v1.Technique + (*ThreatActor)(nil), // 172: ocsf.v1.ThreatActor + (*Timespan)(nil), // 173: ocsf.v1.Timespan + (*Token)(nil), // 174: ocsf.v1.Token + (*Trace)(nil), // 175: ocsf.v1.Trace + (*TransformationInfo)(nil), // 176: ocsf.v1.TransformationInfo + (*Url)(nil), // 177: ocsf.v1.Url + (*User)(nil), // 178: ocsf.v1.User + (*Vulnerability)(nil), // 179: ocsf.v1.Vulnerability + (*Whois)(nil), // 180: ocsf.v1.Whois + (*WinService)(nil), // 181: ocsf.v1.WinService + (*structpb.Value)(nil), // 182: google.protobuf.Value +} +var file_ocsf_v1_objects_proto_depIdxs = []int32{ + 123, // 0: ocsf.v1.Account.tags:type_name -> ocsf.v1.KeyValueObject + 0, // 1: ocsf.v1.Account.type_id:type_name -> ocsf.v1.Account.TypeId + 80, // 2: ocsf.v1.Actor.authorizations:type_name -> ocsf.v1.Authorization + 120, // 3: ocsf.v1.Actor.idp:type_name -> ocsf.v1.Idp + 149, // 4: ocsf.v1.Actor.process:type_name -> ocsf.v1.Process + 165, // 5: ocsf.v1.Actor.session:type_name -> ocsf.v1.Session + 178, // 6: ocsf.v1.Actor.user:type_name -> ocsf.v1.User + 173, // 7: ocsf.v1.Advisory.avg_timespan:type_name -> ocsf.v1.Timespan + 1, // 8: ocsf.v1.Advisory.install_state_id:type_name -> ocsf.v1.Advisory.InstallStateId + 144, // 9: ocsf.v1.Advisory.os:type_name -> ocsf.v1.Os + 151, // 10: ocsf.v1.Advisory.product:type_name -> ocsf.v1.Product + 88, // 11: ocsf.v1.Advisory.related_cves:type_name -> ocsf.v1.Cve + 90, // 12: ocsf.v1.Advisory.related_cwes:type_name -> ocsf.v1.Cwe + 111, // 13: ocsf.v1.AffectedCode.file:type_name -> ocsf.v1.File + 178, // 14: ocsf.v1.AffectedCode.owner:type_name -> ocsf.v1.User + 153, // 15: ocsf.v1.AffectedCode.remediation:type_name -> ocsf.v1.Remediation + 159, // 16: ocsf.v1.AffectedCode.rule:type_name -> ocsf.v1.Rule + 112, // 17: ocsf.v1.AffectedPackage.hash:type_name -> ocsf.v1.Fingerprint + 153, // 18: ocsf.v1.AffectedPackage.remediation:type_name -> ocsf.v1.Remediation + 2, // 19: ocsf.v1.AffectedPackage.type_id:type_name -> ocsf.v1.AffectedPackage.TypeId + 147, // 20: ocsf.v1.Agent.policies:type_name -> ocsf.v1.Policy + 3, // 21: ocsf.v1.Agent.type_id:type_name -> ocsf.v1.Agent.TypeId + 75, // 22: ocsf.v1.Analytic.related_analytics:type_name -> ocsf.v1.Analytic + 4, // 23: ocsf.v1.Analytic.state_id:type_name -> ocsf.v1.Analytic.StateId + 5, // 24: ocsf.v1.Analytic.type_id:type_name -> ocsf.v1.Analytic.TypeId + 116, // 25: ocsf.v1.Api.group:type_name -> ocsf.v1.Group + 156, // 26: ocsf.v1.Api.request:type_name -> ocsf.v1.Request + 158, // 27: ocsf.v1.Api.response:type_name -> ocsf.v1.Response + 164, // 28: ocsf.v1.Api.service:type_name -> ocsf.v1.Service + 174, // 29: ocsf.v1.Api.token:type_name -> ocsf.v1.Token + 182, // 30: ocsf.v1.Application.data:type_name -> google.protobuf.Value + 116, // 31: ocsf.v1.Application.group:type_name -> ocsf.v1.Group + 178, // 32: ocsf.v1.Application.owner:type_name -> ocsf.v1.User + 115, // 33: ocsf.v1.Application.resource_relationship:type_name -> ocsf.v1.Graph + 6, // 34: ocsf.v1.Application.risk_level_id:type_name -> ocsf.v1.Application.RiskLevelId + 161, // 35: ocsf.v1.Application.sbom:type_name -> ocsf.v1.Sbom + 123, // 36: ocsf.v1.Application.tags:type_name -> ocsf.v1.KeyValueObject + 177, // 37: ocsf.v1.Application.url:type_name -> ocsf.v1.Url + 136, // 38: ocsf.v1.Attack.mitigation:type_name -> ocsf.v1.Mitigation + 169, // 39: ocsf.v1.Attack.sub_technique:type_name -> ocsf.v1.SubTechnique + 170, // 40: ocsf.v1.Attack.tactic:type_name -> ocsf.v1.Tactic + 170, // 41: ocsf.v1.Attack.tactics:type_name -> ocsf.v1.Tactic + 171, // 42: ocsf.v1.Attack.technique:type_name -> ocsf.v1.Technique + 95, // 43: ocsf.v1.AuthFactor.device:type_name -> ocsf.v1.Device + 7, // 44: ocsf.v1.AuthFactor.factor_type_id:type_name -> ocsf.v1.AuthFactor.FactorTypeId + 147, // 45: ocsf.v1.Authorization.policy:type_name -> ocsf.v1.Policy + 112, // 46: ocsf.v1.Certificate.fingerprints:type_name -> ocsf.v1.Fingerprint + 160, // 47: ocsf.v1.Certificate.sans:type_name -> ocsf.v1.San + 68, // 48: ocsf.v1.Cloud.account:type_name -> ocsf.v1.Account + 143, // 49: ocsf.v1.Cloud.org:type_name -> ocsf.v1.Organization + 112, // 50: ocsf.v1.Container.hash:type_name -> ocsf.v1.Fingerprint + 121, // 51: ocsf.v1.Container.image:type_name -> ocsf.v1.Image + 123, // 52: ocsf.v1.Container.tags:type_name -> ocsf.v1.KeyValueObject + 89, // 53: ocsf.v1.Cve.cvss:type_name -> ocsf.v1.Cvss + 90, // 54: ocsf.v1.Cve.cwe:type_name -> ocsf.v1.Cwe + 108, // 55: ocsf.v1.Cve.epss:type_name -> ocsf.v1.Epss + 151, // 56: ocsf.v1.Cve.product:type_name -> ocsf.v1.Product + 90, // 57: ocsf.v1.Cve.related_cwes:type_name -> ocsf.v1.Cwe + 135, // 58: ocsf.v1.Cvss.metrics:type_name -> ocsf.v1.Metric + 91, // 59: ocsf.v1.D3fend.d3f_tactic:type_name -> ocsf.v1.D3fTactic + 92, // 60: ocsf.v1.D3fend.d3f_technique:type_name -> ocsf.v1.D3fTechnique + 8, // 61: ocsf.v1.DataClassification.category_id:type_name -> ocsf.v1.DataClassification.CategoryId + 85, // 62: ocsf.v1.DataClassification.classifier_details:type_name -> ocsf.v1.ClassifierDetails + 9, // 63: ocsf.v1.DataClassification.confidentiality_id:type_name -> ocsf.v1.DataClassification.ConfidentialityId + 98, // 64: ocsf.v1.DataClassification.discovery_details:type_name -> ocsf.v1.DiscoveryDetails + 147, // 65: ocsf.v1.DataClassification.policy:type_name -> ocsf.v1.Policy + 10, // 66: ocsf.v1.DataClassification.status_id:type_name -> ocsf.v1.DataClassification.StatusId + 73, // 67: ocsf.v1.Device.agent_list:type_name -> ocsf.v1.Agent + 87, // 68: ocsf.v1.Device.container:type_name -> ocsf.v1.Container + 116, // 69: ocsf.v1.Device.groups:type_name -> ocsf.v1.Group + 96, // 70: ocsf.v1.Device.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 121, // 71: ocsf.v1.Device.image:type_name -> ocsf.v1.Image + 127, // 72: ocsf.v1.Device.location:type_name -> ocsf.v1.Location + 138, // 73: ocsf.v1.Device.network_interfaces:type_name -> ocsf.v1.NetworkInterface + 143, // 74: ocsf.v1.Device.org:type_name -> ocsf.v1.Organization + 144, // 75: ocsf.v1.Device.os:type_name -> ocsf.v1.Os + 178, // 76: ocsf.v1.Device.owner:type_name -> ocsf.v1.User + 116, // 77: ocsf.v1.Device.pool:type_name -> ocsf.v1.Group + 11, // 78: ocsf.v1.Device.risk_level_id:type_name -> ocsf.v1.Device.RiskLevelId + 12, // 79: ocsf.v1.Device.type_id:type_name -> ocsf.v1.Device.TypeId + 13, // 80: ocsf.v1.DeviceHwInfo.cpu_architecture_id:type_name -> ocsf.v1.DeviceHwInfo.CpuArchitectureId + 99, // 81: ocsf.v1.DeviceHwInfo.desktop_display:type_name -> ocsf.v1.Display + 114, // 82: ocsf.v1.DeviceHwInfo.gpu_info_list:type_name -> ocsf.v1.GpuInfo + 124, // 83: ocsf.v1.DeviceHwInfo.keyboard_info:type_name -> ocsf.v1.KeyboardInfo + 14, // 84: ocsf.v1.DigitalSignature.algorithm_id:type_name -> ocsf.v1.DigitalSignature.AlgorithmId + 83, // 85: ocsf.v1.DigitalSignature.certificate:type_name -> ocsf.v1.Certificate + 112, // 86: ocsf.v1.DigitalSignature.digest:type_name -> ocsf.v1.Fingerprint + 15, // 87: ocsf.v1.DigitalSignature.state_id:type_name -> ocsf.v1.DigitalSignature.StateId + 142, // 88: ocsf.v1.DiscoveryDetails.occurrence_details:type_name -> ocsf.v1.OccurrenceDetails + 142, // 89: ocsf.v1.DiscoveryDetails.occurrences:type_name -> ocsf.v1.OccurrenceDetails + 16, // 90: ocsf.v1.DnsAnswer.flag_ids:type_name -> ocsf.v1.DnsAnswer.FlagIds + 127, // 91: ocsf.v1.DomainContact.location:type_name -> ocsf.v1.Location + 17, // 92: ocsf.v1.DomainContact.type_id:type_name -> ocsf.v1.DomainContact.TypeId + 182, // 93: ocsf.v1.Edge.data:type_name -> google.protobuf.Value + 94, // 94: ocsf.v1.Email.data_classification:type_name -> ocsf.v1.DataClassification + 94, // 95: ocsf.v1.Email.data_classifications:type_name -> ocsf.v1.DataClassification + 111, // 96: ocsf.v1.Email.files:type_name -> ocsf.v1.File + 117, // 97: ocsf.v1.Email.http_headers:type_name -> ocsf.v1.HttpHeader + 177, // 98: ocsf.v1.Email.urls:type_name -> ocsf.v1.Url + 18, // 99: ocsf.v1.EncryptionDetails.algorithm_id:type_name -> ocsf.v1.EncryptionDetails.AlgorithmId + 182, // 100: ocsf.v1.Enrichment.data:type_name -> google.protobuf.Value + 155, // 101: ocsf.v1.Enrichment.reputation:type_name -> ocsf.v1.Reputation + 178, // 102: ocsf.v1.File.accessor:type_name -> ocsf.v1.User + 19, // 103: ocsf.v1.File.confidentiality_id:type_name -> ocsf.v1.File.ConfidentialityId + 178, // 104: ocsf.v1.File.creator:type_name -> ocsf.v1.User + 94, // 105: ocsf.v1.File.data_classification:type_name -> ocsf.v1.DataClassification + 94, // 106: ocsf.v1.File.data_classifications:type_name -> ocsf.v1.DataClassification + 20, // 107: ocsf.v1.File.drive_type_id:type_name -> ocsf.v1.File.DriveTypeId + 105, // 108: ocsf.v1.File.encryption_details:type_name -> ocsf.v1.EncryptionDetails + 112, // 109: ocsf.v1.File.hashes:type_name -> ocsf.v1.Fingerprint + 178, // 110: ocsf.v1.File.modifier:type_name -> ocsf.v1.User + 178, // 111: ocsf.v1.File.owner:type_name -> ocsf.v1.User + 151, // 112: ocsf.v1.File.product:type_name -> ocsf.v1.Product + 97, // 113: ocsf.v1.File.signature:type_name -> ocsf.v1.DigitalSignature + 97, // 114: ocsf.v1.File.signatures:type_name -> ocsf.v1.DigitalSignature + 123, // 115: ocsf.v1.File.tags:type_name -> ocsf.v1.KeyValueObject + 21, // 116: ocsf.v1.File.type_id:type_name -> ocsf.v1.File.TypeId + 177, // 117: ocsf.v1.File.url:type_name -> ocsf.v1.Url + 182, // 118: ocsf.v1.File.xattributes:type_name -> google.protobuf.Value + 22, // 119: ocsf.v1.Fingerprint.algorithm_id:type_name -> ocsf.v1.Fingerprint.AlgorithmId + 23, // 120: ocsf.v1.GpuInfo.bus_type_id:type_name -> ocsf.v1.GpuInfo.BusTypeId + 24, // 121: ocsf.v1.GpuInfo.vram_mode_id:type_name -> ocsf.v1.GpuInfo.VramModeId + 102, // 122: ocsf.v1.Graph.edges:type_name -> ocsf.v1.Edge + 140, // 123: ocsf.v1.Graph.nodes:type_name -> ocsf.v1.Node + 25, // 124: ocsf.v1.Graph.query_language_id:type_name -> ocsf.v1.Graph.QueryLanguageId + 117, // 125: ocsf.v1.HttpRequest.http_headers:type_name -> ocsf.v1.HttpHeader + 177, // 126: ocsf.v1.HttpRequest.url:type_name -> ocsf.v1.Url + 117, // 127: ocsf.v1.HttpResponse.http_headers:type_name -> ocsf.v1.HttpHeader + 79, // 128: ocsf.v1.Idp.auth_factors:type_name -> ocsf.v1.AuthFactor + 112, // 129: ocsf.v1.Idp.fingerprint:type_name -> ocsf.v1.Fingerprint + 162, // 130: ocsf.v1.Idp.scim:type_name -> ocsf.v1.Scim + 168, // 131: ocsf.v1.Idp.sso:type_name -> ocsf.v1.Sso + 26, // 132: ocsf.v1.Idp.state_id:type_name -> ocsf.v1.Idp.StateId + 123, // 133: ocsf.v1.Image.tags:type_name -> ocsf.v1.KeyValueObject + 173, // 134: ocsf.v1.KbArticle.avg_timespan:type_name -> ocsf.v1.Timespan + 27, // 135: ocsf.v1.KbArticle.install_state_id:type_name -> ocsf.v1.KbArticle.InstallStateId + 144, // 136: ocsf.v1.KbArticle.os:type_name -> ocsf.v1.Os + 151, // 137: ocsf.v1.KbArticle.product:type_name -> ocsf.v1.Product + 28, // 138: ocsf.v1.KillChainPhase.phase_id:type_name -> ocsf.v1.KillChainPhase.PhaseId + 127, // 139: ocsf.v1.LdapPerson.location:type_name -> ocsf.v1.Location + 178, // 140: ocsf.v1.LdapPerson.manager:type_name -> ocsf.v1.User + 123, // 141: ocsf.v1.LdapPerson.tags:type_name -> ocsf.v1.KeyValueObject + 95, // 142: ocsf.v1.Logger.device:type_name -> ocsf.v1.Device + 151, // 143: ocsf.v1.Logger.product:type_name -> ocsf.v1.Product + 29, // 144: ocsf.v1.Malware.classification_ids:type_name -> ocsf.v1.Malware.ClassificationIds + 88, // 145: ocsf.v1.Malware.cves:type_name -> ocsf.v1.Cve + 111, // 146: ocsf.v1.Malware.files:type_name -> ocsf.v1.File + 30, // 147: ocsf.v1.Malware.severity_id:type_name -> ocsf.v1.Malware.SeverityId + 31, // 148: ocsf.v1.MalwareScanInfo.type_id:type_name -> ocsf.v1.MalwareScanInfo.TypeId + 182, // 149: ocsf.v1.ManagedEntity.data:type_name -> google.protobuf.Value + 95, // 150: ocsf.v1.ManagedEntity.device:type_name -> ocsf.v1.Device + 103, // 151: ocsf.v1.ManagedEntity.email:type_name -> ocsf.v1.Email + 116, // 152: ocsf.v1.ManagedEntity.group:type_name -> ocsf.v1.Group + 127, // 153: ocsf.v1.ManagedEntity.location:type_name -> ocsf.v1.Location + 143, // 154: ocsf.v1.ManagedEntity.org:type_name -> ocsf.v1.Organization + 147, // 155: ocsf.v1.ManagedEntity.policy:type_name -> ocsf.v1.Policy + 32, // 156: ocsf.v1.ManagedEntity.type_id:type_name -> ocsf.v1.ManagedEntity.TypeId + 178, // 157: ocsf.v1.ManagedEntity.user:type_name -> ocsf.v1.User + 33, // 158: ocsf.v1.MessageContext.ai_role_id:type_name -> ocsf.v1.MessageContext.AiRoleId + 77, // 159: ocsf.v1.MessageContext.application:type_name -> ocsf.v1.Application + 164, // 160: ocsf.v1.MessageContext.service:type_name -> ocsf.v1.Service + 94, // 161: ocsf.v1.Metadata.data_classification:type_name -> ocsf.v1.DataClassification + 94, // 162: ocsf.v1.Metadata.data_classifications:type_name -> ocsf.v1.DataClassification + 109, // 163: ocsf.v1.Metadata.extension:type_name -> ocsf.v1.Extension + 109, // 164: ocsf.v1.Metadata.extensions:type_name -> ocsf.v1.Extension + 128, // 165: ocsf.v1.Metadata.loggers:type_name -> ocsf.v1.Logger + 151, // 166: ocsf.v1.Metadata.product:type_name -> ocsf.v1.Product + 154, // 167: ocsf.v1.Metadata.reporter:type_name -> ocsf.v1.Reporter + 123, // 168: ocsf.v1.Metadata.tags:type_name -> ocsf.v1.KeyValueObject + 173, // 169: ocsf.v1.Metadata.total_queued_duration:type_name -> ocsf.v1.Timespan + 176, // 170: ocsf.v1.Metadata.transformation_info_list:type_name -> ocsf.v1.TransformationInfo + 93, // 171: ocsf.v1.Mitigation.countermeasures:type_name -> ocsf.v1.D3fend + 73, // 172: ocsf.v1.NetworkEndpoint.agent_list:type_name -> ocsf.v1.Agent + 81, // 173: ocsf.v1.NetworkEndpoint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 87, // 174: ocsf.v1.NetworkEndpoint.container:type_name -> ocsf.v1.Container + 112, // 175: ocsf.v1.NetworkEndpoint.fingerprints:type_name -> ocsf.v1.Fingerprint + 96, // 176: ocsf.v1.NetworkEndpoint.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 127, // 177: ocsf.v1.NetworkEndpoint.location:type_name -> ocsf.v1.Location + 34, // 178: ocsf.v1.NetworkEndpoint.network_scope_id:type_name -> ocsf.v1.NetworkEndpoint.NetworkScopeId + 144, // 179: ocsf.v1.NetworkEndpoint.os:type_name -> ocsf.v1.Os + 178, // 180: ocsf.v1.NetworkEndpoint.owner:type_name -> ocsf.v1.User + 116, // 181: ocsf.v1.NetworkEndpoint.pool:type_name -> ocsf.v1.Group + 139, // 182: ocsf.v1.NetworkEndpoint.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy + 35, // 183: ocsf.v1.NetworkEndpoint.type_id:type_name -> ocsf.v1.NetworkEndpoint.TypeId + 148, // 184: ocsf.v1.NetworkInterface.open_ports:type_name -> ocsf.v1.PortInfo + 36, // 185: ocsf.v1.NetworkInterface.type_id:type_name -> ocsf.v1.NetworkInterface.TypeId + 73, // 186: ocsf.v1.NetworkProxy.agent_list:type_name -> ocsf.v1.Agent + 81, // 187: ocsf.v1.NetworkProxy.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 87, // 188: ocsf.v1.NetworkProxy.container:type_name -> ocsf.v1.Container + 112, // 189: ocsf.v1.NetworkProxy.fingerprints:type_name -> ocsf.v1.Fingerprint + 96, // 190: ocsf.v1.NetworkProxy.hw_info:type_name -> ocsf.v1.DeviceHwInfo + 127, // 191: ocsf.v1.NetworkProxy.location:type_name -> ocsf.v1.Location + 37, // 192: ocsf.v1.NetworkProxy.network_scope_id:type_name -> ocsf.v1.NetworkProxy.NetworkScopeId + 144, // 193: ocsf.v1.NetworkProxy.os:type_name -> ocsf.v1.Os + 178, // 194: ocsf.v1.NetworkProxy.owner:type_name -> ocsf.v1.User + 116, // 195: ocsf.v1.NetworkProxy.pool:type_name -> ocsf.v1.Group + 139, // 196: ocsf.v1.NetworkProxy.proxy_endpoint:type_name -> ocsf.v1.NetworkProxy + 38, // 197: ocsf.v1.NetworkProxy.type_id:type_name -> ocsf.v1.NetworkProxy.TypeId + 182, // 198: ocsf.v1.Node.data:type_name -> google.protobuf.Value + 155, // 199: ocsf.v1.Observable.reputation:type_name -> ocsf.v1.Reputation + 39, // 200: ocsf.v1.Observable.type_id:type_name -> ocsf.v1.Observable.TypeId + 40, // 201: ocsf.v1.Os.type_id:type_name -> ocsf.v1.Os.TypeId + 100, // 202: ocsf.v1.Osint.answers:type_name -> ocsf.v1.DnsAnswer + 78, // 203: ocsf.v1.Osint.attacks:type_name -> ocsf.v1.Attack + 81, // 204: ocsf.v1.Osint.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 82, // 205: ocsf.v1.Osint.campaign:type_name -> ocsf.v1.Campaign + 41, // 206: ocsf.v1.Osint.confidence_id:type_name -> ocsf.v1.Osint.ConfidenceId + 178, // 207: ocsf.v1.Osint.creator:type_name -> ocsf.v1.User + 42, // 208: ocsf.v1.Osint.detection_pattern_type_id:type_name -> ocsf.v1.Osint.DetectionPatternTypeId + 103, // 209: ocsf.v1.Osint.email:type_name -> ocsf.v1.Email + 104, // 210: ocsf.v1.Osint.email_auth:type_name -> ocsf.v1.EmailAuth + 111, // 211: ocsf.v1.Osint.file:type_name -> ocsf.v1.File + 125, // 212: ocsf.v1.Osint.kill_chain:type_name -> ocsf.v1.KillChainPhase + 127, // 213: ocsf.v1.Osint.location:type_name -> ocsf.v1.Location + 130, // 214: ocsf.v1.Osint.malware:type_name -> ocsf.v1.Malware + 75, // 215: ocsf.v1.Osint.related_analytics:type_name -> ocsf.v1.Analytic + 155, // 216: ocsf.v1.Osint.reputation:type_name -> ocsf.v1.Reputation + 163, // 217: ocsf.v1.Osint.script:type_name -> ocsf.v1.Script + 43, // 218: ocsf.v1.Osint.severity_id:type_name -> ocsf.v1.Osint.SeverityId + 97, // 219: ocsf.v1.Osint.signatures:type_name -> ocsf.v1.DigitalSignature + 172, // 220: ocsf.v1.Osint.threat_actor:type_name -> ocsf.v1.ThreatActor + 44, // 221: ocsf.v1.Osint.type_id:type_name -> ocsf.v1.Osint.TypeId + 179, // 222: ocsf.v1.Osint.vulnerabilities:type_name -> ocsf.v1.Vulnerability + 180, // 223: ocsf.v1.Osint.whois:type_name -> ocsf.v1.Whois + 112, // 224: ocsf.v1.Package.hash:type_name -> ocsf.v1.Fingerprint + 45, // 225: ocsf.v1.Package.type_id:type_name -> ocsf.v1.Package.TypeId + 182, // 226: ocsf.v1.Policy.data:type_name -> google.protobuf.Value + 116, // 227: ocsf.v1.Policy.group:type_name -> ocsf.v1.Group + 150, // 228: ocsf.v1.Process.ancestry:type_name -> ocsf.v1.ProcessEntity + 87, // 229: ocsf.v1.Process.container:type_name -> ocsf.v1.Container + 107, // 230: ocsf.v1.Process.environment_variables:type_name -> ocsf.v1.EnvironmentVariable + 111, // 231: ocsf.v1.Process.file:type_name -> ocsf.v1.File + 116, // 232: ocsf.v1.Process.group:type_name -> ocsf.v1.Group + 181, // 233: ocsf.v1.Process.hosted_services:type_name -> ocsf.v1.WinService + 46, // 234: ocsf.v1.Process.integrity_id:type_name -> ocsf.v1.Process.IntegrityId + 149, // 235: ocsf.v1.Process.parent_process:type_name -> ocsf.v1.Process + 165, // 236: ocsf.v1.Process.session:type_name -> ocsf.v1.Session + 178, // 237: ocsf.v1.Process.user:type_name -> ocsf.v1.User + 182, // 238: ocsf.v1.Process.xattributes:type_name -> google.protobuf.Value + 94, // 239: ocsf.v1.Product.data_classification:type_name -> ocsf.v1.DataClassification + 94, // 240: ocsf.v1.Product.data_classifications:type_name -> ocsf.v1.DataClassification + 110, // 241: ocsf.v1.Product.feature:type_name -> ocsf.v1.Feature + 84, // 242: ocsf.v1.Remediation.cis_controls:type_name -> ocsf.v1.CisControl + 122, // 243: ocsf.v1.Remediation.kb_article_list:type_name -> ocsf.v1.KbArticle + 143, // 244: ocsf.v1.Reporter.org:type_name -> ocsf.v1.Organization + 47, // 245: ocsf.v1.Reputation.score_id:type_name -> ocsf.v1.Reputation.ScoreId + 87, // 246: ocsf.v1.Request.containers:type_name -> ocsf.v1.Container + 182, // 247: ocsf.v1.Request.data:type_name -> google.protobuf.Value + 73, // 248: ocsf.v1.ResourceDetails.agent_list:type_name -> ocsf.v1.Agent + 182, // 249: ocsf.v1.ResourceDetails.data:type_name -> google.protobuf.Value + 94, // 250: ocsf.v1.ResourceDetails.data_classification:type_name -> ocsf.v1.DataClassification + 94, // 251: ocsf.v1.ResourceDetails.data_classifications:type_name -> ocsf.v1.DataClassification + 116, // 252: ocsf.v1.ResourceDetails.group:type_name -> ocsf.v1.Group + 178, // 253: ocsf.v1.ResourceDetails.owner:type_name -> ocsf.v1.User + 115, // 254: ocsf.v1.ResourceDetails.resource_relationship:type_name -> ocsf.v1.Graph + 48, // 255: ocsf.v1.ResourceDetails.role_id:type_name -> ocsf.v1.ResourceDetails.RoleId + 123, // 256: ocsf.v1.ResourceDetails.tags:type_name -> ocsf.v1.KeyValueObject + 87, // 257: ocsf.v1.Response.containers:type_name -> ocsf.v1.Container + 182, // 258: ocsf.v1.Response.data:type_name -> google.protobuf.Value + 146, // 259: ocsf.v1.Sbom.package:type_name -> ocsf.v1.Package + 151, // 260: ocsf.v1.Sbom.product:type_name -> ocsf.v1.Product + 166, // 261: ocsf.v1.Sbom.software_components:type_name -> ocsf.v1.SoftwareComponent + 49, // 262: ocsf.v1.Sbom.type_id:type_name -> ocsf.v1.Sbom.TypeId + 50, // 263: ocsf.v1.Scim.auth_protocol_id:type_name -> ocsf.v1.Scim.AuthProtocolId + 182, // 264: ocsf.v1.Scim.scim_group_schema:type_name -> google.protobuf.Value + 182, // 265: ocsf.v1.Scim.scim_user_schema:type_name -> google.protobuf.Value + 51, // 266: ocsf.v1.Scim.state_id:type_name -> ocsf.v1.Scim.StateId + 111, // 267: ocsf.v1.Script.file:type_name -> ocsf.v1.File + 112, // 268: ocsf.v1.Script.hashes:type_name -> ocsf.v1.Fingerprint + 129, // 269: ocsf.v1.Script.script_content:type_name -> ocsf.v1.LongString + 52, // 270: ocsf.v1.Script.type_id:type_name -> ocsf.v1.Script.TypeId + 123, // 271: ocsf.v1.Service.tags:type_name -> ocsf.v1.KeyValueObject + 112, // 272: ocsf.v1.SoftwareComponent.hash:type_name -> ocsf.v1.Fingerprint + 53, // 273: ocsf.v1.SoftwareComponent.relationship_id:type_name -> ocsf.v1.SoftwareComponent.RelationshipId + 54, // 274: ocsf.v1.SoftwareComponent.type_id:type_name -> ocsf.v1.SoftwareComponent.TypeId + 164, // 275: ocsf.v1.Span.service:type_name -> ocsf.v1.Service + 55, // 276: ocsf.v1.Sso.auth_protocol_id:type_name -> ocsf.v1.Sso.AuthProtocolId + 83, // 277: ocsf.v1.Sso.certificate:type_name -> ocsf.v1.Certificate + 56, // 278: ocsf.v1.ThreatActor.type_id:type_name -> ocsf.v1.ThreatActor.TypeId + 57, // 279: ocsf.v1.Timespan.type_id:type_name -> ocsf.v1.Timespan.TypeId + 58, // 280: ocsf.v1.Token.type_id:type_name -> ocsf.v1.Token.TypeId + 164, // 281: ocsf.v1.Trace.service:type_name -> ocsf.v1.Service + 167, // 282: ocsf.v1.Trace.span:type_name -> ocsf.v1.Span + 151, // 283: ocsf.v1.TransformationInfo.product:type_name -> ocsf.v1.Product + 59, // 284: ocsf.v1.Url.category_ids:type_name -> ocsf.v1.Url.CategoryIds + 68, // 285: ocsf.v1.User.account:type_name -> ocsf.v1.Account + 116, // 286: ocsf.v1.User.groups:type_name -> ocsf.v1.Group + 126, // 287: ocsf.v1.User.ldap_person:type_name -> ocsf.v1.LdapPerson + 143, // 288: ocsf.v1.User.org:type_name -> ocsf.v1.Organization + 152, // 289: ocsf.v1.User.programmatic_credentials:type_name -> ocsf.v1.ProgrammaticCredential + 60, // 290: ocsf.v1.User.risk_level_id:type_name -> ocsf.v1.User.RiskLevelId + 61, // 291: ocsf.v1.User.type_id:type_name -> ocsf.v1.User.TypeId + 70, // 292: ocsf.v1.Vulnerability.advisory:type_name -> ocsf.v1.Advisory + 71, // 293: ocsf.v1.Vulnerability.affected_code:type_name -> ocsf.v1.AffectedCode + 72, // 294: ocsf.v1.Vulnerability.affected_packages:type_name -> ocsf.v1.AffectedPackage + 88, // 295: ocsf.v1.Vulnerability.cve:type_name -> ocsf.v1.Cve + 90, // 296: ocsf.v1.Vulnerability.cwe:type_name -> ocsf.v1.Cwe + 62, // 297: ocsf.v1.Vulnerability.fix_coverage_id:type_name -> ocsf.v1.Vulnerability.FixCoverageId + 122, // 298: ocsf.v1.Vulnerability.kb_article_list:type_name -> ocsf.v1.KbArticle + 146, // 299: ocsf.v1.Vulnerability.packages:type_name -> ocsf.v1.Package + 153, // 300: ocsf.v1.Vulnerability.remediation:type_name -> ocsf.v1.Remediation + 81, // 301: ocsf.v1.Whois.autonomous_system:type_name -> ocsf.v1.AutonomousSystem + 63, // 302: ocsf.v1.Whois.dnssec_status_id:type_name -> ocsf.v1.Whois.DnssecStatusId + 101, // 303: ocsf.v1.Whois.domain_contacts:type_name -> ocsf.v1.DomainContact + 150, // 304: ocsf.v1.WinService.hosting_process:type_name -> ocsf.v1.ProcessEntity + 64, // 305: ocsf.v1.WinService.service_category_id:type_name -> ocsf.v1.WinService.ServiceCategoryId + 111, // 306: ocsf.v1.WinService.service_dll_file:type_name -> ocsf.v1.File + 65, // 307: ocsf.v1.WinService.service_error_control_id:type_name -> ocsf.v1.WinService.ServiceErrorControlId + 111, // 308: ocsf.v1.WinService.service_file:type_name -> ocsf.v1.File + 66, // 309: ocsf.v1.WinService.service_start_type_id:type_name -> ocsf.v1.WinService.ServiceStartTypeId + 67, // 310: ocsf.v1.WinService.service_type_id:type_name -> ocsf.v1.WinService.ServiceTypeId + 123, // 311: ocsf.v1.WinService.tags:type_name -> ocsf.v1.KeyValueObject + 312, // [312:312] is the sub-list for method output_type + 312, // [312:312] is the sub-list for method input_type + 312, // [312:312] is the sub-list for extension type_name + 312, // [312:312] is the sub-list for extension extendee + 0, // [0:312] is the sub-list for field type_name +} + +func init() { file_ocsf_v1_objects_proto_init() } +func file_ocsf_v1_objects_proto_init() { + if File_ocsf_v1_objects_proto != nil { return } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_entity_proto_rawDesc), len(file_api_entity_proto_rawDesc)), - NumEnums: 88, - NumMessages: 116, + RawDescriptor: unsafe.Slice(unsafe.StringData(file_ocsf_v1_objects_proto_rawDesc), len(file_ocsf_v1_objects_proto_rawDesc)), + NumEnums: 68, + NumMessages: 114, NumExtensions: 0, NumServices: 0, }, - GoTypes: file_api_entity_proto_goTypes, - DependencyIndexes: file_api_entity_proto_depIdxs, - EnumInfos: file_api_entity_proto_enumTypes, - MessageInfos: file_api_entity_proto_msgTypes, + GoTypes: file_ocsf_v1_objects_proto_goTypes, + DependencyIndexes: file_ocsf_v1_objects_proto_depIdxs, + EnumInfos: file_ocsf_v1_objects_proto_enumTypes, + MessageInfos: file_ocsf_v1_objects_proto_msgTypes, }.Build() - File_api_entity_proto = out.File - file_api_entity_proto_goTypes = nil - file_api_entity_proto_depIdxs = nil + File_ocsf_v1_objects_proto = out.File + file_ocsf_v1_objects_proto_goTypes = nil + file_ocsf_v1_objects_proto_depIdxs = nil } diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go index e939cb8..097cb2f 100644 --- a/ocsf/internal/ocsf/gen/emit.go +++ b/ocsf/internal/ocsf/gen/emit.go @@ -180,91 +180,190 @@ func detectImports(s *schema.Schema, classes []schema.Class, objects []schema.Ob return needStructProto, needValidateProto } -// Emit produces a deterministic proto3 document from the named classes and -// their transitive object closure. +// GeneratedFile is one proto file produced by Emit. +// +// Path is the module-relative output path (e.g. "ocsf/v1/api_activity.proto" +// or "ocsf/v1/objects.proto"). Content is the full proto3 file text. +type GeneratedFile struct { + Path string + Content string +} + +// objectsFileName is the base name of the shared objects file. +const objectsFileName = "objects.proto" + +// Emit produces a deterministic multi-file proto3 layout from the named classes +// and their transitive object closure. // // version is embedded in the proto package name using only its major component: -// "1.8.0" → package ocsf.v1, "2.0.0" → package ocsf.v2. +// "1.8.0" → package ocsf.v1, "2.0.0" → package ocsf.v2. The same major (v) +// is used as the directory segment: files land under "ocsf/v/". +// +// Layout for a given class selection and version with major N: +// - ocsf/v/.proto — one file per class, containing exactly that +// class's message plus its nested enums. +// - ocsf/v/objects.proto — every transitively referenced object message +// (sorted by message name) plus stub messages for referenced-but-absent +// objects. Objects reference one another only within this file, so it needs +// no ocsf import; this keeps OCSF's cyclic object graph (user<->group, +// actor->process->...) legal under proto's no-circular-import rule. +// +// Files are sorted by Path. Imports within each file are sorted. Class files +// import objects.proto when they reference any object, buf/validate when they +// emit validation annotations, and struct.proto when they use +// google.protobuf.Value. // // The caller owns tm and is responsible for calling tm.Save after Emit returns. -// Emit mutates tm by calling Assign for every field it emits. +// Emit mutates tm by calling Assign for every field it emits. Field numbers are +// keyed by message+attribute, so the multi-file split does not change any tag. // // stubbed is the sorted, de-duplicated list of object names that were emitted // as empty stub messages because they were referenced by attributes but absent -// from the schema snapshot. It is nil when no stubs were needed. Callers can -// use this to distinguish an expected partial-fixture gap from a loader bug. -func Emit(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version string) (proto string, stubbed []string, err error) { +// from the schema snapshot. It is nil when no stubs were needed. Callers can use +// this to distinguish an expected partial-fixture gap from a loader bug. +func Emit(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version string) (files []GeneratedFile, stubbed []string, err error) { classes, objects, err := SelectClosure(s, classNames) if err != nil { - return "", nil, err + return nil, nil, err } - // First pass: figure out which imports we need. - needStructProto, needValidateProto := detectImports(s, classes, objects) + pkgSuffix, err := versionToPackage(version) + if err != nil { + return nil, nil, err + } + dir := "ocsf/" + pkgSuffix - var sb strings.Builder + stubs := collectStubs(s, classes, objects) + // Any class or object may reference an object (present or stubbed): all such + // referents live in objects.proto, so a file references objects.proto iff its + // own attributes point at an object. + hasObjects := len(objects) > 0 || len(stubs) > 0 - // License / header comment. - sb.WriteString(`// Code generated by ocsf-protogen. DO NOT EDIT. -// Source: OCSF schema ` + version + ` + files = make([]GeneratedFile, 0, len(classes)+1) -`) + // One file per class. + for i := range classes { + f, emitErr := emitClassFile(s, tm, version, pkgSuffix, dir, hasObjects, &classes[i]) + if emitErr != nil { + return nil, nil, emitErr + } + files = append(files, f) + } - pkgSuffix, err := versionToPackage(version) + // One shared objects file. + objFile, err := emitObjectsFile(s, tm, version, pkgSuffix, dir, objects, stubs) if err != nil { - return "", nil, err + return nil, nil, err } + files = append(files, objFile) - sb.WriteString(`syntax = "proto3";` + "\n\n") - sb.WriteString(`package ocsf.` + pkgSuffix + ";\n\n") + sort.Slice(files, func(i, j int) bool { return files[i].Path < files[j].Path }) + + var stubbedNames []string + if len(stubs) > 0 { + stubbedNames = stubs + } + return files, stubbedNames, nil +} + +// emitClassFile builds the proto file for a single class. +func emitClassFile(s *schema.Schema, tm *tagmap.TagMap, version, pkgSuffix, dir string, hasObjects bool, cls *schema.Class) (GeneratedFile, error) { + msg, err := emitMessage(s, tm, toPascalCase(cls.Name), cls.Attributes, cls.Constraints) + if err != nil { + return GeneratedFile{}, fmt.Errorf("ocsf emit: class %q: %w", cls.Name, err) + } + + needStruct, needValidate := detectImports(s, []schema.Class{*cls}, nil) + // A class imports objects.proto iff it references at least one object. + needObjects := hasObjects && classReferencesObject(cls) - // Imports (sorted). var imports []string - if needStructProto { + if needObjects { + imports = append(imports, `import "`+dir+"/"+objectsFileName+`";`) + } + if needStruct { imports = append(imports, `import "google/protobuf/struct.proto";`) } - if needValidateProto { + if needValidate { imports = append(imports, `import "buf/validate/validate.proto";`) } - sort.Strings(imports) - for _, imp := range imports { - sb.WriteString(imp + "\n") + + content := fileHeader(version, pkgSuffix) + importBlock(imports) + msg + "\n" + return GeneratedFile{Path: dir + "/" + cls.Name + ".proto", Content: content}, nil +} + +// emitObjectsFile builds the shared objects.proto containing all objects (sorted +// by message name) plus stub messages for referenced-but-absent objects. +func emitObjectsFile(s *schema.Schema, tm *tagmap.TagMap, version, pkgSuffix, dir string, objects []schema.Object, stubs []string) (GeneratedFile, error) { + needStruct, needValidate := detectImports(s, nil, objects) + + var imports []string + if needStruct { + imports = append(imports, `import "google/protobuf/struct.proto";`) } - if len(imports) > 0 { - sb.WriteString("\n") + if needValidate { + imports = append(imports, `import "buf/validate/validate.proto";`) } - // Emit classes then objects, each sorted by name. - for i := range classes { - msg, emitErr := emitMessage(s, tm, toPascalCase(classes[i].Name), classes[i].Attributes, classes[i].Constraints) - if emitErr != nil { - return "", nil, fmt.Errorf("ocsf emit: class %q: %w", classes[i].Name, emitErr) - } - sb.WriteString(msg) - sb.WriteString("\n") - } - for i := range objects { - msg, emitErr := emitMessage(s, tm, toPascalCase(objects[i].Name), objects[i].Attributes, objects[i].Constraints) - if emitErr != nil { - return "", nil, fmt.Errorf("ocsf emit: object %q: %w", objects[i].Name, emitErr) + // Sort objects by their emitted (PascalCase) message name for determinism. + sorted := make([]schema.Object, len(objects)) + copy(sorted, objects) + sort.Slice(sorted, func(i, j int) bool { + return toPascalCase(sorted[i].Name) < toPascalCase(sorted[j].Name) + }) + + var body strings.Builder + for i := range sorted { + msg, err := emitMessage(s, tm, toPascalCase(sorted[i].Name), sorted[i].Attributes, sorted[i].Constraints) + if err != nil { + return GeneratedFile{}, fmt.Errorf("ocsf emit: object %q: %w", sorted[i].Name, err) } - sb.WriteString(msg) - sb.WriteString("\n") + body.WriteString(msg) + body.WriteString("\n") } - // Emit stub messages for object types that are referenced but absent from - // the schema snapshot (e.g. profile-injected objects from a partial export). - stubs := collectStubs(s, classes, objects) + // Stub messages for object types referenced but absent from the schema. for _, stubName := range stubs { - sb.WriteString("// Stub: referenced object not present in this schema snapshot.\n") - sb.WriteString("message " + stubName + " {}\n\n") + body.WriteString("// Stub: referenced object not present in this schema snapshot.\n") + body.WriteString("message " + stubName + " {}\n\n") } - var stubbedNames []string - if len(stubs) > 0 { - stubbedNames = stubs + content := fileHeader(version, pkgSuffix) + importBlock(imports) + body.String() + return GeneratedFile{Path: dir + "/" + objectsFileName, Content: content}, nil +} + +// fileHeader returns the shared header comment, syntax, and package lines. +func fileHeader(version, pkgSuffix string) string { + return "// Code generated by ocsf-protogen. DO NOT EDIT.\n" + + "// Source: OCSF schema " + version + "\n\n" + + `syntax = "proto3";` + "\n\n" + + "package ocsf." + pkgSuffix + ";\n\n" +} + +// importBlock returns a sorted import block terminated by a blank line, or the +// empty string when there are no imports. +func importBlock(imports []string) string { + if len(imports) == 0 { + return "" + } + sort.Strings(imports) + var sb strings.Builder + for _, imp := range imports { + sb.WriteString(imp + "\n") + } + sb.WriteString("\n") + return sb.String() +} + +// classReferencesObject reports whether any attribute of the class points at a +// (non-generic) object type. +func classReferencesObject(cls *schema.Class) bool { + for _, attr := range cls.Attributes { + if attr.Type == objectTypeName && attr.ObjectType != "" && attr.ObjectType != genericObject { + return true + } } - return sb.String(), stubbedNames, nil + return false } // resolveProtoType maps an attribute to its ProtoType, returning an error for diff --git a/ocsf/internal/ocsf/gen/emit_test.go b/ocsf/internal/ocsf/gen/emit_test.go index 28e2a41..c4f97c4 100644 --- a/ocsf/internal/ocsf/gen/emit_test.go +++ b/ocsf/internal/ocsf/gen/emit_test.go @@ -26,9 +26,27 @@ import ( // -update regenerates golden files when passed to `go test`. var update = flag.Bool("update", false, "regenerate golden files") -// goldenPath is the directory for golden .proto files. +// goldenDir is the module root of the golden proto tree. Emit writes files under +// goldenDir/ocsf/v/, so the golden module root is this directory. const goldenDir = "testdata/golden" +// emitJoined runs Emit and concatenates every generated file's content in +// path-sorted order. Tests that only assert on substrings (message present, +// import present, field annotation present) use this so they need not care +// which specific file a given fragment landed in. +func emitJoined(t *testing.T, s *schema.Schema, classNames []string, tm *tagmap.TagMap, version string) (string, []string, error) { + t.Helper() + files, stubbed, err := gen.Emit(s, classNames, tm, version) + if err != nil { + return "", stubbed, err + } + var sb strings.Builder + for _, f := range files { + sb.WriteString(f.Content) + } + return sb.String(), stubbed, nil +} + // TestSelectClosure_ApiActivity verifies that SelectClosure returns the api_activity // class plus the full transitive object closure, all sorted deterministically. func TestSelectClosure_ApiActivity(t *testing.T) { @@ -90,7 +108,7 @@ func TestEmit_PackageAndSyntax(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Contains(t, out, `syntax = "proto3";`) @@ -138,7 +156,7 @@ func TestVersionToPackage_TableDriven(t *testing.T) { t.Run(tc.version, func(t *testing.T) { s := minimalSchema(tc.version) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"stub_event"}, tm, tc.version) + out, _, err := emitJoined(t, s, []string{"stub_event"}, tm, tc.version) if tc.wantErr { require.Error(t, err) return @@ -156,7 +174,7 @@ func TestEmit_MessageApiActivity(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Contains(t, out, "message ApiActivity {") @@ -169,7 +187,7 @@ func TestEmit_NestedEnum(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Contains(t, out, "enum ActivityId {") @@ -182,7 +200,7 @@ func TestEmit_ObjectTypedField(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) // actor field should be "Actor actor = ;" @@ -195,7 +213,7 @@ func TestEmit_RepeatedField(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Contains(t, out, "repeated Authorization authorizations =") @@ -207,7 +225,7 @@ func TestEmit_WellKnownImport(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Contains(t, out, `import "google/protobuf/struct.proto";`) @@ -219,7 +237,7 @@ func TestEmit_RequiredFieldAnnotation(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) // api_activity.time is required @@ -234,10 +252,10 @@ func TestEmit_StableTags(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out1, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out1, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) - out2, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out2, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) require.Equal(t, out1, out2, "two Emit calls with the same tag map must produce identical output") @@ -249,11 +267,11 @@ func TestEmit_Deterministic(t *testing.T) { s := loadFixture(t) tm1 := tagmap.New() - out1, _, err := gen.Emit(s, []string{"api_activity"}, tm1, "1.8.0") + out1, _, err := emitJoined(t, s, []string{"api_activity"}, tm1, "1.8.0") require.NoError(t, err) tm2 := tagmap.New() - out2, _, err := gen.Emit(s, []string{"api_activity"}, tm2, "1.8.0") + out2, _, err := emitJoined(t, s, []string{"api_activity"}, tm2, "1.8.0") require.NoError(t, err) require.Equal(t, out1, out2, "Emit with fresh tag maps must be byte-identical") @@ -267,7 +285,7 @@ func TestEmit_ConstraintCEL(t *testing.T) { tm := tagmap.New() // api_activity pulls in the user object transitively. - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) // The User message must contain a CEL option for at_least_one. @@ -281,7 +299,7 @@ func TestEmit_JustOneCEL(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) // vulnerability is in the transitive closure @@ -289,32 +307,72 @@ func TestEmit_JustOneCEL(t *testing.T) { } // TestEmit_Golden is a golden-file test. It emits api_activity + entity_management -// and compares against testdata/golden/api_entity.proto. +// as a multi-file proto tree and compares every generated file against the +// committed tree under testdata/golden/ (ocsf/v1/{api_activity,entity_management, +// objects}.proto). Drift is any file added, removed, or changed. // -// Run with -update to regenerate the golden file. +// Run with -update to regenerate the golden tree. func TestEmit_Golden(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity", "entity_management"}, tm, "1.8.0") + files, _, err := gen.Emit(s, []string{"api_activity", "entity_management"}, tm, "1.8.0") require.NoError(t, err) - goldenFile := goldenDir + "/api_entity.proto" - if *update { - require.NoError(t, os.MkdirAll(goldenDir, 0o755)) - require.NoError(t, os.WriteFile(goldenFile, []byte(out), 0o644)) - t.Logf("golden file updated: %s", goldenFile) + for _, f := range files { + dst := filepath.Join(goldenDir, filepath.FromSlash(f.Path)) + require.NoError(t, os.MkdirAll(filepath.Dir(dst), 0o755)) + require.NoError(t, os.WriteFile(dst, []byte(f.Content), 0o644)) + } + t.Logf("golden tree updated under %s (%d files)", goldenDir, len(files)) return } - golden, err := os.ReadFile(goldenFile) - if os.IsNotExist(err) { - t.Fatalf("golden file %s does not exist; run with -update to generate it", goldenFile) + // Compare the full set of generated files against the committed tree. + wantPaths := make(map[string]string, len(files)) + for _, f := range files { + wantPaths[f.Path] = f.Content + } + + // Enumerate committed .proto files under the versioned dir to catch removals. + committed := make(map[string]string) + protoRoot := filepath.Join(goldenDir, "ocsf") + walkErr := filepath.WalkDir(protoRoot, func(path string, d os.DirEntry, err error) error { + if err != nil { + return err + } + if d.IsDir() || filepath.Ext(path) != ".proto" { + return nil + } + rel, relErr := filepath.Rel(goldenDir, path) + if relErr != nil { + return relErr + } + b, readErr := os.ReadFile(path) + if readErr != nil { + return readErr + } + committed[filepath.ToSlash(rel)] = string(b) + return nil + }) + if os.IsNotExist(walkErr) { + t.Fatalf("golden tree %s does not exist; run with -update to generate it", protoRoot) + } + require.NoError(t, walkErr) + + // Every generated file must exist and match. + for path, content := range wantPaths { + got, ok := committed[path] + require.True(t, ok, "generated file %s is missing from golden tree; re-run with -update", path) + require.Equal(t, content, got, + "generated file %s does not match golden; re-run with -update if intentional", path) + } + // No stray committed files. + for path := range committed { + _, ok := wantPaths[path] + require.True(t, ok, "committed golden file %s is not produced by Emit; re-run with -update", path) } - require.NoError(t, err) - require.Equal(t, string(golden), out, - "emitted proto does not match golden; re-run with -update if intentional") } // TestEmit_ImportOrder verifies that imports appear in sorted order. @@ -322,7 +380,7 @@ func TestEmit_ImportOrder(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) bufIdx := strings.Index(out, `"buf/validate/validate.proto"`) @@ -363,7 +421,7 @@ func TestEmit_StubbedObjects_ReportsAbsent(t *testing.T) { } tm := tagmap.New() - _, stubbed, err := gen.Emit(s, []string{"test_event"}, tm, "0.0.1") + _, stubbed, err := emitJoined(t, s, []string{"test_event"}, tm, "0.0.1") require.NoError(t, err) require.Equal(t, []string{"PhantomObj"}, stubbed, "Emit must report PascalCase name of the absent object in stubbed") @@ -377,7 +435,7 @@ func TestEmit_StubbedObjects_NoneWhenFullyResolvable(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - _, stubbed, err := gen.Emit(s, []string{"entity_management"}, tm, "1.8.0") + _, stubbed, err := emitJoined(t, s, []string{"entity_management"}, tm, "1.8.0") require.NoError(t, err) require.Empty(t, stubbed, "Emit must return empty stubbed when all referenced objects are present in the schema") @@ -394,7 +452,7 @@ func TestEmit_RequiredRepeatedFieldNoAnnotation(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - out, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + out, _, err := emitJoined(t, s, []string{"api_activity"}, tm, "1.8.0") require.NoError(t, err) // osint is repeated+required: must NOT carry the annotation. @@ -436,7 +494,7 @@ func TestEmit_UnresolvableScalarErrors(t *testing.T) { } tm := tagmap.New() - _, _, err := gen.Emit(s, []string{"bad_event"}, tm, "0.0.1") + _, _, err := emitJoined(t, s, []string{"bad_event"}, tm, "0.0.1") require.Error(t, err, "Emit must return an error for an unresolvable scalar type") require.Contains(t, err.Error(), "totally_unknown_scalar_t", "error must name the unresolvable type") @@ -451,7 +509,7 @@ func TestEmit_DeterministicWithSavedTagMap(t *testing.T) { // First run: emit with a fresh TagMap and save it. tm1 := tagmap.New() - out1, _, err := gen.Emit(s, []string{"api_activity"}, tm1, "1.8.0") + out1, _, err := emitJoined(t, s, []string{"api_activity"}, tm1, "1.8.0") require.NoError(t, err) tagFile := filepath.Join(t.TempDir(), "tags.json") @@ -461,7 +519,7 @@ func TestEmit_DeterministicWithSavedTagMap(t *testing.T) { tm2, err := tagmap.Load(tagFile) require.NoError(t, err) - out2, _, err := gen.Emit(s, []string{"api_activity"}, tm2, "1.8.0") + out2, _, err := emitJoined(t, s, []string{"api_activity"}, tm2, "1.8.0") require.NoError(t, err) require.Equal(t, out1, out2, diff --git a/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml index 4d2ee62..5e2f6a2 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml +++ b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml @@ -7,8 +7,6 @@ lint: use: - STANDARD except: - # Generated files don't follow a consistent package/directory convention. - - PACKAGE_DIRECTORY_MATCH # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values by design. - ENUM_ZERO_VALUE_SUFFIX breaking: diff --git a/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/api_activity.proto b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/api_activity.proto new file mode 100644 index 0000000..212b9f3 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/api_activity.proto @@ -0,0 +1,171 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message ApiActivity { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + string action = 1; + ActionId action_id = 2; + ActivityId activity_id = 3 [(buf.validate.field).required = true]; + string activity_name = 4; + Actor actor = 5 [(buf.validate.field).required = true]; + AiModel ai_model = 6; + Api api = 7 [(buf.validate.field).required = true]; + repeated Attack attacks = 8; + repeated Authorization authorizations = 9; + string category_name = 10; + CategoryUid category_uid = 11 [(buf.validate.field).required = true]; + string class_name = 12; + ClassUid class_uid = 13 [(buf.validate.field).required = true]; + Cloud cloud = 14 [(buf.validate.field).required = true]; + string confidence = 15; + ConfidenceId confidence_id = 16; + int32 confidence_score = 17; + int32 count = 18; + Device device = 19; + string disposition = 20; + DispositionId disposition_id = 21; + NetworkEndpoint dst_endpoint = 22; + int64 duration = 23; + int64 end_time = 24; + string end_time_dt = 25; + repeated Enrichment enrichments = 26; + FirewallRule firewall_rule = 27; + HttpRequest http_request = 28; + HttpResponse http_response = 29; + bool is_alert = 30; + repeated Malware malware = 31; + MalwareScanInfo malware_scan_info = 32; + string message = 33; + MessageContext message_context = 34; + Metadata metadata = 35 [(buf.validate.field).required = true]; + repeated Observable observables = 36; + repeated Osint osint = 37; + Policy policy = 38; + string raw_data = 39; + Fingerprint raw_data_hash = 40; + int64 raw_data_size = 41; + repeated ResourceDetails resources = 42; + string risk_details = 43; + string risk_level = 44; + RiskLevelId risk_level_id = 45; + int32 risk_score = 46; + string severity = 47; + SeverityId severity_id = 48 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; + int64 start_time = 50; + string start_time_dt = 51; + string status = 52; + string status_code = 53; + string status_detail = 54; + StatusId status_id = 55; + int64 time = 56 [(buf.validate.field).required = true]; + string time_dt = 57; + int32 timezone_offset = 58; + Trace trace = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/entity_management.proto b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/entity_management.proto new file mode 100644 index 0000000..b39653c --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/entity_management.proto @@ -0,0 +1,189 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message EntityManagement { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_MOVE = 5; + ACTIVITY_ID_ENROLL = 6; + ACTIVITY_ID_UNENROLL = 7; + ACTIVITY_ID_ENABLE = 8; + ACTIVITY_ID_DISABLE = 9; + ACTIVITY_ID_ACTIVATE = 10; + ACTIVITY_ID_DEACTIVATE = 11; + ACTIVITY_ID_SUSPEND = 12; + ACTIVITY_ID_RESUME = 13; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + ActivityId activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + Api api = 8; + repeated Attack attacks = 9; + repeated Authorization authorizations = 10; + string category_name = 11; + CategoryUid category_uid = 12 [(buf.validate.field).required = true]; + string class_name = 13; + ClassUid class_uid = 14 [(buf.validate.field).required = true]; + Cloud cloud = 15 [(buf.validate.field).required = true]; + string comment = 16; + string confidence = 17; + ConfidenceId confidence_id = 18; + int32 confidence_score = 19; + int32 count = 20; + Device device = 21; + string disposition = 22; + DispositionId disposition_id = 23; + int64 duration = 24; + int64 end_time = 25; + string end_time_dt = 26; + repeated Enrichment enrichments = 27; + ManagedEntity entity = 28 [(buf.validate.field).required = true]; + ManagedEntity entity_result = 29; + FirewallRule firewall_rule = 30; + HttpRequest http_request = 31; + HttpResponse http_response = 32; + bool is_alert = 33; + repeated Malware malware = 34; + MalwareScanInfo malware_scan_info = 35; + string message = 36; + Metadata metadata = 37 [(buf.validate.field).required = true]; + repeated Observable observables = 38; + repeated Osint osint = 39; + Policy policy = 40; + string raw_data = 41; + Fingerprint raw_data_hash = 42; + int64 raw_data_size = 43; + string risk_details = 44; + string risk_level = 45; + RiskLevelId risk_level_id = 46; + int32 risk_score = 47; + string severity = 48; + SeverityId severity_id = 49 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 50; + int64 start_time = 51; + string start_time_dt = 52; + string status = 53; + string status_code = 54; + string status_detail = 55; + StatusId status_id = 56; + int64 time = 57 [(buf.validate.field).required = true]; + string time_dt = 58; + int32 timezone_offset = 59; + string type_name = 60; + TypeUid type_uid = 61 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 62; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/objects.proto similarity index 87% rename from ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto rename to ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/objects.proto index bff84db..6019663 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden/api_entity.proto +++ b/ocsf/internal/ocsf/gen/testdata/golden/ocsf/v1/objects.proto @@ -8,344 +8,6 @@ package ocsf.v1; import "buf/validate/validate.proto"; import "google/protobuf/struct.proto"; -message ApiActivity { - enum ActionId { - ACTION_ID_UNKNOWN = 0; - ACTION_ID_ALLOWED = 1; - ACTION_ID_DENIED = 2; - ACTION_ID_OBSERVED = 3; - ACTION_ID_MODIFIED = 4; - ACTION_ID_OTHER = 99; - } - enum ActivityId { - ACTIVITY_ID_UNKNOWN = 0; - ACTIVITY_ID_CREATE = 1; - ACTIVITY_ID_READ = 2; - ACTIVITY_ID_UPDATE = 3; - ACTIVITY_ID_DELETE = 4; - ACTIVITY_ID_OTHER = 99; - } - enum CategoryUid { - CATEGORY_UID_UNKNOWN = 0; - CATEGORY_UID_APPLICATION_ACTIVITY = 6; - } - enum ClassUid { - CLASS_UID_UNKNOWN = 0; - CLASS_UID_API_ACTIVITY = 6003; - } - enum ConfidenceId { - CONFIDENCE_ID_UNKNOWN = 0; - CONFIDENCE_ID_LOW = 1; - CONFIDENCE_ID_MEDIUM = 2; - CONFIDENCE_ID_HIGH = 3; - CONFIDENCE_ID_OTHER = 99; - } - enum DispositionId { - DISPOSITION_ID_UNKNOWN = 0; - DISPOSITION_ID_ALLOWED = 1; - DISPOSITION_ID_BLOCKED = 2; - DISPOSITION_ID_QUARANTINED = 3; - DISPOSITION_ID_ISOLATED = 4; - DISPOSITION_ID_DELETED = 5; - DISPOSITION_ID_DROPPED = 6; - DISPOSITION_ID_CUSTOM_ACTION = 7; - DISPOSITION_ID_APPROVED = 8; - DISPOSITION_ID_RESTORED = 9; - DISPOSITION_ID_EXONERATED = 10; - DISPOSITION_ID_CORRECTED = 11; - DISPOSITION_ID_PARTIALLY_CORRECTED = 12; - DISPOSITION_ID_UNCORRECTED = 13; - DISPOSITION_ID_DELAYED = 14; - DISPOSITION_ID_DETECTED = 15; - DISPOSITION_ID_NO_ACTION = 16; - DISPOSITION_ID_LOGGED = 17; - DISPOSITION_ID_TAGGED = 18; - DISPOSITION_ID_ALERT = 19; - DISPOSITION_ID_COUNT = 20; - DISPOSITION_ID_RESET = 21; - DISPOSITION_ID_CAPTCHA = 22; - DISPOSITION_ID_CHALLENGE = 23; - DISPOSITION_ID_ACCESS_REVOKED = 24; - DISPOSITION_ID_REJECTED = 25; - DISPOSITION_ID_UNAUTHORIZED = 26; - DISPOSITION_ID_ERROR = 27; - DISPOSITION_ID_OTHER = 99; - } - enum RiskLevelId { - RISK_LEVEL_ID_INFO = 0; - RISK_LEVEL_ID_LOW = 1; - RISK_LEVEL_ID_MEDIUM = 2; - RISK_LEVEL_ID_HIGH = 3; - RISK_LEVEL_ID_CRITICAL = 4; - RISK_LEVEL_ID_OTHER = 99; - } - enum SeverityId { - SEVERITY_ID_UNKNOWN = 0; - SEVERITY_ID_INFORMATIONAL = 1; - SEVERITY_ID_LOW = 2; - SEVERITY_ID_MEDIUM = 3; - SEVERITY_ID_HIGH = 4; - SEVERITY_ID_CRITICAL = 5; - SEVERITY_ID_FATAL = 6; - SEVERITY_ID_OTHER = 99; - } - enum StatusId { - STATUS_ID_UNKNOWN = 0; - STATUS_ID_SUCCESS = 1; - STATUS_ID_FAILURE = 2; - STATUS_ID_OTHER = 99; - } - enum TypeUid { - TYPE_UID_UNKNOWN = 0; - TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; - TYPE_UID_API_ACTIVITY_CREATE = 600301; - TYPE_UID_API_ACTIVITY_READ = 600302; - TYPE_UID_API_ACTIVITY_UPDATE = 600303; - TYPE_UID_API_ACTIVITY_DELETE = 600304; - TYPE_UID_API_ACTIVITY_OTHER = 600399; - } - string action = 1; - ActionId action_id = 2; - ActivityId activity_id = 3 [(buf.validate.field).required = true]; - string activity_name = 4; - Actor actor = 5 [(buf.validate.field).required = true]; - AiModel ai_model = 6; - Api api = 7 [(buf.validate.field).required = true]; - repeated Attack attacks = 8; - repeated Authorization authorizations = 9; - string category_name = 10; - CategoryUid category_uid = 11 [(buf.validate.field).required = true]; - string class_name = 12; - ClassUid class_uid = 13 [(buf.validate.field).required = true]; - Cloud cloud = 14 [(buf.validate.field).required = true]; - string confidence = 15; - ConfidenceId confidence_id = 16; - int32 confidence_score = 17; - int32 count = 18; - Device device = 19; - string disposition = 20; - DispositionId disposition_id = 21; - NetworkEndpoint dst_endpoint = 22; - int64 duration = 23; - int64 end_time = 24; - string end_time_dt = 25; - repeated Enrichment enrichments = 26; - FirewallRule firewall_rule = 27; - HttpRequest http_request = 28; - HttpResponse http_response = 29; - bool is_alert = 30; - repeated Malware malware = 31; - MalwareScanInfo malware_scan_info = 32; - string message = 33; - MessageContext message_context = 34; - Metadata metadata = 35 [(buf.validate.field).required = true]; - repeated Observable observables = 36; - repeated Osint osint = 37; - Policy policy = 38; - string raw_data = 39; - Fingerprint raw_data_hash = 40; - int64 raw_data_size = 41; - repeated ResourceDetails resources = 42; - string risk_details = 43; - string risk_level = 44; - RiskLevelId risk_level_id = 45; - int32 risk_score = 46; - string severity = 47; - SeverityId severity_id = 48 [(buf.validate.field).required = true]; - NetworkEndpoint src_endpoint = 49 [(buf.validate.field).required = true]; - int64 start_time = 50; - string start_time_dt = 51; - string status = 52; - string status_code = 53; - string status_detail = 54; - StatusId status_id = 55; - int64 time = 56 [(buf.validate.field).required = true]; - string time_dt = 57; - int32 timezone_offset = 58; - Trace trace = 59; - string type_name = 60; - TypeUid type_uid = 61 [(buf.validate.field).required = true]; - google.protobuf.Value unmapped = 62; -} - -message EntityManagement { - enum ActionId { - ACTION_ID_UNKNOWN = 0; - ACTION_ID_ALLOWED = 1; - ACTION_ID_DENIED = 2; - ACTION_ID_OBSERVED = 3; - ACTION_ID_MODIFIED = 4; - ACTION_ID_OTHER = 99; - } - enum ActivityId { - ACTIVITY_ID_UNKNOWN = 0; - ACTIVITY_ID_CREATE = 1; - ACTIVITY_ID_READ = 2; - ACTIVITY_ID_UPDATE = 3; - ACTIVITY_ID_DELETE = 4; - ACTIVITY_ID_MOVE = 5; - ACTIVITY_ID_ENROLL = 6; - ACTIVITY_ID_UNENROLL = 7; - ACTIVITY_ID_ENABLE = 8; - ACTIVITY_ID_DISABLE = 9; - ACTIVITY_ID_ACTIVATE = 10; - ACTIVITY_ID_DEACTIVATE = 11; - ACTIVITY_ID_SUSPEND = 12; - ACTIVITY_ID_RESUME = 13; - ACTIVITY_ID_OTHER = 99; - } - enum CategoryUid { - CATEGORY_UID_UNKNOWN = 0; - CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; - } - enum ClassUid { - CLASS_UID_UNKNOWN = 0; - CLASS_UID_ENTITY_MANAGEMENT = 3004; - } - enum ConfidenceId { - CONFIDENCE_ID_UNKNOWN = 0; - CONFIDENCE_ID_LOW = 1; - CONFIDENCE_ID_MEDIUM = 2; - CONFIDENCE_ID_HIGH = 3; - CONFIDENCE_ID_OTHER = 99; - } - enum DispositionId { - DISPOSITION_ID_UNKNOWN = 0; - DISPOSITION_ID_ALLOWED = 1; - DISPOSITION_ID_BLOCKED = 2; - DISPOSITION_ID_QUARANTINED = 3; - DISPOSITION_ID_ISOLATED = 4; - DISPOSITION_ID_DELETED = 5; - DISPOSITION_ID_DROPPED = 6; - DISPOSITION_ID_CUSTOM_ACTION = 7; - DISPOSITION_ID_APPROVED = 8; - DISPOSITION_ID_RESTORED = 9; - DISPOSITION_ID_EXONERATED = 10; - DISPOSITION_ID_CORRECTED = 11; - DISPOSITION_ID_PARTIALLY_CORRECTED = 12; - DISPOSITION_ID_UNCORRECTED = 13; - DISPOSITION_ID_DELAYED = 14; - DISPOSITION_ID_DETECTED = 15; - DISPOSITION_ID_NO_ACTION = 16; - DISPOSITION_ID_LOGGED = 17; - DISPOSITION_ID_TAGGED = 18; - DISPOSITION_ID_ALERT = 19; - DISPOSITION_ID_COUNT = 20; - DISPOSITION_ID_RESET = 21; - DISPOSITION_ID_CAPTCHA = 22; - DISPOSITION_ID_CHALLENGE = 23; - DISPOSITION_ID_ACCESS_REVOKED = 24; - DISPOSITION_ID_REJECTED = 25; - DISPOSITION_ID_UNAUTHORIZED = 26; - DISPOSITION_ID_ERROR = 27; - DISPOSITION_ID_OTHER = 99; - } - enum RiskLevelId { - RISK_LEVEL_ID_INFO = 0; - RISK_LEVEL_ID_LOW = 1; - RISK_LEVEL_ID_MEDIUM = 2; - RISK_LEVEL_ID_HIGH = 3; - RISK_LEVEL_ID_CRITICAL = 4; - RISK_LEVEL_ID_OTHER = 99; - } - enum SeverityId { - SEVERITY_ID_UNKNOWN = 0; - SEVERITY_ID_INFORMATIONAL = 1; - SEVERITY_ID_LOW = 2; - SEVERITY_ID_MEDIUM = 3; - SEVERITY_ID_HIGH = 4; - SEVERITY_ID_CRITICAL = 5; - SEVERITY_ID_FATAL = 6; - SEVERITY_ID_OTHER = 99; - } - enum StatusId { - STATUS_ID_UNKNOWN = 0; - STATUS_ID_SUCCESS = 1; - STATUS_ID_FAILURE = 2; - STATUS_ID_OTHER = 99; - } - enum TypeUid { - TYPE_UID_UNKNOWN = 0; - TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; - TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; - TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; - TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; - TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; - TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; - TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; - TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; - TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; - TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; - TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; - TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; - TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; - TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; - TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; - } - repeated string access_list = 1; - int32 access_mask = 2; - string action = 3; - ActionId action_id = 4; - ActivityId activity_id = 5 [(buf.validate.field).required = true]; - string activity_name = 6; - Actor actor = 7; - Api api = 8; - repeated Attack attacks = 9; - repeated Authorization authorizations = 10; - string category_name = 11; - CategoryUid category_uid = 12 [(buf.validate.field).required = true]; - string class_name = 13; - ClassUid class_uid = 14 [(buf.validate.field).required = true]; - Cloud cloud = 15 [(buf.validate.field).required = true]; - string comment = 16; - string confidence = 17; - ConfidenceId confidence_id = 18; - int32 confidence_score = 19; - int32 count = 20; - Device device = 21; - string disposition = 22; - DispositionId disposition_id = 23; - int64 duration = 24; - int64 end_time = 25; - string end_time_dt = 26; - repeated Enrichment enrichments = 27; - ManagedEntity entity = 28 [(buf.validate.field).required = true]; - ManagedEntity entity_result = 29; - FirewallRule firewall_rule = 30; - HttpRequest http_request = 31; - HttpResponse http_response = 32; - bool is_alert = 33; - repeated Malware malware = 34; - MalwareScanInfo malware_scan_info = 35; - string message = 36; - Metadata metadata = 37 [(buf.validate.field).required = true]; - repeated Observable observables = 38; - repeated Osint osint = 39; - Policy policy = 40; - string raw_data = 41; - Fingerprint raw_data_hash = 42; - int64 raw_data_size = 43; - string risk_details = 44; - string risk_level = 45; - RiskLevelId risk_level_id = 46; - int32 risk_score = 47; - string severity = 48; - SeverityId severity_id = 49 [(buf.validate.field).required = true]; - NetworkEndpoint src_endpoint = 50; - int64 start_time = 51; - string start_time_dt = 52; - string status = 53; - string status_code = 54; - string status_detail = 55; - StatusId status_id = 56; - int64 time = 57 [(buf.validate.field).required = true]; - string time_dt = 58; - int32 timezone_offset = 59; - string type_name = 60; - TypeUid type_uid = 61 [(buf.validate.field).required = true]; - google.protobuf.Value unmapped = 62; -} - message Account { option (buf.validate.message).cel = { id: "Account.at_least_one", From e081b3ec53a62da3ebdab38c4b0bf7cf74112565 Mon Sep 17 00:00:00 2001 From: santiago Date: Wed, 1 Jul 2026 17:14:57 +0200 Subject: [PATCH 11/26] feat(ocsf): emit self-contained SR schema text per class The generic ocsf.v protos carry no Schema-Registry annotation, so there is no schema text a consumer can register directly. Add EmitSRSchemas, which emits one self-contained .sr.proto per class for explicit SR registration by consumers. Each file inlines the class message plus its full transitive object closure: the class message is emitted first so it lands at Confluent message-index 0 (what decoders rely on). All buf.validate output is stripped (no per-field required annotations, no message-level CEL blocks) and the objects file is never imported. Field numbers reuse the wire tagmap via the idempotent Assign, so tags are identical to the main Emit output. emitMessage gains an emitOptions{omitValidate} parameter threaded from the SR path; the main callers pass the default (validate on), leaving existing golden output unchanged. The CLI gains --sr-schema-out , integrated with --check for drift detection. The sr/ golden dir is excluded from the buf module since each .sr.proto is a standalone artifact, not part of the module. Co-Authored-By: Claude Opus 4.8 (1M context) --- ocsf/cmd/ocsf-protogen/main.go | 14 +- ocsf/cmd/ocsf-protogen/protogen/protogen.go | 65 +- .../ocsf-protogen/protogen/protogen_test.go | 92 + ocsf/internal/ocsf/gen/emit.go | 20 +- ocsf/internal/ocsf/gen/srschema.go | 127 + ocsf/internal/ocsf/gen/srschema_test.go | 213 ++ .../ocsf/gen/testdata/golden/buf.yaml | 6 + .../testdata/golden/sr/api_activity.sr.proto | 2614 +++++++++++++++++ .../golden/sr/entity_management.sr.proto | 2447 +++++++++++++++ 9 files changed, 5586 insertions(+), 12 deletions(-) create mode 100644 ocsf/internal/ocsf/gen/srschema.go create mode 100644 ocsf/internal/ocsf/gen/srschema_test.go create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/sr/api_activity.sr.proto create mode 100644 ocsf/internal/ocsf/gen/testdata/golden/sr/entity_management.sr.proto diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go index 1551c38..d0c3cdf 100644 --- a/ocsf/cmd/ocsf-protogen/main.go +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -85,6 +85,7 @@ func run(args []string) error { compatCheckFlag := fs.Bool("compat-check", false, "check wire stability between two tagmap files (use with --old and --new)") oldFlag := fs.String("old", "", "path to the base-branch tagmap JSON (for --compat-check)") newFlag := fs.String("new", "", "path to the PR tagmap JSON (for --compat-check)") + srSchemaOutFlag := fs.String("sr-schema-out", "", "optional directory for self-contained Schema-Registry schemas (.sr.proto); empty disables SR emission") if err := fs.Parse(args); err != nil { return err @@ -119,12 +120,13 @@ func run(args []string) error { } cfg := protogen.Config{ - SchemaPath: *schemaFlag, - Classes: classes, - Version: *versionFlag, - OutDir: *outFlag, - TagmapPath: *tagmapFlag, - Check: *checkFlag, + SchemaPath: *schemaFlag, + Classes: classes, + Version: *versionFlag, + OutDir: *outFlag, + TagmapPath: *tagmapFlag, + Check: *checkFlag, + SRSchemaOutDir: *srSchemaOutFlag, } if cfg.Check { diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go index f4c482c..65f022f 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -34,6 +34,11 @@ type Config struct { OutDir string TagmapPath string Check bool + // SRSchemaOutDir, when non-empty, is the directory into which the + // self-contained Schema-Registry schema files (.sr.proto) are written + // after the main Emit. It is unrelated to OutDir: SR files are flat, not + // module-relative. Empty disables SR schema emission entirely. + SRSchemaOutDir string } // Generate loads the schema, emits the proto, writes --out and --tagmap. @@ -62,6 +67,19 @@ func Generate(cfg Config) (stubbed []string, err error) { return nil, err } + // Emit self-contained SR schemas using the SAME tagmap so field numbers match + // the main output. Do this before tm.Save so the (idempotent) Assign calls are + // persisted too. + if strings.TrimSpace(cfg.SRSchemaOutDir) != "" { + srFiles, err := gen.EmitSRSchemas(s, cfg.Classes, tm, cfg.Version) + if err != nil { + return nil, fmt.Errorf("emit sr schemas: %w", err) + } + if err := writeFiles(cfg.SRSchemaOutDir, srFiles); err != nil { + return nil, err + } + } + if err := tm.Save(cfg.TagmapPath); err != nil { return nil, fmt.Errorf("save tagmap to %q: %w", cfg.TagmapPath, err) } @@ -144,7 +162,52 @@ func Check(cfg Config) error { } // File-set drift: any file added, removed, or changed. - return diffTree(cfg.OutDir, files, committed) + if err := diffTree(cfg.OutDir, files, committed); err != nil { + return err + } + + // SR schema drift (only when the SR output dir is configured). SR files are + // written flat under SRSchemaOutDir, so we compare each generated file against + // its committed counterpart there. + if strings.TrimSpace(cfg.SRSchemaOutDir) != "" { + srFiles, err := gen.EmitSRSchemas(s, cfg.Classes, newTM, cfg.Version) + if err != nil { + return fmt.Errorf("emit sr schemas: %w", err) + } + if err := diffSRSchemas(cfg.SRSchemaOutDir, srFiles); err != nil { + return err + } + } + + return nil +} + +// diffSRSchemas compares freshly generated SR schema files against their +// committed counterparts under srOutDir and returns a descriptive error on any +// missing or changed file. +func diffSRSchemas(srOutDir string, files []gen.GeneratedFile) error { + for _, f := range files { + p := filepath.Join(srOutDir, filepath.FromSlash(f.Path)) + b, err := os.ReadFile(filepath.Clean(p)) + switch { + case os.IsNotExist(err): + return fmt.Errorf( + "generated SR schema %q is missing from %q "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + f.Path, srOutDir, + ) + case err != nil: + return fmt.Errorf("read committed SR schema %q: %w", p, err) + } + if string(b) != f.Content { + return fmt.Errorf( + "committed SR schema %q differs from freshly generated output "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + f.Path, + ) + } + } + return nil } // readCommittedTree loads the committed content of every path produced by Emit diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go index 5ef2718..a09bca7 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -110,6 +110,98 @@ func TestGenerateThenCheck(t *testing.T) { require.NoError(t, err, "--check must pass immediately after Generate on the same baseline") } +// ─── SR schema output ───────────────────────────────────────────────────────── + +// TestGenerateWritesSRSchemas verifies that when SRSchemaOutDir is set, Generate +// writes one flat .sr.proto per class and that --check passes against the +// just-generated baseline. +func TestGenerateWritesSRSchemas(t *testing.T) { + dir := t.TempDir() + srDir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + require.FileExists(t, filepath.Join(srDir, "api_activity.sr.proto")) + require.FileExists(t, filepath.Join(srDir, "entity_management.sr.proto")) + + // --check against the just-generated SR baseline must pass. + checkCfg := cfg + checkCfg.Check = true + require.NoError(t, protogen.Check(checkCfg), + "--check must pass immediately after Generate on the same SR baseline") +} + +// TestCheckFailsOnSRSchemaDrift verifies that --check detects drift in a +// committed SR schema file. +func TestCheckFailsOnSRSchemaDrift(t *testing.T) { + dir := t.TempDir() + srDir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Corrupt the committed SR schema file. + srPath := filepath.Join(srDir, "api_activity.sr.proto") + content, err := os.ReadFile(srPath) + require.NoError(t, err) + require.NoError(t, os.WriteFile(srPath, append(content, []byte("\n// CORRUPTED\n")...), 0o644)) + + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.Error(t, err, "--check must fail when a committed SR schema drifts") + require.Contains(t, err.Error(), "SR schema") + require.Contains(t, err.Error(), "differs") +} + +// TestCheckFailsOnMissingSRSchema verifies that --check reports a missing SR file. +func TestCheckFailsOnMissingSRSchema(t *testing.T) { + dir := t.TempDir() + srDir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + require.NoError(t, os.Remove(filepath.Join(srDir, "api_activity.sr.proto"))) + + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.Error(t, err, "--check must fail when a committed SR schema is missing") + require.Contains(t, err.Error(), "missing") +} + // ─── Check: tagmap incompatibility ──────────────────────────────────────────── // TestCheckFailsOnProtoDriftFromEditedTagmap verifies that protogen.Check diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go index 097cb2f..10690b9 100644 --- a/ocsf/internal/ocsf/gen/emit.go +++ b/ocsf/internal/ocsf/gen/emit.go @@ -268,7 +268,7 @@ func Emit(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version stri // emitClassFile builds the proto file for a single class. func emitClassFile(s *schema.Schema, tm *tagmap.TagMap, version, pkgSuffix, dir string, hasObjects bool, cls *schema.Class) (GeneratedFile, error) { - msg, err := emitMessage(s, tm, toPascalCase(cls.Name), cls.Attributes, cls.Constraints) + msg, err := emitMessage(s, tm, toPascalCase(cls.Name), cls.Attributes, cls.Constraints, emitOptions{}) if err != nil { return GeneratedFile{}, fmt.Errorf("ocsf emit: class %q: %w", cls.Name, err) } @@ -314,7 +314,7 @@ func emitObjectsFile(s *schema.Schema, tm *tagmap.TagMap, version, pkgSuffix, di var body strings.Builder for i := range sorted { - msg, err := emitMessage(s, tm, toPascalCase(sorted[i].Name), sorted[i].Attributes, sorted[i].Constraints) + msg, err := emitMessage(s, tm, toPascalCase(sorted[i].Name), sorted[i].Attributes, sorted[i].Constraints, emitOptions{}) if err != nil { return GeneratedFile{}, fmt.Errorf("ocsf emit: object %q: %w", sorted[i].Name, err) } @@ -493,9 +493,19 @@ func resolveFieldSpec(s *schema.Schema, tm *tagmap.TagMap, msgName, attrName str return fs, nil, nil } +// emitOptions controls optional emitter behavior. +// +// omitValidate suppresses all buf.validate output: the per-field +// (buf.validate.field).required annotation and the message-level +// (buf.validate.message).cel constraint blocks. It is set by the SR-schema path, +// which emits self-contained schemas that must not depend on buf/validate. +type emitOptions struct { + omitValidate bool +} + // emitMessage generates one proto message block for the given message name, // attribute map, and optional constraints. -func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[string]*schema.Attribute, constraints *schema.Constraints) (string, error) { +func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[string]*schema.Attribute, constraints *schema.Constraints, opts emitOptions) (string, error) { // Sort attribute names for determinism during tag assignment. attrNames := make([]string, 0, len(attrs)) for name := range attrs { @@ -535,7 +545,7 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ sb.WriteString("message " + msgName + " {\n") // Emit constraint CEL options (before nested enums and fields). - if constraints != nil { + if constraints != nil && !opts.omitValidate { if len(constraints.AtLeastOne) > 0 { cel := atLeastOneCEL(msgName, constraints.AtLeastOne) sb.WriteString(cel) @@ -563,7 +573,7 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ // (len >= 1)", but OCSF "required" on an array means only "key present". // Fields like osint can be legitimately empty, so we skip the annotation // for repeated fields to avoid wrongly rejecting valid events. - if fs.required && !fs.repeated { + if fs.required && !fs.repeated && !opts.omitValidate { line += ` [(buf.validate.field).required = true]` } line += ";\n" diff --git a/ocsf/internal/ocsf/gen/srschema.go b/ocsf/internal/ocsf/gen/srschema.go new file mode 100644 index 0000000..10a8646 --- /dev/null +++ b/ocsf/internal/ocsf/gen/srschema.go @@ -0,0 +1,127 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen + +import ( + "fmt" + "sort" + "strings" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// EmitSRSchemas produces one self-contained Schema-Registry (SR) schema file per +// named class. +// +// The generic ocsf.v protos emitted by Emit carry no SR annotation, so there +// is no schema text a consumer can register directly. EmitSRSchemas fills that +// gap: for each class it inlines the class message plus its full transitive +// object closure into a single proto3 file that a consumer can hand to a Schema +// Registry as-is. +// +// For each class it emits one GeneratedFile: +// - Path: ".sr.proto" (flat, no directory prefix; the caller +// decides where to write it). +// - Content: a single self-contained proto3 file whose messages appear in this +// order: +// 1. the CLASS message (making it Confluent message-index 0, which decoders +// rely on), +// 2. every object in the class's transitive closure, sorted by PascalCase +// message name, +// 3. stub messages for objects referenced but absent from the schema +// snapshot. +// +// The file NEVER imports buf/validate/validate.proto and NEVER imports the +// shared objects file: objects are inlined here. google/protobuf/struct.proto is +// imported only when some emitted attribute resolves to google.protobuf.Value. +// +// No buf.validate output is produced: neither the per-field +// (buf.validate.field).required annotation nor the message-level CEL constraint +// blocks. Everything else (field names, tag numbers, repeated, nested enums, +// type names) is IDENTICAL to Emit's output. +// +// Field numbers reuse the wire tagmap: pass the SAME tm used for Emit. Assign is +// idempotent, so an already-assigned (message, attribute) returns its existing +// tag without mutation, and the SR schema's tags match the main output exactly. +func EmitSRSchemas(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version string) ([]GeneratedFile, error) { + pkgSuffix, err := versionToPackage(version) + if err != nil { + return nil, err + } + + files := make([]GeneratedFile, 0, len(classNames)) + for _, className := range classNames { + f, emitErr := emitSRSchemaFile(s, tm, version, pkgSuffix, className) + if emitErr != nil { + return nil, emitErr + } + files = append(files, f) + } + + sort.Slice(files, func(i, j int) bool { return files[i].Path < files[j].Path }) + return files, nil +} + +// emitSRSchemaFile builds the self-contained SR schema file for a single class. +func emitSRSchemaFile(s *schema.Schema, tm *tagmap.TagMap, version, pkgSuffix, className string) (GeneratedFile, error) { + classes, objects, err := SelectClosure(s, []string{className}) + if err != nil { + return GeneratedFile{}, err + } + // SelectClosure validates existence, so exactly one class is returned. + cls := classes[0] + + opts := emitOptions{omitValidate: true} + + var body strings.Builder + + // (1) Class message FIRST → Confluent message-index 0. + classMsg, err := emitMessage(s, tm, toPascalCase(cls.Name), cls.Attributes, cls.Constraints, opts) + if err != nil { + return GeneratedFile{}, fmt.Errorf("ocsf sr emit: class %q: %w", cls.Name, err) + } + body.WriteString(classMsg) + body.WriteString("\n") + + // (2) Objects in the transitive closure, sorted by PascalCase message name. + sorted := make([]schema.Object, len(objects)) + copy(sorted, objects) + sort.Slice(sorted, func(i, j int) bool { + return toPascalCase(sorted[i].Name) < toPascalCase(sorted[j].Name) + }) + for i := range sorted { + msg, emitErr := emitMessage(s, tm, toPascalCase(sorted[i].Name), sorted[i].Attributes, sorted[i].Constraints, opts) + if emitErr != nil { + return GeneratedFile{}, fmt.Errorf("ocsf sr emit: object %q: %w", sorted[i].Name, emitErr) + } + body.WriteString(msg) + body.WriteString("\n") + } + + // (3) Stub messages for referenced-but-absent objects. + stubs := collectStubs(s, classes, objects) + for _, stubName := range stubs { + body.WriteString("// Stub: referenced object not present in this schema snapshot.\n") + body.WriteString("message " + stubName + " {}\n\n") + } + + // struct.proto is the only import the SR file may need: never buf/validate, + // never the objects file. Detect Value usage across the class + closure. + needStruct, _ := detectImports(s, classes, objects) + + var imports []string + if needStruct { + imports = append(imports, `import "google/protobuf/struct.proto";`) + } + + content := fileHeader(version, pkgSuffix) + importBlock(imports) + body.String() + return GeneratedFile{Path: cls.Name + ".sr.proto", Content: content}, nil +} diff --git a/ocsf/internal/ocsf/gen/srschema_test.go b/ocsf/internal/ocsf/gen/srschema_test.go new file mode 100644 index 0000000..716316f --- /dev/null +++ b/ocsf/internal/ocsf/gen/srschema_test.go @@ -0,0 +1,213 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "os" + "path/filepath" + "regexp" + "strings" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// srGoldenDir is where the committed SR schema goldens live. Files land directly +// under it as .sr.proto (flat, no version directory). +const srGoldenDir = "testdata/golden/sr" + +// srClasses is the class selection used by the SR golden test. +var srClasses = []string{"api_activity", "entity_management"} + +// TestEmitSRSchemas_Golden emits the SR schema files for api_activity + +// entity_management and compares each against the committed golden under +// testdata/golden/sr/. Run with -update to regenerate. +func TestEmitSRSchemas_Golden(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, err := gen.EmitSRSchemas(s, srClasses, tm, "1.8.0") + require.NoError(t, err) + require.Len(t, files, len(srClasses)) + + if *update { + require.NoError(t, os.MkdirAll(srGoldenDir, 0o755)) + for _, f := range files { + dst := filepath.Join(srGoldenDir, filepath.FromSlash(f.Path)) + require.NoError(t, os.WriteFile(dst, []byte(f.Content), 0o644)) + } + t.Logf("SR golden files updated under %s (%d files)", srGoldenDir, len(files)) + return + } + + for _, f := range files { + golden := filepath.Join(srGoldenDir, filepath.FromSlash(f.Path)) + want, readErr := os.ReadFile(golden) + require.NoError(t, readErr, "SR golden %s missing; re-run with -update", f.Path) + require.Equal(t, string(want), f.Content, + "SR schema %s does not match golden; re-run with -update if intentional", f.Path) + } +} + +// TestEmitSRSchemas_Paths verifies each file is named .sr.proto with +// no directory prefix. +func TestEmitSRSchemas_Paths(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, err := gen.EmitSRSchemas(s, srClasses, tm, "1.8.0") + require.NoError(t, err) + + got := make([]string, 0, len(files)) + for _, f := range files { + got = append(got, f.Path) + require.NotContains(t, f.Path, "/", "SR schema path must be flat (no directory prefix)") + } + require.ElementsMatch(t, []string{"api_activity.sr.proto", "entity_management.sr.proto"}, got) +} + +// TestEmitSRSchemas_NoBufValidate asserts that NO buf.validate substring and NO +// buf/validate import appears anywhere in any SR schema output. +func TestEmitSRSchemas_NoBufValidate(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, err := gen.EmitSRSchemas(s, srClasses, tm, "1.8.0") + require.NoError(t, err) + + for _, f := range files { + require.NotContains(t, f.Content, "buf.validate", + "SR schema %s must not contain any buf.validate output", f.Path) + require.NotContains(t, f.Content, `import "buf/validate`, + "SR schema %s must not import buf/validate", f.Path) + require.NotContains(t, f.Content, `import "ocsf/`, + "SR schema %s must not import the objects file (objects are inlined)", f.Path) + } +} + +// TestEmitSRSchemas_ClassMessageFirst asserts the class message is the FIRST +// `message ` declaration in each file (Confluent message-index 0). +func TestEmitSRSchemas_ClassMessageFirst(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, err := gen.EmitSRSchemas(s, srClasses, tm, "1.8.0") + require.NoError(t, err) + + // class_name -> expected leading message name. + wantFirst := map[string]string{ + "api_activity.sr.proto": "ApiActivity", + "entity_management.sr.proto": "EntityManagement", + } + + msgRe := regexp.MustCompile(`(?m)^message (\w+) \{`) + for _, f := range files { + m := msgRe.FindStringSubmatch(f.Content) + require.NotNil(t, m, "SR schema %s must contain a top-level message", f.Path) + require.Equal(t, wantFirst[f.Path], m[1], + "first message in %s must be the class message (index 0)", f.Path) + + // Package sanity: SR schema must use the same package as the main output. + require.Contains(t, f.Content, "package ocsf.v1;") + } +} + +// TestEmitSRSchemas_FieldNumberParity runs Emit and EmitSRSchemas with the SAME +// fresh tagmap and asserts that representative field tags on the ApiActivity +// class message are identical between the main api_activity.proto and the +// api_activity.sr.proto. +func TestEmitSRSchemas_FieldNumberParity(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + mainFiles, _, err := gen.Emit(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + srFiles, err := gen.EmitSRSchemas(s, []string{"api_activity"}, tm, "1.8.0") + require.NoError(t, err) + + mainContent := findFile(t, filenameToContent(mainFiles), "ocsf/v1/api_activity.proto") + srContent := findFile(t, filenameToContent(srFiles), "api_activity.sr.proto") + + // Representative fields on ApiActivity. + for _, field := range []string{"activity_id", "actor", "time", "type_uid"} { + mainTag := extractTag(t, mainContent, field) + srTag := extractTag(t, srContent, field) + require.Equal(t, mainTag, srTag, + "field %q must have the same tag in main and SR output", field) + } +} + +// filenameToContent builds a path→content map from a slice of GeneratedFiles. +func filenameToContent(files []gen.GeneratedFile) map[string]string { + m := make(map[string]string, len(files)) + for _, f := range files { + m[f.Path] = f.Content + } + return m +} + +func findFile(t *testing.T, m map[string]string, path string) string { + t.Helper() + c, ok := m[path] + require.True(t, ok, "expected generated file %q", path) + return c +} + +// extractTag finds the ` = ;` tag for a field within a message body. +// It matches the first occurrence, which for the class-first files is the class +// message's field. +func extractTag(t *testing.T, content, field string) string { + t.Helper() + re := regexp.MustCompile(`(?m)\b` + regexp.QuoteMeta(field) + ` = (\d+)`) + m := re.FindStringSubmatch(content) + require.NotNil(t, m, "field %q not found in content", field) + return m[1] +} + +// TestEmitSRSchemas_Deterministic verifies two calls with fresh equivalent +// tagmaps produce byte-identical output. +func TestEmitSRSchemas_Deterministic(t *testing.T) { + s := loadFixture(t) + + f1, err := gen.EmitSRSchemas(s, srClasses, tagmap.New(), "1.8.0") + require.NoError(t, err) + f2, err := gen.EmitSRSchemas(s, srClasses, tagmap.New(), "1.8.0") + require.NoError(t, err) + + require.Equal(t, len(f1), len(f2)) + for i := range f1 { + require.Equal(t, f1[i].Path, f2[i].Path) + require.Equal(t, f1[i].Content, f2[i].Content) + } +} + +// TestEmitSRSchemas_UnknownClass verifies a non-existent class errors. +func TestEmitSRSchemas_UnknownClass(t *testing.T) { + s := loadFixture(t) + _, err := gen.EmitSRSchemas(s, []string{"nonexistent_class_xyz"}, tagmap.New(), "1.8.0") + require.Error(t, err) + require.Contains(t, err.Error(), "nonexistent_class_xyz") +} + +// TestEmitSRSchemas_HeaderShape verifies the shared header lines. +func TestEmitSRSchemas_HeaderShape(t *testing.T) { + s := loadFixture(t) + files, err := gen.EmitSRSchemas(s, []string{"api_activity"}, tagmap.New(), "1.8.0") + require.NoError(t, err) + require.Len(t, files, 1) + c := files[0].Content + require.True(t, strings.HasPrefix(c, "// Code generated by ocsf-protogen. DO NOT EDIT.\n")) + require.Contains(t, c, "// Source: OCSF schema 1.8.0") + require.Contains(t, c, `syntax = "proto3";`) +} diff --git a/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml index 5e2f6a2..3c34751 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml +++ b/ocsf/internal/ocsf/gen/testdata/golden/buf.yaml @@ -1,6 +1,12 @@ version: v2 modules: - path: . + # The self-contained Schema-Registry schemas under sr/ intentionally inline + # the same messages as ocsf/v1/*.proto in the same package. They are not part + # of the buf module: excluding them avoids duplicate-symbol collisions and + # keeps each .sr.proto a standalone artifact for direct SR registration. + excludes: + - sr deps: - buf.build/bufbuild/protovalidate lint: diff --git a/ocsf/internal/ocsf/gen/testdata/golden/sr/api_activity.sr.proto b/ocsf/internal/ocsf/gen/testdata/golden/sr/api_activity.sr.proto new file mode 100644 index 0000000..8ba3cc6 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/sr/api_activity.sr.proto @@ -0,0 +1,2614 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "google/protobuf/struct.proto"; + +message ApiActivity { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + string action = 1; + ActionId action_id = 2; + ActivityId activity_id = 3; + string activity_name = 4; + Actor actor = 5; + AiModel ai_model = 6; + Api api = 7; + repeated Attack attacks = 8; + repeated Authorization authorizations = 9; + string category_name = 10; + CategoryUid category_uid = 11; + string class_name = 12; + ClassUid class_uid = 13; + Cloud cloud = 14; + string confidence = 15; + ConfidenceId confidence_id = 16; + int32 confidence_score = 17; + int32 count = 18; + Device device = 19; + string disposition = 20; + DispositionId disposition_id = 21; + NetworkEndpoint dst_endpoint = 22; + int64 duration = 23; + int64 end_time = 24; + string end_time_dt = 25; + repeated Enrichment enrichments = 26; + FirewallRule firewall_rule = 27; + HttpRequest http_request = 28; + HttpResponse http_response = 29; + bool is_alert = 30; + repeated Malware malware = 31; + MalwareScanInfo malware_scan_info = 32; + string message = 33; + MessageContext message_context = 34; + Metadata metadata = 35; + repeated Observable observables = 36; + repeated Osint osint = 37; + Policy policy = 38; + string raw_data = 39; + Fingerprint raw_data_hash = 40; + int64 raw_data_size = 41; + repeated ResourceDetails resources = 42; + string risk_details = 43; + string risk_level = 44; + RiskLevelId risk_level_id = 45; + int32 risk_score = 46; + string severity = 47; + SeverityId severity_id = 48; + NetworkEndpoint src_endpoint = 49; + int64 start_time = 50; + string start_time_dt = 51; + string status = 52; + string status_code = 53; + string status_detail = 54; + StatusId status_id = 55; + int64 time = 56; + string time_dt = 57; + int32 timezone_offset = 58; + Trace trace = 59; + string type_name = 60; + TypeUid type_uid = 61; + google.protobuf.Value unmapped = 62; +} + +message Account { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + bool is_disabled = 1; + bool is_locked = 2; + bool is_on_premises_sync_enabled = 3; + repeated string labels = 4; + string name = 5; + repeated KeyValueObject tags = 6; + string type = 7; + TypeId type_id = 8; + string uid = 9; +} + +message Actor { + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20; +} + +message Agent { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message AiModel { + string ai_provider = 1; + string name = 2; + string uid = 3; + string version = 4; +} + +message Analytic { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2; + Request request = 3; + Response response = 4; + Service service = 5; + Token token = 6; + string version = 7; +} + +message Application { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + string criticality = 1; + google.protobuf.Value data = 2; + string desc = 3; + Group group = 4; + string hostname = 5; + repeated string labels = 6; + string name = 7; + User owner = 8; + string region = 9; + Graph resource_relationship = 10; + string risk_level = 11; + RiskLevelId risk_level_id = 12; + int32 risk_score = 13; + Sbom sbom = 14; + repeated KeyValueObject tags = 15; + string type = 16; + string uid = 17; + string uid_alt = 18; + Url url = 19; + string version = 20; +} + +message Attack { + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7; + repeated San sans = 8; + string serial_number = 9; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5; + string region = 6; + string zone = 7; +} + +message Container { + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16; +} + +message Cvss { + double base_score = 1; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string mac_vendor = 38; + string meid = 39; + string model = 40; + int64 modified_time = 41; + string modified_time_dt = 42; + string name = 43; + int32 namespace_pid = 44; + repeated NetworkInterface network_interfaces = 45; + Organization org = 46; + Os os = 47; + string os_machine_uuid = 48; + User owner = 49; + Group pool = 50; + string region = 51; + string risk_level = 52; + RiskLevelId risk_level_id = 53; + int32 risk_score = 54; + string subnet = 55; + string subnet_uid = 56; + string type = 57; + TypeId type_id = 58; + string udid = 59; + string uid = 60; + string uid_alt = 61; + string vendor_name = 62; + string vlan_uid = 63; + string vpc_uid = 64; + string zone = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + int32 gpu_count = 13; + repeated GpuInfo gpu_info_list = 14; + KeyboardInfo keyboard_info = 15; + int32 ram_size = 16; + string serial_number = 17; + string uuid = 18; + string vendor_name = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6; + string uid = 7; +} + +message Edge { + google.protobuf.Value data = 1; + bool is_directed = 2; + string name = 3; + string relation = 4; + string source = 5; + string target = 6; + string uid = 7; +} + +message Email { + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3; + string desc = 4; + string name = 5; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11; +} + +message EnvironmentVariable { + string name = 1; + string value = 2; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4; + string version = 5; +} + +message Extension { + string name = 1; + string uid = 2; + string version = 3; +} + +message Feature { + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + repeated string imported_symbols = 19; + string internal_name = 20; + bool is_deleted = 21; + bool is_encrypted = 22; + bool is_public = 23; + bool is_readonly = 24; + bool is_system = 25; + string mime_type = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + User modifier = 29; + string name = 30; + User owner = 31; + string parent_folder = 32; + string path = 33; + Product product = 34; + string security_descriptor = 35; + DigitalSignature signature = 36; + repeated DigitalSignature signatures = 37; + int64 size = 38; + string storage_class = 39; + repeated KeyValueObject tags = 40; + string type = 41; + TypeId type_id = 42; + string uid = 43; + string uri = 44; + Url url = 45; + string version = 46; + string volume = 47; + google.protobuf.Value xattributes = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + string value = 3; +} + +message FirewallRule { + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Graph { + enum QueryLanguageId { + QUERY_LANGUAGE_ID_UNKNOWN = 0; + QUERY_LANGUAGE_ID_CYPHER = 1; + QUERY_LANGUAGE_ID_GRAPHQL = 2; + QUERY_LANGUAGE_ID_GREMLIN = 3; + QUERY_LANGUAGE_ID_GQL = 4; + QUERY_LANGUAGE_ID_G_CORE = 5; + QUERY_LANGUAGE_ID_PGQL = 6; + QUERY_LANGUAGE_ID_SPARQL = 7; + QUERY_LANGUAGE_ID_OTHER = 99; + } + string desc = 1; + repeated Edge edges = 2; + bool is_directed = 3; + string name = 4; + repeated Node nodes = 5; + string query_language = 6; + QueryLanguageId query_language_id = 7; + string type = 8; + string uid = 9; +} + +message Group { + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1; + string value = 2; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6; +} + +message KbArticle { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + string name = 1; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string department = 6; + string display_name = 7; + repeated string email_addrs = 8; + string employee_uid = 9; + string given_name = 10; + int64 hire_time = 11; + string hire_time_dt = 12; + string job_title = 13; + repeated string labels = 14; + int64 last_login_time = 15; + string last_login_time_dt = 16; + string ldap_cn = 17; + string ldap_dn = 18; + int64 leave_time = 19; + string leave_time_dt = 20; + Location location = 21; + User manager = 22; + int64 modified_time = 23; + string modified_time_dt = 24; + string office_location = 25; + string phone_number = 26; + string surname = 27; + repeated KeyValueObject tags = 28; +} + +message Location { + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3; +} + +message Malware { + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + int32 unique_malware_count = 13; +} + +message MessageContext { + enum AiRoleId { + AI_ROLE_ID_UNKNOWN = 0; + AI_ROLE_ID_USER = 1; + AI_ROLE_ID_ASSISTANT = 2; + AI_ROLE_ID_TOOL = 3; + AI_ROLE_ID_AGENT = 4; + AI_ROLE_ID_ORCHESTRATOR = 5; + AI_ROLE_ID_RETRIEVER = 6; + AI_ROLE_ID_OTHER = 99; + } + string ai_role = 1; + AiRoleId ai_role_id = 2; + Application application = 3; + int32 completion_tokens = 4; + string name = 5; + int32 prompt_tokens = 6; + Service service = 7; + int32 total_tokens = 8; + string uid = 9; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + Timespan total_queued_duration = 32; + repeated TransformationInfo transformation_info_list = 33; + int64 transmit_time = 34; + string transmit_time_dt = 35; + string type = 36; + string uid = 37; + int32 untruncated_size = 38; + string version = 39; +} + +message Metric { + string name = 1; + string value = 2; +} + +message Mitigation { + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message NetworkInterface { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message Node { + google.protobuf.Value data = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17; +} + +message Policy { + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1; + string provider = 2; + string score = 3; + ScoreId score_id = 4; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4; +} + +message ResourceDetails { + enum RoleId { + ROLE_ID_UNKNOWN = 0; + ROLE_ID_TARGET = 1; + ROLE_ID_ACTOR = 2; + ROLE_ID_AFFECTED = 3; + ROLE_ID_RELATED = 4; + ROLE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string cloud_partition = 2; + int64 created_time = 3; + string created_time_dt = 4; + string criticality = 5; + google.protobuf.Value data = 6; + DataClassification data_classification = 7; + repeated DataClassification data_classifications = 8; + Group group = 9; + string hostname = 10; + string ip = 11; + bool is_backed_up = 12; + repeated string labels = 13; + int64 modified_time = 14; + string modified_time_dt = 15; + string name = 16; + string namespace = 17; + User owner = 18; + string provider = 19; + string region = 20; + Graph resource_relationship = 21; + string role = 22; + RoleId role_id = 23; + repeated KeyValueObject tags = 24; + string type = 25; + string uid = 26; + string uid_alt = 27; + string version = 28; + string zone = 29; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1; + string type = 2; +} + +message Sbom { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SPDX = 1; + TYPE_ID_CYCLONEDX = 2; + TYPE_ID_SWID = 3; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + Package package = 3; + Product product = 4; + repeated SoftwareComponent software_components = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; + string version = 9; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; +} + +message Service { + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message SoftwareComponent { + enum RelationshipId { + RELATIONSHIP_ID_UNKNOWN = 0; + RELATIONSHIP_ID_DEPENDS_ON = 1; + RELATIONSHIP_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_FRAMEWORK = 1; + TYPE_ID_LIBRARY = 2; + TYPE_ID_OPERATING_SYSTEM = 3; + TYPE_ID_OTHER = 99; + } + string author = 1; + Fingerprint hash = 2; + string license = 3; + string name = 4; + string purl = 5; + string related_component = 6; + string relationship = 7; + RelationshipId relationship_id = 8; + string type = 9; + TypeId type_id = 10; + string version = 11; +} + +message Span { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + string message = 4; + string operation = 5; + string parent_uid = 6; + Service service = 7; + int64 start_time = 8; + string start_time_dt = 9; + string status_code = 10; + string uid = 11; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message Trace { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + repeated string flags = 4; + Service service = 5; + Span span = 6; + int64 start_time = 7; + string start_time_dt = 8; + string uid = 9; +} + +message TransformationInfo { + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden/sr/entity_management.sr.proto b/ocsf/internal/ocsf/gen/testdata/golden/sr/entity_management.sr.proto new file mode 100644 index 0000000..86371a7 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden/sr/entity_management.sr.proto @@ -0,0 +1,2447 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "google/protobuf/struct.proto"; + +message EntityManagement { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum ActivityId { + ACTIVITY_ID_UNKNOWN = 0; + ACTIVITY_ID_CREATE = 1; + ACTIVITY_ID_READ = 2; + ACTIVITY_ID_UPDATE = 3; + ACTIVITY_ID_DELETE = 4; + ACTIVITY_ID_MOVE = 5; + ACTIVITY_ID_ENROLL = 6; + ACTIVITY_ID_UNENROLL = 7; + ACTIVITY_ID_ENABLE = 8; + ACTIVITY_ID_DISABLE = 9; + ACTIVITY_ID_ACTIVATE = 10; + ACTIVITY_ID_DEACTIVATE = 11; + ACTIVITY_ID_SUSPEND = 12; + ACTIVITY_ID_RESUME = 13; + ACTIVITY_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + ActivityId activity_id = 5; + string activity_name = 6; + Actor actor = 7; + Api api = 8; + repeated Attack attacks = 9; + repeated Authorization authorizations = 10; + string category_name = 11; + CategoryUid category_uid = 12; + string class_name = 13; + ClassUid class_uid = 14; + Cloud cloud = 15; + string comment = 16; + string confidence = 17; + ConfidenceId confidence_id = 18; + int32 confidence_score = 19; + int32 count = 20; + Device device = 21; + string disposition = 22; + DispositionId disposition_id = 23; + int64 duration = 24; + int64 end_time = 25; + string end_time_dt = 26; + repeated Enrichment enrichments = 27; + ManagedEntity entity = 28; + ManagedEntity entity_result = 29; + FirewallRule firewall_rule = 30; + HttpRequest http_request = 31; + HttpResponse http_response = 32; + bool is_alert = 33; + repeated Malware malware = 34; + MalwareScanInfo malware_scan_info = 35; + string message = 36; + Metadata metadata = 37; + repeated Observable observables = 38; + repeated Osint osint = 39; + Policy policy = 40; + string raw_data = 41; + Fingerprint raw_data_hash = 42; + int64 raw_data_size = 43; + string risk_details = 44; + string risk_level = 45; + RiskLevelId risk_level_id = 46; + int32 risk_score = 47; + string severity = 48; + SeverityId severity_id = 49; + NetworkEndpoint src_endpoint = 50; + int64 start_time = 51; + string start_time_dt = 52; + string status = 53; + string status_code = 54; + string status_detail = 55; + StatusId status_id = 56; + int64 time = 57; + string time_dt = 58; + int32 timezone_offset = 59; + string type_name = 60; + TypeUid type_uid = 61; + google.protobuf.Value unmapped = 62; +} + +message Account { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + bool is_disabled = 1; + bool is_locked = 2; + bool is_on_premises_sync_enabled = 3; + repeated string labels = 4; + string name = 5; + repeated KeyValueObject tags = 6; + string type = 7; + TypeId type_id = 8; + string uid = 9; +} + +message Actor { + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20; +} + +message Agent { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message Analytic { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2; + Request request = 3; + Response response = 4; + Service service = 5; + Token token = 6; + string version = 7; +} + +message Attack { + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7; + repeated San sans = 8; + string serial_number = 9; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5; + string region = 6; + string zone = 7; +} + +message Container { + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16; +} + +message Cvss { + double base_score = 1; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string mac_vendor = 38; + string meid = 39; + string model = 40; + int64 modified_time = 41; + string modified_time_dt = 42; + string name = 43; + int32 namespace_pid = 44; + repeated NetworkInterface network_interfaces = 45; + Organization org = 46; + Os os = 47; + string os_machine_uuid = 48; + User owner = 49; + Group pool = 50; + string region = 51; + string risk_level = 52; + RiskLevelId risk_level_id = 53; + int32 risk_score = 54; + string subnet = 55; + string subnet_uid = 56; + string type = 57; + TypeId type_id = 58; + string udid = 59; + string uid = 60; + string uid_alt = 61; + string vendor_name = 62; + string vlan_uid = 63; + string vpc_uid = 64; + string zone = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + int32 gpu_count = 13; + repeated GpuInfo gpu_info_list = 14; + KeyboardInfo keyboard_info = 15; + int32 ram_size = 16; + string serial_number = 17; + string uuid = 18; + string vendor_name = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6; + string uid = 7; +} + +message Email { + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3; + string desc = 4; + string name = 5; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11; +} + +message EnvironmentVariable { + string name = 1; + string value = 2; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4; + string version = 5; +} + +message Extension { + string name = 1; + string uid = 2; + string version = 3; +} + +message Feature { + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + repeated string imported_symbols = 19; + string internal_name = 20; + bool is_deleted = 21; + bool is_encrypted = 22; + bool is_public = 23; + bool is_readonly = 24; + bool is_system = 25; + string mime_type = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + User modifier = 29; + string name = 30; + User owner = 31; + string parent_folder = 32; + string path = 33; + Product product = 34; + string security_descriptor = 35; + DigitalSignature signature = 36; + repeated DigitalSignature signatures = 37; + int64 size = 38; + string storage_class = 39; + repeated KeyValueObject tags = 40; + string type = 41; + TypeId type_id = 42; + string uid = 43; + string uri = 44; + Url url = 45; + string version = 46; + string volume = 47; + google.protobuf.Value xattributes = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + string value = 3; +} + +message FirewallRule { + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Group { + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1; + string value = 2; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6; +} + +message KbArticle { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + string name = 1; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string department = 6; + string display_name = 7; + repeated string email_addrs = 8; + string employee_uid = 9; + string given_name = 10; + int64 hire_time = 11; + string hire_time_dt = 12; + string job_title = 13; + repeated string labels = 14; + int64 last_login_time = 15; + string last_login_time_dt = 16; + string ldap_cn = 17; + string ldap_dn = 18; + int64 leave_time = 19; + string leave_time_dt = 20; + Location location = 21; + User manager = 22; + int64 modified_time = 23; + string modified_time_dt = 24; + string office_location = 25; + string phone_number = 26; + string surname = 27; + repeated KeyValueObject tags = 28; +} + +message Location { + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3; +} + +message Malware { + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + int32 unique_malware_count = 13; +} + +message ManagedEntity { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_DEVICE = 1; + TYPE_ID_USER = 2; + TYPE_ID_GROUP = 3; + TYPE_ID_ORGANIZATION = 4; + TYPE_ID_POLICY = 5; + TYPE_ID_EMAIL = 6; + TYPE_ID_NETWORK_ZONE = 7; + TYPE_ID_OTHER = 99; + } + google.protobuf.Value data = 1; + Device device = 2; + Email email = 3; + Group group = 4; + Location location = 5; + string name = 6; + Organization org = 7; + Policy policy = 8; + string type = 9; + TypeId type_id = 10; + string uid = 11; + User user = 12; + string version = 13; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + Timespan total_queued_duration = 32; + repeated TransformationInfo transformation_info_list = 33; + int64 transmit_time = 34; + string transmit_time_dt = 35; + string type = 36; + string uid = 37; + int32 untruncated_size = 38; + string version = 39; +} + +message Metric { + string name = 1; + string value = 2; +} + +message Mitigation { + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message NetworkInterface { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17; +} + +message Policy { + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1; + string provider = 2; + string score = 3; + ScoreId score_id = 4; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1; + string type = 2; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; +} + +message Service { + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message TransformationInfo { + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + From fbdaa001478f9d0b17a62301c836ff17ce6bf1e0 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:23:54 +0200 Subject: [PATCH 12/26] feat(ocsf): merge event classes into one flat attribute set A single audit-log topic needs ONE message covering every selected class, not one message per class. MergeClasses unions the attribute maps of N classes into a single flat definition, the schema-level half of the merged single-event layout. Merge rules per attribute name: - Type, object type, and is_array must agree across every declaring class; a mismatch is a hard generation error since the proto field type would otherwise depend on class selection. - Integer-keyed enums union by value. When the same numeric value carries different captions in two classes (a class-scoped enum), the attribute is demoted to its plain scalar type instead of failing: OCSF defines such semantics via the (class_uid, value) pair, which the merged message keeps. Enum-presence and key-kind mismatches demote too. - activity_id is demoted unconditionally. Its values genuinely collide across OCSF classes (1 = Create in api_activity, Logon in authentication, Assign Privileges in group_management), and demoting it later would break generated-code consumers, so it is int32 from day one; readable per-class names live in the disjoint-by-construction TypeUid union. - Requirement merges to "required" only when required in EVERY class; a blanket annotation would wrongly reject events of classes that do not use the attribute. Per-class requiredness becomes gated CEL in the emitter. The returned Merged also carries per-attribute owner classes, feeding the emitter's class-ownership validation. Co-Authored-By: Claude Fable 5 --- ocsf/internal/ocsf/gen/merge.go | 273 +++++++++++++++++++++++++++ ocsf/internal/ocsf/gen/merge_test.go | 228 ++++++++++++++++++++++ 2 files changed, 501 insertions(+) create mode 100644 ocsf/internal/ocsf/gen/merge.go create mode 100644 ocsf/internal/ocsf/gen/merge_test.go diff --git a/ocsf/internal/ocsf/gen/merge.go b/ocsf/internal/ocsf/gen/merge.go new file mode 100644 index 0000000..4791828 --- /dev/null +++ b/ocsf/internal/ocsf/gen/merge.go @@ -0,0 +1,273 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen + +import ( + "errors" + "fmt" + "sort" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +// requirementRequired is the OCSF requirement level that maps to a +// protovalidate required annotation. +const requirementRequired = "required" + +// forcedScalarAttrs lists attributes that are ALWAYS emitted as plain scalars +// in a merged message, never as a nested enum, regardless of whether the +// selected classes happen to merge cleanly today. +// +// activity_id is class-scoped by OCSF design: the same numeric value means +// different things in different classes (1 = Create in api_activity but +// Logon in authentication). Emitting a merged enum for it would be wrong the +// moment a conflicting class is selected, and switching an already-emitted +// enum field to int32 later is wire-compatible but breaks generated-code +// consumers. So it is int32 from day one; the per-class semantics live in +// the (class_uid, activity_id) pair and the TypeUid enum. +var forcedScalarAttrs = map[string]bool{ + "activity_id": true, +} + +// Merged is the result of unioning the attributes of several OCSF classes +// into a single flat proto message definition. +type Merged struct { + // Name is the proto message name for the merged event (e.g. "AuditEvent"). + Name string + + // Classes holds the selected classes, sorted by name. + Classes []schema.Class + + // Attributes is the merged attribute map. Enum-valued attributes carry the + // union of enum members across all owning classes; demoted attributes have + // their Enum cleared so the emitter falls back to the plain scalar type. + Attributes map[string]*schema.Attribute + + // Owners maps each attribute name to the sorted names of the classes that + // declare it. Attributes owned by every selected class (the base_event + // set) have len(Owners[a]) == len(Classes). + Owners map[string][]string + + // Demoted lists (sorted) the attribute names that were demoted from a + // nested enum to a plain scalar, either because they are in + // forcedScalarAttrs or because their enum value sets conflict across the + // selected classes. + Demoted []string +} + +// MergeClasses unions the attribute maps of the named classes into a single +// flat message definition suitable for a one-topic event stream. +// +// Merge rules per attribute name: +// +// - Type, ObjectType, and IsArray must agree across every class that +// declares the attribute; any mismatch is a hard error (it would change +// the proto field type depending on class selection). +// +// - Integer-keyed enums merge by value union. If the same numeric value +// maps to different captions in two classes (a class-scoped enum such as +// activity_id), the attribute is demoted to its plain scalar type instead +// of failing: OCSF defines such semantics via the (class_uid, value) +// pair, which the merged message preserves. If one class declares an enum +// and another declares none for the same attribute, the attribute is +// demoted too. +// +// - Attributes in forcedScalarAttrs are demoted unconditionally so their +// emitted type never changes when classes are added. +// +// - Requirement is "required" only when EVERY selected class declares the +// attribute as required. Anything weaker becomes "recommended": a blanket +// proto-level required annotation would wrongly reject events of classes +// that do not use the attribute. Per-class requiredness is enforced with +// class_uid-gated CEL by the emitter. +// +// The returned Merged is deterministic for a given schema and class set. +func MergeClasses(s *schema.Schema, classNames []string, msgName string) (*Merged, error) { + if msgName == "" { + return nil, errors.New("ocsf merge: merged message name must not be empty") + } + + classes := make([]schema.Class, 0, len(classNames)) + for _, name := range classNames { + cls, ok := s.Classes[name] + if !ok { + return nil, fmt.Errorf("ocsf merge: class %q not found in schema", name) + } + classes = append(classes, *cls) + } + if len(classes) == 0 { + return nil, errors.New("ocsf merge: at least one class is required") + } + sort.Slice(classes, func(i, j int) bool { return classes[i].Name < classes[j].Name }) + + merged := make(map[string]*schema.Attribute) + owners := make(map[string][]string) + demoted := make(map[string]bool) + + for _, cls := range classes { + attrNames := sortedKeys(cls.Attributes) + for _, attrName := range attrNames { + attr := cls.Attributes[attrName] + owners[attrName] = append(owners[attrName], cls.Name) + + existing, seen := merged[attrName] + if !seen { + cp := *attr + merged[attrName] = &cp + continue + } + + if err := checkAttrShape(attrName, existing, attr, cls.Name); err != nil { + return nil, err + } + + union, conflict := unionEnumMembers(existing.Enum, attr.Enum) + if conflict { + demoted[attrName] = true + } + existing.Enum = union + } + } + + // Apply forced and conflict demotions: clearing Enum makes the emitter + // fall back to the attribute's plain scalar type (int32 for integer_t). + for name, attr := range merged { + if forcedScalarAttrs[name] { + demoted[name] = true + } + if demoted[name] { + attr.Enum = nil + } + } + + // Merge requirement: required only when required in every selected class. + for name, attr := range merged { + attr.Requirement = mergedRequirement(name, classes) + } + + for name := range owners { + sort.Strings(owners[name]) + } + + demotedNames := make([]string, 0, len(demoted)) + for name := range demoted { + demotedNames = append(demotedNames, name) + } + sort.Strings(demotedNames) + + return &Merged{ + Name: msgName, + Classes: classes, + Attributes: merged, + Owners: owners, + Demoted: demotedNames, + }, nil +} + +// checkAttrShape verifies that two class-level definitions of the same +// attribute agree on everything that determines the proto field type. +func checkAttrShape(name string, a, b *schema.Attribute, bClass string) error { + if a.Type != b.Type { + return fmt.Errorf("ocsf merge: attribute %q: type %q conflicts with %q in class %q", + name, a.Type, b.Type, bClass) + } + if a.ObjectType != b.ObjectType { + return fmt.Errorf("ocsf merge: attribute %q: object type %q conflicts with %q in class %q", + name, a.ObjectType, b.ObjectType, bClass) + } + if a.IsArray != b.IsArray { + return fmt.Errorf("ocsf merge: attribute %q: is_array %v conflicts with %v in class %q", + name, a.IsArray, b.IsArray, bClass) + } + return nil +} + +// unionEnumMembers merges two enum member slices by key, returning the sorted +// union and whether a semantic conflict was found. +// +// A conflict is any of: +// - the same integer key mapping to different captions in a and b, +// - exactly one side having enum members at all (presence mismatch), or +// - mixed key kinds (one side integer-keyed, the other string-keyed). +// +// String-keyed enums are unioned by StrKey with the same caption rule; they +// emit as plain proto strings either way, but a caption conflict still means +// the value semantics are class-scoped, so the caller records the demotion. +func unionEnumMembers(a, b []schema.EnumMember) (union []schema.EnumMember, conflict bool) { + if len(a) == 0 && len(b) == 0 { + return nil, false + } + // Presence mismatch: one class constrains values, the other doesn't. + if (len(a) == 0) != (len(b) == 0) { + if len(a) == 0 { + return b, true + } + return a, true + } + // Kind mismatch. + if a[0].IntKey != b[0].IntKey { + return a, true + } + + key := func(m schema.EnumMember) string { + if m.IntKey { + return fmt.Sprintf("i:%d", m.Key) + } + return "s:" + m.StrKey + } + + byKey := make(map[string]schema.EnumMember, len(a)+len(b)) + for _, m := range a { + byKey[key(m)] = m + } + for _, m := range b { + if prev, ok := byKey[key(m)]; ok { + if prev.Caption != m.Caption { + conflict = true + } + continue + } + byKey[key(m)] = m + } + + union = make([]schema.EnumMember, 0, len(byKey)) + for _, m := range byKey { + union = append(union, m) + } + sort.Slice(union, func(i, j int) bool { + if union[i].IntKey { + return union[i].Key < union[j].Key + } + return union[i].StrKey < union[j].StrKey + }) + return union, conflict +} + +// mergedRequirement returns "required" when every selected class declares the +// attribute with requirement "required"; otherwise "recommended". +func mergedRequirement(attrName string, classes []schema.Class) string { + for _, cls := range classes { + attr, ok := cls.Attributes[attrName] + if !ok || attr.Requirement != requirementRequired { + return "recommended" + } + } + return requirementRequired +} + +// sortedKeys returns the sorted keys of an attribute map. +func sortedKeys(m map[string]*schema.Attribute) []string { + keys := make([]string, 0, len(m)) + for k := range m { + keys = append(keys, k) + } + sort.Strings(keys) + return keys +} diff --git a/ocsf/internal/ocsf/gen/merge_test.go b/ocsf/internal/ocsf/gen/merge_test.go new file mode 100644 index 0000000..b75c075 --- /dev/null +++ b/ocsf/internal/ocsf/gen/merge_test.go @@ -0,0 +1,228 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" +) + +// mergedClasses is the class selection used across the merged-event tests. +var mergedClasses = []string{"api_activity", "entity_management"} + +// TestMergeClasses_CleanUnion merges api_activity + entity_management (which +// have no semantic conflicts in OCSF 1.8.0) and verifies the union shape. +func TestMergeClasses_CleanUnion(t *testing.T) { + s := loadFixture(t) + + m, err := gen.MergeClasses(s, mergedClasses, "AuditEvent") + require.NoError(t, err) + + require.Equal(t, "AuditEvent", m.Name) + require.Len(t, m.Classes, 2) + require.Equal(t, "api_activity", m.Classes[0].Name) + require.Equal(t, "entity_management", m.Classes[1].Name) + + // Union: every attribute of both classes is present exactly once. + for _, cls := range m.Classes { + for name := range cls.Attributes { + require.Contains(t, m.Attributes, name, "attribute %q from class %q missing from merge", name, cls.Name) + } + } + + // Owners: base_event attributes are owned by both classes; class-specific + // ones by exactly one. Note api is declared by BOTH classes (required in + // api_activity, optional in entity_management). + require.Equal(t, []string{"api_activity", "entity_management"}, m.Owners["metadata"]) + require.Equal(t, []string{"api_activity", "entity_management"}, m.Owners["api"]) + require.Equal(t, []string{"api_activity"}, m.Owners["trace"]) + require.Equal(t, []string{"entity_management"}, m.Owners["entity"]) +} + +// TestMergeClasses_ActivityIDAlwaysDemoted verifies the forced demotion: +// activity_id is a plain scalar even when the selected classes happen to merge +// cleanly (entity_management's enum is a strict superset of api_activity's). +func TestMergeClasses_ActivityIDAlwaysDemoted(t *testing.T) { + s := loadFixture(t) + + m, err := gen.MergeClasses(s, mergedClasses, "AuditEvent") + require.NoError(t, err) + + require.Contains(t, m.Demoted, "activity_id") + require.Empty(t, m.Attributes["activity_id"].Enum, "demoted attribute must have no enum members") +} + +// TestMergeClasses_ConflictingEnumDemotes verifies that a class-scoped enum +// whose values collide across classes is demoted rather than merged or failed. +// api_activity says activity_id 1 = Create; authentication says 1 = Logon. +// Beyond the forced activity_id case, this exercises the conflict-detection +// path with a synthetic attribute. +func TestMergeClasses_ConflictingEnumDemotes(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "verdict_id": {Name: "verdict_id", Type: "integer_t", Enum: []schema.EnumMember{ + {Key: 0, IntKey: true, Caption: "Unknown"}, + {Key: 1, IntKey: true, Caption: "Pass"}, + }}, + }, + map[string]*schema.Attribute{ + "verdict_id": {Name: "verdict_id", Type: "integer_t", Enum: []schema.EnumMember{ + {Key: 0, IntKey: true, Caption: "Unknown"}, + {Key: 1, IntKey: true, Caption: "Fail"}, // same key, different meaning + }}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.Contains(t, m.Demoted, "verdict_id") + require.Empty(t, m.Attributes["verdict_id"].Enum) +} + +// TestMergeClasses_EnumSupersetUnions verifies that non-conflicting enums +// union: shared values agree, extra values are kept. +func TestMergeClasses_EnumSupersetUnions(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "state_id": {Name: "state_id", Type: "integer_t", Enum: []schema.EnumMember{ + {Key: 0, IntKey: true, Caption: "Unknown"}, + {Key: 1, IntKey: true, Caption: "Active"}, + }}, + }, + map[string]*schema.Attribute{ + "state_id": {Name: "state_id", Type: "integer_t", Enum: []schema.EnumMember{ + {Key: 0, IntKey: true, Caption: "Unknown"}, + {Key: 1, IntKey: true, Caption: "Active"}, + {Key: 2, IntKey: true, Caption: "Suspended"}, + }}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.NotContains(t, m.Demoted, "state_id") + require.Len(t, m.Attributes["state_id"].Enum, 3) +} + +// TestMergeClasses_EnumPresenceMismatchDemotes verifies that an attribute with +// an enum in one class and none in another is demoted. +func TestMergeClasses_EnumPresenceMismatchDemotes(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "state_id": {Name: "state_id", Type: "integer_t", Enum: []schema.EnumMember{ + {Key: 0, IntKey: true, Caption: "Unknown"}, + }}, + }, + map[string]*schema.Attribute{ + "state_id": {Name: "state_id", Type: "integer_t"}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.Contains(t, m.Demoted, "state_id") +} + +// TestMergeClasses_TypeMismatchErrors verifies that the same attribute name +// with different OCSF types across classes is a hard error. +func TestMergeClasses_TypeMismatchErrors(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "payload": {Name: "payload", Type: "string_t"}, + }, + map[string]*schema.Attribute{ + "payload": {Name: "payload", Type: "integer_t"}, + }, + ) + + _, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.ErrorContains(t, err, `attribute "payload"`) + require.ErrorContains(t, err, "conflicts") +} + +// TestMergeClasses_RequiredOnlyWhenRequiredEverywhere verifies the requirement +// merge rule with the real schema: metadata is required in both classes, actor +// is required only in api_activity. +func TestMergeClasses_RequiredOnlyWhenRequiredEverywhere(t *testing.T) { + s := loadFixture(t) + + m, err := gen.MergeClasses(s, mergedClasses, "AuditEvent") + require.NoError(t, err) + + require.Equal(t, "required", m.Attributes["metadata"].Requirement) + require.Equal(t, "required", m.Attributes["class_uid"].Requirement) + // actor: required in api_activity, weaker in entity_management. + require.Equal(t, "recommended", m.Attributes["actor"].Requirement) + // api: required in api_activity, absent from entity_management. + require.Equal(t, "recommended", m.Attributes["api"].Requirement) +} + +// TestMergeClasses_UnknownClass verifies the error for a class missing from +// the schema. +func TestMergeClasses_UnknownClass(t *testing.T) { + s := loadFixture(t) + _, err := gen.MergeClasses(s, []string{"api_activity", "no_such_class"}, "AuditEvent") + require.ErrorContains(t, err, `"no_such_class"`) +} + +// TestMergeClasses_ClassUIDUnion verifies the class_uid / category_uid / +// type_uid enums union disjoint values from every class. +func TestMergeClasses_ClassUIDUnion(t *testing.T) { + s := loadFixture(t) + + m, err := gen.MergeClasses(s, mergedClasses, "AuditEvent") + require.NoError(t, err) + + classUIDs := enumKeys(m.Attributes["class_uid"].Enum) + require.Contains(t, classUIDs, 6003) + require.Contains(t, classUIDs, 3004) + + catUIDs := enumKeys(m.Attributes["category_uid"].Enum) + require.Contains(t, catUIDs, 6) + require.Contains(t, catUIDs, 3) + + typeUIDs := enumKeys(m.Attributes["type_uid"].Enum) + require.Contains(t, typeUIDs, 600301) // API Activity: Create + require.Contains(t, typeUIDs, 300401) // Entity Management: Create +} + +// syntheticSchema builds a minimal two-class schema for merge unit tests. +func syntheticSchema(t *testing.T, alphaAttrs, betaAttrs map[string]*schema.Attribute) *schema.Schema { + t.Helper() + return &schema.Schema{ + Version: "1.8.0", + Classes: map[string]*schema.Class{ + "alpha": {Name: "alpha", UID: 1001, CategoryUID: 1, Attributes: alphaAttrs}, + "beta": {Name: "beta", UID: 1002, CategoryUID: 1, Attributes: betaAttrs}, + }, + Objects: map[string]*schema.Object{}, + Types: map[string]*schema.TypeDef{ + "string_t": {}, + "integer_t": {}, + }, + } +} + +// enumKeys extracts the integer keys of an enum member slice. +func enumKeys(members []schema.EnumMember) []int { + keys := make([]int, 0, len(members)) + for _, m := range members { + keys = append(keys, m.Key) + } + return keys +} From 3f26e164d752e236c63ebc4c55a8cbd9b13ce315 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:24:16 +0200 Subject: [PATCH 13/26] feat(ocsf): emit the merged single-event proto and SR schema EmitMerged turns a MergeClasses result into the single-topic layout: one flat message (e.g. AuditEvent) holding the union of all selected classes' attributes, next to the same shared objects.proto the per-class layout uses (byte-identical: same closure, same tagmap keys). EmitMergedSRSchema emits the one self-contained .sr.proto for the topic, merged message first so it stays at Confluent message-index 0. Class awareness that the per-class layout got from separate message types is regenerated as protovalidate message-level CEL: - type_uid == class_uid * 100 + activity_id (the OCSF invariant that makes the demoted int32 activity_id safe), - ownership gates: attributes owned by a strict subset of classes may only be set when class_uid matches an owner, - per-class conditional requiredness for attributes required by one class but not all (repeated attributes excluded, matching the per-class rule), - per-class at_least_one/just_one constraints, gated on class_uid. emitMessage gains fieldComments (demoted class-scoped enums get an explanatory comment) and extraCEL (pre-rendered option blocks), both suppressed by omitValidate on the SR path; the constraint helpers are refactored to expose expression-level variants for the gated forms. Field numbers are a fresh append-only lineage keyed by the merged message name; a test proves adding a class to the selection never moves an existing tag. Golden output for api_activity + entity_management is committed under testdata/golden-merged and passes buf lint/build. Co-Authored-By: Claude Fable 5 --- ocsf/internal/ocsf/gen/emit.go | 132 +- ocsf/internal/ocsf/gen/emitmerged.go | 387 +++ ocsf/internal/ocsf/gen/emitmerged_test.go | 337 ++ .../ocsf/gen/testdata/golden-merged/buf.lock | 6 + .../ocsf/gen/testdata/golden-merged/buf.yaml | 20 + .../golden-merged/ocsf/v1/audit_event.proto | 261 ++ .../golden-merged/ocsf/v1/objects.proto | 2747 +++++++++++++++++ .../golden-merged/sr/audit_event.sr.proto | 2656 ++++++++++++++++ 8 files changed, 6496 insertions(+), 50 deletions(-) create mode 100644 ocsf/internal/ocsf/gen/emitmerged.go create mode 100644 ocsf/internal/ocsf/gen/emitmerged_test.go create mode 100644 ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock create mode 100644 ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml create mode 100644 ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto create mode 100644 ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/objects.proto create mode 100644 ocsf/internal/ocsf/gen/testdata/golden-merged/sr/audit_event.sr.proto diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go index 10690b9..f94f976 100644 --- a/ocsf/internal/ocsf/gen/emit.go +++ b/ocsf/internal/ocsf/gen/emit.go @@ -163,7 +163,7 @@ func detectImports(s *schema.Schema, classes []schema.Class, objects []schema.Ob if pt.WellKnown == wellKnownValueType { needStructProto = true } - if attr.Requirement == "required" { + if attr.Requirement == requirementRequired { needValidateProto = true } } @@ -462,7 +462,7 @@ func resolveFieldSpec(s *schema.Schema, tm *tagmap.TagMap, msgName, attrName str tag: tag, name: attrName, repeated: pt.Repeated, - required: attr.Requirement == "required", + required: attr.Requirement == requirementRequired, } switch { @@ -499,8 +499,17 @@ func resolveFieldSpec(s *schema.Schema, tm *tagmap.TagMap, msgName, attrName str // (buf.validate.field).required annotation and the message-level // (buf.validate.message).cel constraint blocks. It is set by the SR-schema path, // which emits self-contained schemas that must not depend on buf/validate. +// +// fieldComments maps an attribute name to a single-line comment emitted +// directly above its field declaration. Used by the merged-event path to mark +// demoted class-scoped enums. +// +// extraCEL holds pre-rendered (buf.validate.message).cel option blocks emitted +// after the constraint-derived ones. Suppressed when omitValidate is set. type emitOptions struct { - omitValidate bool + omitValidate bool + fieldComments map[string]string + extraCEL []string } // emitMessage generates one proto message block for the given message name, @@ -544,17 +553,7 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ var sb strings.Builder sb.WriteString("message " + msgName + " {\n") - // Emit constraint CEL options (before nested enums and fields). - if constraints != nil && !opts.omitValidate { - if len(constraints.AtLeastOne) > 0 { - cel := atLeastOneCEL(msgName, constraints.AtLeastOne) - sb.WriteString(cel) - } - if len(constraints.JustOne) > 0 { - cel := justOneCEL(msgName, constraints.JustOne) - sb.WriteString(cel) - } - } + emitMessageCEL(&sb, msgName, constraints, opts) // Emit nested enums. for _, enumName := range enumNames { @@ -562,8 +561,38 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ sb.WriteString(emitEnum(pe)) } - // Emit fields. + emitFields(&sb, fields, opts) + + sb.WriteString("}\n") + return sb.String(), nil +} + +// emitMessageCEL writes the message-level CEL option blocks (constraints +// first, then any pre-rendered extras). Suppressed entirely by omitValidate. +func emitMessageCEL(sb *strings.Builder, msgName string, constraints *schema.Constraints, opts emitOptions) { + if opts.omitValidate { + return + } + if constraints != nil { + if len(constraints.AtLeastOne) > 0 { + sb.WriteString(atLeastOneCEL(msgName, constraints.AtLeastOne)) + } + if len(constraints.JustOne) > 0 { + sb.WriteString(justOneCEL(msgName, constraints.JustOne)) + } + } + for _, cel := range opts.extraCEL { + sb.WriteString(cel) + } +} + +// emitFields writes the field declaration lines (with optional per-field +// comments and required annotations) in the caller-provided order. +func emitFields(sb *strings.Builder, fields []fieldSpec, opts emitOptions) { for _, fs := range fields { + if comment, ok := opts.fieldComments[fs.name]; ok { + sb.WriteString(" // " + comment + "\n") + } line := " " if fs.repeated { line += "repeated " @@ -579,9 +608,6 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ line += ";\n" sb.WriteString(line) } - - sb.WriteString("}\n") - return sb.String(), nil } // emitEnum formats a proto3 nested enum declaration. @@ -595,11 +621,21 @@ func emitEnum(pe ProtoEnum) string { return sb.String() } -// atLeastOneCEL generates a buf.validate CEL option asserting at least one -// of the listed fields is set. -// -// Generated expression: has(this.a) || has(this.b) || has(this.c) -func atLeastOneCEL(msgName string, fields []string) string { +// celOption formats a single (buf.validate.message).cel option block. +func celOption(id, message, expr string) string { + return fmt.Sprintf( + " option (buf.validate.message).cel = {\n"+ + " id: %q,\n"+ + " message: %q,\n"+ + " expression: %q\n"+ + " };\n", + id, message, expr, + ) +} + +// atLeastOneExpr builds the CEL expression asserting at least one of the +// listed fields is set: has(this.a) || has(this.b) || has(this.c) +func atLeastOneExpr(fields []string) (expr, fieldList string) { sorted := make([]string, len(fields)) copy(sorted, fields) sort.Strings(sorted) @@ -608,27 +644,12 @@ func atLeastOneCEL(msgName string, fields []string) string { for i, f := range sorted { parts[i] = "has(this." + f + ")" } - expr := strings.Join(parts, " || ") - fieldList := "[" + strings.Join(sorted, ", ") + "]" - return fmt.Sprintf( - " option (buf.validate.message).cel = {\n"+ - " id: %q,\n"+ - " message: %q,\n"+ - " expression: %q\n"+ - " };\n", - msgName+".at_least_one", - "at least one of "+fieldList+" must be set", - expr, - ) + return strings.Join(parts, " || "), "[" + strings.Join(sorted, ", ") + "]" } -// justOneCEL generates a buf.validate CEL option asserting exactly one of the -// listed fields is set. -// -// Generated expression: -// -// (has(this.a) ? 1 : 0) + (has(this.b) ? 1 : 0) + ... == 1 -func justOneCEL(msgName string, fields []string) string { +// justOneExpr builds the CEL expression asserting exactly one of the listed +// fields is set: (has(this.a) ? 1 : 0) + (has(this.b) ? 1 : 0) + ... == 1 +func justOneExpr(fields []string) (expr, fieldList string) { sorted := make([]string, len(fields)) copy(sorted, fields) sort.Strings(sorted) @@ -637,14 +658,25 @@ func justOneCEL(msgName string, fields []string) string { for i, f := range sorted { parts[i] = "(has(this." + f + ") ? 1 : 0)" } - expr := strings.Join(parts, " + ") + " == 1" - fieldList := "[" + strings.Join(sorted, ", ") + "]" - return fmt.Sprintf( - " option (buf.validate.message).cel = {\n"+ - " id: %q,\n"+ - " message: %q,\n"+ - " expression: %q\n"+ - " };\n", + return strings.Join(parts, " + ") + " == 1", "[" + strings.Join(sorted, ", ") + "]" +} + +// atLeastOneCEL generates a buf.validate CEL option asserting at least one +// of the listed fields is set. +func atLeastOneCEL(msgName string, fields []string) string { + expr, fieldList := atLeastOneExpr(fields) + return celOption( + msgName+".at_least_one", + "at least one of "+fieldList+" must be set", + expr, + ) +} + +// justOneCEL generates a buf.validate CEL option asserting exactly one of the +// listed fields is set. +func justOneCEL(msgName string, fields []string) string { + expr, fieldList := justOneExpr(fields) + return celOption( msgName+".just_one", "exactly one of "+fieldList+" must be set", expr, diff --git a/ocsf/internal/ocsf/gen/emitmerged.go b/ocsf/internal/ocsf/gen/emitmerged.go new file mode 100644 index 0000000..44926cb --- /dev/null +++ b/ocsf/internal/ocsf/gen/emitmerged.go @@ -0,0 +1,387 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen + +import ( + "fmt" + "sort" + "strings" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/schema" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// demotedComment is emitted above every field demoted from a nested enum to a +// plain scalar in the merged message. +const demotedComment = "Class-scoped enum: value semantics depend on class_uid; see TypeUid." + +// EmitMerged produces the single-event proto3 layout: one flat message (named +// msgName, e.g. "AuditEvent") holding the union of all attributes across the +// named classes, plus the shared objects.proto with the transitive object +// closure. This is the layout for a single audit-log topic carrying events of +// every selected class. +// +// Unlike Emit (one message per class), the merged message: +// +// - Unions attributes across classes per MergeClasses. Shared base_event +// attributes appear once with one tag; class-owned attributes are plain +// optional fields. +// - Demotes class-scoped enums (activity_id, and any enum whose values +// conflict across classes) to plain scalars, with an explanatory comment. +// - Marks a field (buf.validate.field).required only when it is required in +// EVERY selected class; per-class requiredness and class-field ownership +// are enforced with class_uid-gated message-level CEL instead, so a +// protovalidate pass on the merged message validates exactly the class the +// event claims to be. +// - Adds the OCSF type_uid consistency rule +// (type_uid == class_uid * 100 + activity_id) as message-level CEL. +// +// Field numbers are keyed by (msgName, attribute) in tm: a fresh lineage, +// independent of the per-class messages, append-only across class additions. +// Object messages reuse their existing (object, attribute) keys, so object +// tags are identical between Emit and EmitMerged output. +// +// stubbed follows the same contract as Emit. +func EmitMerged(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version, msgName string) (files []GeneratedFile, stubbed []string, err error) { + merged, err := MergeClasses(s, classNames, msgName) + if err != nil { + return nil, nil, err + } + + // Object closure is the union across all selected classes — identical to + // what the per-class layout needs, so SelectClosure is reused as-is. + classes, objects, err := SelectClosure(s, classNames) + if err != nil { + return nil, nil, err + } + + pkgSuffix, err := versionToPackage(version) + if err != nil { + return nil, nil, err + } + dir := "ocsf/" + pkgSuffix + + stubs := collectStubs(s, classes, objects) + hasObjects := len(objects) > 0 || len(stubs) > 0 + + classFile, err := emitMergedClassFile(s, tm, merged, version, pkgSuffix, dir, hasObjects) + if err != nil { + return nil, nil, err + } + + objFile, err := emitObjectsFile(s, tm, version, pkgSuffix, dir, objects, stubs) + if err != nil { + return nil, nil, err + } + + files = []GeneratedFile{classFile, objFile} + sort.Slice(files, func(i, j int) bool { return files[i].Path < files[j].Path }) + + var stubbedNames []string + if len(stubs) > 0 { + stubbedNames = stubs + } + return files, stubbedNames, nil +} + +// EmitMergedSRSchema produces the single self-contained Schema-Registry schema +// for the merged event message: the merged message first (Confluent +// message-index 0), then every object in the union closure inlined, then +// stubs. Same contract as EmitSRSchemas (no buf/validate, no cross-file +// imports, tags from the shared tagmap), but one file for the whole topic +// instead of one per class. +// +// The returned file's Path is ".sr.proto" (e.g. +// "audit_event.sr.proto"). +func EmitMergedSRSchema(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version, msgName string) (GeneratedFile, error) { + merged, err := MergeClasses(s, classNames, msgName) + if err != nil { + return GeneratedFile{}, err + } + + classes, objects, err := SelectClosure(s, classNames) + if err != nil { + return GeneratedFile{}, err + } + + pkgSuffix, err := versionToPackage(version) + if err != nil { + return GeneratedFile{}, err + } + + opts := emitOptions{ + omitValidate: true, + fieldComments: demotedFieldComments(merged), + } + + var body strings.Builder + + // (1) Merged event message FIRST → Confluent message-index 0. + classMsg, err := emitMessage(s, tm, merged.Name, merged.Attributes, nil, opts) + if err != nil { + return GeneratedFile{}, fmt.Errorf("ocsf sr emit: merged %q: %w", merged.Name, err) + } + body.WriteString(classMsg) + body.WriteString("\n") + + // (2) Objects in the union closure, sorted by PascalCase message name. + sorted := make([]schema.Object, len(objects)) + copy(sorted, objects) + sort.Slice(sorted, func(i, j int) bool { + return toPascalCase(sorted[i].Name) < toPascalCase(sorted[j].Name) + }) + for i := range sorted { + msg, emitErr := emitMessage(s, tm, toPascalCase(sorted[i].Name), sorted[i].Attributes, sorted[i].Constraints, emitOptions{omitValidate: true}) + if emitErr != nil { + return GeneratedFile{}, fmt.Errorf("ocsf sr emit: object %q: %w", sorted[i].Name, emitErr) + } + body.WriteString(msg) + body.WriteString("\n") + } + + // (3) Stub messages for referenced-but-absent objects. + stubs := collectStubs(s, classes, objects) + for _, stubName := range stubs { + body.WriteString("// Stub: referenced object not present in this schema snapshot.\n") + body.WriteString("message " + stubName + " {}\n\n") + } + + needStruct := mergedNeedsStruct(s, merged) + if !needStruct { + needStruct, _ = detectImports(s, nil, objects) + } + + var imports []string + if needStruct { + imports = append(imports, `import "google/protobuf/struct.proto";`) + } + + content := fileHeader(version, pkgSuffix) + importBlock(imports) + body.String() + return GeneratedFile{Path: msgFileBase(msgName) + ".sr.proto", Content: content}, nil +} + +// emitMergedClassFile builds the proto file holding the merged event message. +func emitMergedClassFile(s *schema.Schema, tm *tagmap.TagMap, merged *Merged, version, pkgSuffix, dir string, hasObjects bool) (GeneratedFile, error) { + opts := emitOptions{ + fieldComments: demotedFieldComments(merged), + extraCEL: mergedCEL(merged), + } + + msg, err := emitMessage(s, tm, merged.Name, merged.Attributes, nil, opts) + if err != nil { + return GeneratedFile{}, fmt.Errorf("ocsf emit: merged %q: %w", merged.Name, err) + } + + needObjects := hasObjects && attrsReferenceObject(merged.Attributes) + needStruct := mergedNeedsStruct(s, merged) + needValidate := len(opts.extraCEL) > 0 || anyRequired(merged.Attributes) + + var imports []string + if needObjects { + imports = append(imports, `import "`+dir+"/"+objectsFileName+`";`) + } + if needStruct { + imports = append(imports, `import "google/protobuf/struct.proto";`) + } + if needValidate { + imports = append(imports, `import "buf/validate/validate.proto";`) + } + + content := fileHeader(version, pkgSuffix) + importBlock(imports) + msg + "\n" + return GeneratedFile{Path: dir + "/" + msgFileBase(merged.Name) + ".proto", Content: content}, nil +} + +// mergedCEL builds the message-level CEL blocks for the merged event message, +// in deterministic order: +// +// 1. type_uid consistency (OCSF invariant: type_uid = class_uid*100 + activity_id), +// 2. per-attribute class ownership (fields owned by a strict subset of the +// selected classes may only be set when class_uid is one of the owners), +// 3. per-class conditional requiredness (attributes required by class C but +// not by every class must be present when class_uid == C), +// 4. per-class at_least_one / just_one constraints, gated on class_uid. +func mergedCEL(merged *Merged) []string { + var cels []string + cels = append(cels, typeUIDConsistencyCEL(merged)...) + cels = append(cels, ownershipCELs(merged)...) + cels = append(cels, condRequiredCELs(merged)...) + cels = append(cels, gatedConstraintCELs(merged)...) + return cels +} + +// typeUIDConsistencyCEL builds the type_uid = class_uid*100 + activity_id +// rule. All three are base_event attributes, so they are always present in a +// merge; guard anyway for partial fixtures. +func typeUIDConsistencyCEL(merged *Merged) []string { + if !hasAll(merged.Attributes, "type_uid", "class_uid", "activity_id") { + return nil + } + return []string{celOption( + merged.Name+".type_uid", + "type_uid must equal class_uid * 100 + activity_id", + "this.type_uid == this.class_uid * 100 + this.activity_id", + )} +} + +// ownershipCELs gates attributes owned by a strict subset of the selected +// classes on class_uid. Attributes owned by every class need no gate. +func ownershipCELs(merged *Merged) []string { + total := len(merged.Classes) + uidByClass := make(map[string]int, total) + for _, cls := range merged.Classes { + uidByClass[cls.Name] = cls.UID + } + + var cels []string + for _, attrName := range sortedKeys(merged.Attributes) { + classOwners := merged.Owners[attrName] + if len(classOwners) == 0 || len(classOwners) == total { + continue + } + uids := make([]string, 0, len(classOwners)) + for _, owner := range classOwners { + uids = append(uids, fmt.Sprintf("%d", uidByClass[owner])) + } + var cond string + if len(uids) == 1 { + cond = "this.class_uid == " + uids[0] + } else { + cond = "this.class_uid in [" + strings.Join(uids, ", ") + "]" + } + cels = append(cels, celOption( + merged.Name+".own."+attrName, + attrName+" is only valid for class_uid "+strings.Join(uids, ", "), + "!has(this."+attrName+") || "+cond, + )) + } + return cels +} + +// condRequiredCELs enforces per-class requiredness for attributes required by +// one class but not blanket-required (those already carry the field-level +// annotation). Repeated attributes are skipped: OCSF "required" on an array +// means only "key present", an empty list is valid, mirroring the per-class +// emitter's rule. +func condRequiredCELs(merged *Merged) []string { + var cels []string + for _, cls := range merged.Classes { + reqAttrs := make([]string, 0, 8) + for attrName, attr := range cls.Attributes { + mergedAttr := merged.Attributes[attrName] + if attr.Requirement == requirementRequired && mergedAttr.Requirement != requirementRequired && !attr.IsArray { + reqAttrs = append(reqAttrs, attrName) + } + } + sort.Strings(reqAttrs) + for _, attrName := range reqAttrs { + cels = append(cels, celOption( + fmt.Sprintf("%s.req.%s.%s", merged.Name, cls.Name, attrName), + fmt.Sprintf("%s is required when class_uid == %d (%s)", attrName, cls.UID, cls.Name), + fmt.Sprintf("this.class_uid != %d || has(this.%s)", cls.UID, attrName), + )) + } + } + return cels +} + +// gatedConstraintCELs re-emits each class's at_least_one/just_one constraints +// gated on class_uid. +func gatedConstraintCELs(merged *Merged) []string { + var cels []string + for _, cls := range merged.Classes { + if cls.Constraints == nil { + continue + } + gate := fmt.Sprintf("this.class_uid != %d || ", cls.UID) + if len(cls.Constraints.AtLeastOne) > 0 { + expr, fieldList := atLeastOneExpr(cls.Constraints.AtLeastOne) + cels = append(cels, celOption( + fmt.Sprintf("%s.constraint.%s.at_least_one", merged.Name, cls.Name), + fmt.Sprintf("at least one of %s must be set when class_uid == %d (%s)", fieldList, cls.UID, cls.Name), + gate+"("+expr+")", + )) + } + if len(cls.Constraints.JustOne) > 0 { + expr, fieldList := justOneExpr(cls.Constraints.JustOne) + cels = append(cels, celOption( + fmt.Sprintf("%s.constraint.%s.just_one", merged.Name, cls.Name), + fmt.Sprintf("exactly one of %s must be set when class_uid == %d (%s)", fieldList, cls.UID, cls.Name), + gate+"("+expr+")", + )) + } + } + return cels +} + +// demotedFieldComments maps each demoted attribute to its emitted comment. +func demotedFieldComments(merged *Merged) map[string]string { + if len(merged.Demoted) == 0 { + return nil + } + comments := make(map[string]string, len(merged.Demoted)) + for _, name := range merged.Demoted { + comments[name] = demotedComment + } + return comments +} + +// mergedNeedsStruct reports whether any merged attribute resolves to +// google.protobuf.Value. +func mergedNeedsStruct(s *schema.Schema, merged *Merged) bool { + for _, attr := range merged.Attributes { + pt, err := resolveProtoType(s, *attr) + if err != nil { + continue + } + if pt.WellKnown == wellKnownValueType { + return true + } + } + return false +} + +// attrsReferenceObject reports whether any attribute points at a (non-generic) +// object type. +func attrsReferenceObject(attrs map[string]*schema.Attribute) bool { + for _, attr := range attrs { + if attr.Type == objectTypeName && attr.ObjectType != "" && attr.ObjectType != genericObject { + return true + } + } + return false +} + +// anyRequired reports whether any non-repeated attribute is required. +// Repeated attributes never carry the field-level required annotation (see +// emitMessage), so they must not force the buf/validate import either. +func anyRequired(attrs map[string]*schema.Attribute) bool { + for _, attr := range attrs { + if attr.Requirement == requirementRequired && !attr.IsArray { + return true + } + } + return false +} + +// hasAll reports whether every named attribute exists in attrs. +func hasAll(attrs map[string]*schema.Attribute, names ...string) bool { + for _, name := range names { + if _, ok := attrs[name]; !ok { + return false + } + } + return true +} + +// msgFileBase converts a PascalCase message name to its snake_case file base: +// "AuditEvent" → "audit_event". +func msgFileBase(msgName string) string { + return strings.ToLower(toUpperSnake(msgName)) +} diff --git a/ocsf/internal/ocsf/gen/emitmerged_test.go b/ocsf/internal/ocsf/gen/emitmerged_test.go new file mode 100644 index 0000000..a1c9f88 --- /dev/null +++ b/ocsf/internal/ocsf/gen/emitmerged_test.go @@ -0,0 +1,337 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package gen_test + +import ( + "os" + "path/filepath" + "strings" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/gen" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/tagmap" +) + +// mergedGoldenDir is the module root of the merged-layout golden tree: +// ocsf/v1/audit_event.proto + ocsf/v1/objects.proto under it, and the SR +// schema under mergedSRGoldenDir. +const ( + mergedGoldenDir = "testdata/golden-merged" + mergedSRGoldenDir = "testdata/golden-merged/sr" + mergedMsgName = "AuditEvent" +) + +// emitMergedJoined runs EmitMerged and concatenates the generated files in +// path-sorted order for substring assertions. +func emitMergedJoined(t *testing.T, classNames []string) string { + t.Helper() + s := loadFixture(t) + tm := tagmap.New() + files, _, err := gen.EmitMerged(s, classNames, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + var sb strings.Builder + for _, f := range files { + sb.WriteString(f.Content) + } + return sb.String() +} + +// TestEmitMerged_Golden emits the merged layout for api_activity + +// entity_management and compares it (and the merged SR schema) against the +// committed goldens. Run with -update to regenerate. +func TestEmitMerged_Golden(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, stubbed, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + require.Empty(t, stubbed, "full 1.8.0 snapshot must not produce stubs") + require.Len(t, files, 2) + + srFile, err := gen.EmitMergedSRSchema(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + if *update { + for _, f := range files { + dst := filepath.Join(mergedGoldenDir, filepath.FromSlash(f.Path)) + require.NoError(t, os.MkdirAll(filepath.Dir(dst), 0o755)) + require.NoError(t, os.WriteFile(dst, []byte(f.Content), 0o644)) + } + srDst := filepath.Join(mergedSRGoldenDir, filepath.FromSlash(srFile.Path)) + require.NoError(t, os.MkdirAll(filepath.Dir(srDst), 0o755)) + require.NoError(t, os.WriteFile(srDst, []byte(srFile.Content), 0o644)) + t.Logf("merged golden files updated under %s", mergedGoldenDir) + return + } + + for _, f := range files { + golden := filepath.Join(mergedGoldenDir, filepath.FromSlash(f.Path)) + want, readErr := os.ReadFile(golden) + require.NoError(t, readErr, "merged golden %s missing; re-run with -update", f.Path) + require.Equal(t, string(want), f.Content, + "merged proto %s does not match golden; re-run with -update if intentional", f.Path) + } + + srGolden := filepath.Join(mergedSRGoldenDir, filepath.FromSlash(srFile.Path)) + want, err := os.ReadFile(srGolden) + require.NoError(t, err, "merged SR golden missing; re-run with -update") + require.Equal(t, string(want), srFile.Content, + "merged SR schema does not match golden; re-run with -update if intentional") +} + +// TestEmitMerged_Paths verifies the file layout: audit_event.proto + +// objects.proto under the versioned directory. +func TestEmitMerged_Paths(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + paths := []string{files[0].Path, files[1].Path} + require.ElementsMatch(t, []string{"ocsf/v1/audit_event.proto", "ocsf/v1/objects.proto"}, paths) +} + +// TestEmitMerged_SingleMessage verifies exactly one top-level message in the +// merged class file, holding the union of attributes with one tag each. +func TestEmitMerged_SingleMessage(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + var classFile string + for _, f := range files { + if strings.HasSuffix(f.Path, "audit_event.proto") { + classFile = f.Content + } + } + require.NotEmpty(t, classFile) + + require.Equal(t, 1, strings.Count(classFile, "\nmessage ")+boolToInt(strings.HasPrefix(classFile, "message ")), + "merged class file must contain exactly one message") + require.Contains(t, classFile, "message AuditEvent {") + + // Union: fields from both classes appear in the ONE message. + require.Contains(t, classFile, " api = ", "api_activity-owned field must be present") + require.Contains(t, classFile, " entity = ", "entity_management-owned field must be present") + require.Contains(t, classFile, " metadata = ", "base_event field must be present") +} + +// TestEmitMerged_ActivityIDDemoted verifies activity_id is a plain int32 with +// the demotion comment, and no ActivityId enum exists. +func TestEmitMerged_ActivityIDDemoted(t *testing.T) { + content := emitMergedJoined(t, mergedClasses) + + require.Contains(t, content, "// Class-scoped enum: value semantics depend on class_uid; see TypeUid.\n int32 activity_id = ") + require.NotContains(t, content, "enum ActivityId", "merged message must not declare a merged ActivityId enum") +} + +// TestEmitMerged_UnionEnums verifies ClassUid/CategoryUid/TypeUid union the +// values of every selected class. +func TestEmitMerged_UnionEnums(t *testing.T) { + content := emitMergedJoined(t, mergedClasses) + + require.Contains(t, content, "CLASS_UID_API_ACTIVITY = 6003") + require.Contains(t, content, "CLASS_UID_ENTITY_MANAGEMENT = 3004") + require.Contains(t, content, "CATEGORY_UID_APPLICATION_ACTIVITY = 6") + require.Contains(t, content, "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3") + require.Contains(t, content, "TYPE_UID_API_ACTIVITY_CREATE = 600301") + require.Contains(t, content, "TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401") +} + +// TestEmitMerged_TypeUIDConsistencyCEL verifies the OCSF type_uid invariant is +// enforced via message-level CEL. +func TestEmitMerged_TypeUIDConsistencyCEL(t *testing.T) { + content := emitMergedJoined(t, mergedClasses) + + require.Contains(t, content, `id: "AuditEvent.type_uid"`) + require.Contains(t, content, `expression: "this.type_uid == this.class_uid * 100 + this.activity_id"`) +} + +// TestEmitMerged_OwnershipCEL verifies class-owned fields are gated on +// class_uid. +func TestEmitMerged_OwnershipCEL(t *testing.T) { + content := emitMergedJoined(t, mergedClasses) + + // trace is api_activity-only (6003). + require.Contains(t, content, `id: "AuditEvent.own.trace"`) + require.Contains(t, content, `expression: "!has(this.trace) || this.class_uid == 6003"`) + // entity is entity_management-only (3004). + require.Contains(t, content, `id: "AuditEvent.own.entity"`) + require.Contains(t, content, `expression: "!has(this.entity) || this.class_uid == 3004"`) + // metadata and api are owned by every class: no ownership gate. + require.NotContains(t, content, `id: "AuditEvent.own.metadata"`) + require.NotContains(t, content, `id: "AuditEvent.own.api"`) +} + +// TestEmitMerged_ConditionalRequiredCEL verifies per-class requiredness is +// enforced with class_uid-gated CEL, not blanket field annotations. +func TestEmitMerged_ConditionalRequiredCEL(t *testing.T) { + content := emitMergedJoined(t, mergedClasses) + + // actor is required by api_activity (6003) but not entity_management. + require.Contains(t, content, `id: "AuditEvent.req.api_activity.actor"`) + require.Contains(t, content, `expression: "this.class_uid != 6003 || has(this.actor)"`) + // entity is required by entity_management (3004). + require.Contains(t, content, `id: "AuditEvent.req.entity_management.entity"`) + require.Contains(t, content, `expression: "this.class_uid != 3004 || has(this.entity)"`) + + // actor must NOT carry the blanket field-level required annotation. + require.NotRegexp(t, `actor = \d+ \[\(buf\.validate\.field\)\.required = true\]`, content) + // metadata (required everywhere) must keep the blanket annotation. + require.Regexp(t, `metadata = \d+ \[\(buf\.validate\.field\)\.required = true\]`, content) +} + +// TestEmitMerged_TagStability verifies that adding a class to the selection +// never changes an already-assigned tag: the wire-stability guarantee for the +// merged message. +func TestEmitMerged_TagStability(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + _, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + // Record every AuditEvent tag after the first run. Assign is idempotent, + // so re-asking returns the stored tag without mutation. + m, err := gen.MergeClasses(s, mergedClasses, mergedMsgName) + require.NoError(t, err) + before := make(map[string]int32, len(m.Attributes)) + for name := range m.Attributes { + tag, assignErr := tm.Assign(mergedMsgName, name) + require.NoError(t, assignErr) + before[name] = tag + } + + // Second run with an additional class (authentication conflicts with + // api_activity on activity_id, exercising demotion too). + wider := append([]string{"authentication"}, mergedClasses...) + _, _, err = gen.EmitMerged(s, wider, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + for name, want := range before { + got, assignErr := tm.Assign(mergedMsgName, name) + require.NoError(t, assignErr) + require.Equal(t, want, got, "tag for %q changed after adding a class", name) + } +} + +// TestEmitMerged_ConflictingClassDemotes verifies EmitMerged succeeds when a +// genuinely conflicting class (authentication) is selected, with activity_id +// demoted rather than erroring. +func TestEmitMerged_ConflictingClassDemotes(t *testing.T) { + content := emitMergedJoined(t, []string{"api_activity", "entity_management", "authentication"}) + + require.Contains(t, content, "int32 activity_id = ") + require.NotContains(t, content, "enum ActivityId") + require.Contains(t, content, "CLASS_UID_AUTHENTICATION = 3002") +} + +// TestEmitMergedSRSchema_Shape verifies the SR schema: merged message first, +// self-contained, no buf.validate anywhere. +func TestEmitMergedSRSchema_Shape(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + f, err := gen.EmitMergedSRSchema(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + require.Equal(t, "audit_event.sr.proto", f.Path) + require.NotContains(t, f.Content, "buf.validate") + require.NotContains(t, f.Content, `import "ocsf/`) + + // Merged message must be the FIRST message (Confluent index 0). + firstMsg := strings.Index(f.Content, "message ") + require.GreaterOrEqual(t, firstMsg, 0) + require.True(t, strings.HasPrefix(f.Content[firstMsg:], "message AuditEvent {"), + "merged message must be first for Confluent message-index 0") +} + +// TestEmitMergedSRSchema_FieldNumberParity verifies the SR schema carries the +// exact same tags as the main merged output when sharing a tagmap. +func TestEmitMergedSRSchema_FieldNumberParity(t *testing.T) { + s := loadFixture(t) + tm := tagmap.New() + + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + srFile, err := gen.EmitMergedSRSchema(s, mergedClasses, tm, "1.8.0", mergedMsgName) + require.NoError(t, err) + + var classFile string + for _, f := range files { + if strings.HasSuffix(f.Path, "audit_event.proto") { + classFile = f.Content + } + } + + mainMsg := extractMessage(t, classFile, "AuditEvent") + srMsg := extractMessage(t, srFile.Content, "AuditEvent") + + mainTags := extractFieldTags(mainMsg) + srTags := extractFieldTags(srMsg) + require.Equal(t, mainTags, srTags, "SR schema field numbers must match the main merged output") + require.NotEmpty(t, mainTags) +} + +// TestEmitMerged_Deterministic verifies two runs produce identical bytes. +func TestEmitMerged_Deterministic(t *testing.T) { + a := emitMergedJoined(t, mergedClasses) + b := emitMergedJoined(t, mergedClasses) + require.Equal(t, a, b) +} + +// extractMessage returns the body of the named top-level message. +func extractMessage(t *testing.T, content, name string) string { + t.Helper() + start := strings.Index(content, "message "+name+" {") + require.GreaterOrEqual(t, start, 0, "message %s not found", name) + // Top-level messages end at the first "\n}\n" after their start. + end := strings.Index(content[start:], "\n}\n") + require.GreaterOrEqual(t, end, 0) + return content[start : start+end] +} + +// extractFieldTags parses "name = N" pairs from a message body. +func extractFieldTags(msg string) map[string]string { + tags := make(map[string]string) + for _, line := range strings.Split(msg, "\n") { + line = strings.TrimSpace(line) + if !strings.Contains(line, " = ") || strings.HasPrefix(line, "//") || + strings.HasPrefix(line, "option") || !strings.HasSuffix(line, ";") { + continue + } + // Skip enum value lines (ALL_CAPS idents). + parts := strings.SplitN(line, " = ", 2) + fields := strings.Fields(parts[0]) + fieldName := fields[len(fields)-1] + if strings.ToUpper(fieldName) == fieldName { + continue + } + num := strings.TrimSuffix(parts[1], ";") + if i := strings.Index(num, " ["); i >= 0 { + num = num[:i] + } + tags[fieldName] = num + } + return tags +} + +// boolToInt converts a bool to 1/0 for message-count arithmetic. +func boolToInt(b bool) int { + if b { + return 1 + } + return 0 +} diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock new file mode 100644 index 0000000..709ae02 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock @@ -0,0 +1,6 @@ +# Generated by buf. DO NOT EDIT. +version: v2 +deps: + - name: buf.build/bufbuild/protovalidate + commit: 50325440f8f24053b047484a6bf60b76 + digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31 diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml new file mode 100644 index 0000000..3c34751 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml @@ -0,0 +1,20 @@ +version: v2 +modules: + - path: . + # The self-contained Schema-Registry schemas under sr/ intentionally inline + # the same messages as ocsf/v1/*.proto in the same package. They are not part + # of the buf module: excluding them avoids duplicate-symbol collisions and + # keeps each .sr.proto a standalone artifact for direct SR registration. + excludes: + - sr +deps: + - buf.build/bufbuild/protovalidate +lint: + use: + - STANDARD + except: + # OCSF uses _UNKNOWN (not _UNSPECIFIED) for synthesized zero values by design. + - ENUM_ZERO_VALUE_SUFFIX +breaking: + use: + - FILE diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto new file mode 100644 index 0000000..5527372 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto @@ -0,0 +1,261 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message AuditEvent { + option (buf.validate.message).cel = { + id: "AuditEvent.type_uid", + message: "type_uid must equal class_uid * 100 + activity_id", + expression: "this.type_uid == this.class_uid * 100 + this.activity_id" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.access_list", + message: "access_list is only valid for class_uid 3004", + expression: "!has(this.access_list) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.access_mask", + message: "access_mask is only valid for class_uid 3004", + expression: "!has(this.access_mask) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.ai_model", + message: "ai_model is only valid for class_uid 6003", + expression: "!has(this.ai_model) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.comment", + message: "comment is only valid for class_uid 3004", + expression: "!has(this.comment) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.dst_endpoint", + message: "dst_endpoint is only valid for class_uid 6003", + expression: "!has(this.dst_endpoint) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.entity", + message: "entity is only valid for class_uid 3004", + expression: "!has(this.entity) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.entity_result", + message: "entity_result is only valid for class_uid 3004", + expression: "!has(this.entity_result) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.message_context", + message: "message_context is only valid for class_uid 6003", + expression: "!has(this.message_context) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.resources", + message: "resources is only valid for class_uid 6003", + expression: "!has(this.resources) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.trace", + message: "trace is only valid for class_uid 6003", + expression: "!has(this.trace) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.actor", + message: "actor is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.actor)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.api", + message: "api is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.api)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.src_endpoint", + message: "src_endpoint is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.src_endpoint)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.entity_management.entity", + message: "entity is required when class_uid == 3004 (entity_management)", + expression: "this.class_uid != 3004 || has(this.entity)" + }; + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + // Class-scoped enum: value semantics depend on class_uid; see TypeUid. + int32 activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + AiModel ai_model = 8; + Api api = 9; + repeated Attack attacks = 10; + repeated Authorization authorizations = 11; + string category_name = 12; + CategoryUid category_uid = 13 [(buf.validate.field).required = true]; + string class_name = 14; + ClassUid class_uid = 15 [(buf.validate.field).required = true]; + Cloud cloud = 16 [(buf.validate.field).required = true]; + string comment = 17; + string confidence = 18; + ConfidenceId confidence_id = 19; + int32 confidence_score = 20; + int32 count = 21; + Device device = 22; + string disposition = 23; + DispositionId disposition_id = 24; + NetworkEndpoint dst_endpoint = 25; + int64 duration = 26; + int64 end_time = 27; + string end_time_dt = 28; + repeated Enrichment enrichments = 29; + ManagedEntity entity = 30; + ManagedEntity entity_result = 31; + FirewallRule firewall_rule = 32; + HttpRequest http_request = 33; + HttpResponse http_response = 34; + bool is_alert = 35; + repeated Malware malware = 36; + MalwareScanInfo malware_scan_info = 37; + string message = 38; + MessageContext message_context = 39; + Metadata metadata = 40 [(buf.validate.field).required = true]; + repeated Observable observables = 41; + repeated Osint osint = 42; + Policy policy = 43; + string raw_data = 44; + Fingerprint raw_data_hash = 45; + int64 raw_data_size = 46; + repeated ResourceDetails resources = 47; + string risk_details = 48; + string risk_level = 49; + RiskLevelId risk_level_id = 50; + int32 risk_score = 51; + string severity = 52; + SeverityId severity_id = 53 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 54; + int64 start_time = 55; + string start_time_dt = 56; + string status = 57; + string status_code = 58; + string status_detail = 59; + StatusId status_id = 60; + int64 time = 61 [(buf.validate.field).required = true]; + string time_dt = 62; + int32 timezone_offset = 63; + Trace trace = 64; + string type_name = 65; + TypeUid type_uid = 66 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 67; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/objects.proto b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/objects.proto new file mode 100644 index 0000000..6019663 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/objects.proto @@ -0,0 +1,2747 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; + +message Account { + option (buf.validate.message).cel = { + id: "Account.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + bool is_disabled = 1; + bool is_locked = 2; + bool is_on_premises_sync_enabled = 3; + repeated string labels = 4; + string name = 5; + repeated KeyValueObject tags = 6; + string type = 7; + TypeId type_id = 8; + string uid = 9; +} + +message Actor { + option (buf.validate.message).cel = { + id: "Actor.at_least_one", + message: "at least one of [app_name, app_uid, invoked_by, process, session, user] must be set", + expression: "has(this.app_name) || has(this.app_uid) || has(this.invoked_by) || has(this.process) || has(this.session) || has(this.user)" + }; + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20 [(buf.validate.field).required = true]; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3 [(buf.validate.field).required = true]; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8 [(buf.validate.field).required = true]; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20 [(buf.validate.field).required = true]; +} + +message Agent { + option (buf.validate.message).cel = { + id: "Agent.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message AiModel { + option (buf.validate.message).cel = { + id: "AiModel.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string ai_provider = 1 [(buf.validate.field).required = true]; + string name = 2 [(buf.validate.field).required = true]; + string uid = 3; + string version = 4; +} + +message Analytic { + option (buf.validate.message).cel = { + id: "Analytic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9 [(buf.validate.field).required = true]; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2 [(buf.validate.field).required = true]; + Request request = 3; + Response response = 4; + Service service = 5; + Token token = 6; + string version = 7; +} + +message Application { + option (buf.validate.message).cel = { + id: "Application.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + string criticality = 1; + google.protobuf.Value data = 2; + string desc = 3; + Group group = 4; + string hostname = 5; + repeated string labels = 6; + string name = 7; + User owner = 8; + string region = 9; + Graph resource_relationship = 10; + string risk_level = 11; + RiskLevelId risk_level_id = 12; + int32 risk_score = 13; + Sbom sbom = 14; + repeated KeyValueObject tags = 15; + string type = 16; + string uid = 17; + string uid_alt = 18; + Url url = 19; + string version = 20; +} + +message Attack { + option (buf.validate.message).cel = { + id: "Attack.at_least_one", + message: "at least one of [sub_technique, tactic, technique] must be set", + expression: "has(this.sub_technique) || has(this.tactic) || has(this.technique)" + }; + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4 [(buf.validate.field).required = true]; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + option (buf.validate.message).cel = { + id: "AutonomousSystem.at_least_one", + message: "at least one of [name, number] must be set", + expression: "has(this.name) || has(this.number)" + }; + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1 [(buf.validate.field).required = true]; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7 [(buf.validate.field).required = true]; + repeated San sans = 8; + string serial_number = 9 [(buf.validate.field).required = true]; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2 [(buf.validate.field).required = true]; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2 [(buf.validate.field).required = true]; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5 [(buf.validate.field).required = true]; + string region = 6; + string zone = 7; +} + +message Container { + option (buf.validate.message).cel = { + id: "Container.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16 [(buf.validate.field).required = true]; +} + +message Cvss { + double base_score = 1 [(buf.validate.field).required = true]; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9 [(buf.validate.field).required = true]; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3 [(buf.validate.field).required = true]; +} + +message D3fTactic { + option (buf.validate.message).cel = { + id: "D3fTactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + option (buf.validate.message).cel = { + id: "D3fTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + option (buf.validate.message).cel = { + id: "D3fend.at_least_one", + message: "at least one of [d3f_tactic, d3f_technique] must be set", + expression: "has(this.d3f_tactic) || has(this.d3f_technique)" + }; + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + option (buf.validate.message).cel = { + id: "DataClassification.at_least_one", + message: "at least one of [category_id, confidentiality_id] must be set", + expression: "has(this.category_id) || has(this.confidentiality_id)" + }; + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + option (buf.validate.message).cel = { + id: "Device.at_least_one", + message: "at least one of [hostname, instance_uid, interface_name, interface_uid, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string mac_vendor = 38; + string meid = 39; + string model = 40; + int64 modified_time = 41; + string modified_time_dt = 42; + string name = 43; + int32 namespace_pid = 44; + repeated NetworkInterface network_interfaces = 45; + Organization org = 46; + Os os = 47; + string os_machine_uuid = 48; + User owner = 49; + Group pool = 50; + string region = 51; + string risk_level = 52; + RiskLevelId risk_level_id = 53; + int32 risk_score = 54; + string subnet = 55; + string subnet_uid = 56; + string type = 57; + TypeId type_id = 58 [(buf.validate.field).required = true]; + string udid = 59; + string uid = 60; + string uid_alt = 61; + string vendor_name = 62; + string vlan_uid = 63; + string vpc_uid = 64; + string zone = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + int32 gpu_count = 13; + repeated GpuInfo gpu_info_list = 14; + KeyboardInfo keyboard_info = 15; + int32 ram_size = 16; + string serial_number = 17; + string uuid = 18; + string vendor_name = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5 [(buf.validate.field).required = true]; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Edge { + option (buf.validate.message).cel = { + id: "Edge.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + google.protobuf.Value data = 1; + bool is_directed = 2; + string name = 3; + string relation = 4; + string source = 5 [(buf.validate.field).required = true]; + string target = 6 [(buf.validate.field).required = true]; + string uid = 7; +} + +message Email { + option (buf.validate.message).cel = { + id: "Email.at_least_one", + message: "at least one of [from, to] must be set", + expression: "has(this.from) || has(this.to)" + }; + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3 [(buf.validate.field).required = true]; + string desc = 4; + string name = 5 [(buf.validate.field).required = true]; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11 [(buf.validate.field).required = true]; +} + +message EnvironmentVariable { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4 [(buf.validate.field).required = true]; + string version = 5; +} + +message Extension { + option (buf.validate.message).cel = { + id: "Extension.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3 [(buf.validate.field).required = true]; +} + +message Feature { + option (buf.validate.message).cel = { + id: "Feature.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + repeated string imported_symbols = 19; + string internal_name = 20; + bool is_deleted = 21; + bool is_encrypted = 22; + bool is_public = 23; + bool is_readonly = 24; + bool is_system = 25; + string mime_type = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + User modifier = 29; + string name = 30 [(buf.validate.field).required = true]; + User owner = 31; + string parent_folder = 32; + string path = 33; + Product product = 34; + string security_descriptor = 35; + DigitalSignature signature = 36; + repeated DigitalSignature signatures = 37; + int64 size = 38; + string storage_class = 39; + repeated KeyValueObject tags = 40; + string type = 41; + TypeId type_id = 42 [(buf.validate.field).required = true]; + string uid = 43; + string uri = 44; + Url url = 45; + string version = 46; + string volume = 47; + google.protobuf.Value xattributes = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2 [(buf.validate.field).required = true]; + string value = 3 [(buf.validate.field).required = true]; +} + +message FirewallRule { + option (buf.validate.message).cel = { + id: "FirewallRule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Graph { + option (buf.validate.message).cel = { + id: "Graph.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum QueryLanguageId { + QUERY_LANGUAGE_ID_UNKNOWN = 0; + QUERY_LANGUAGE_ID_CYPHER = 1; + QUERY_LANGUAGE_ID_GRAPHQL = 2; + QUERY_LANGUAGE_ID_GREMLIN = 3; + QUERY_LANGUAGE_ID_GQL = 4; + QUERY_LANGUAGE_ID_G_CORE = 5; + QUERY_LANGUAGE_ID_PGQL = 6; + QUERY_LANGUAGE_ID_SPARQL = 7; + QUERY_LANGUAGE_ID_OTHER = 99; + } + string desc = 1; + repeated Edge edges = 2; + bool is_directed = 3; + string name = 4; + repeated Node nodes = 5; + string query_language = 6; + QueryLanguageId query_language_id = 7; + string type = 8; + string uid = 9; +} + +message Group { + option (buf.validate.message).cel = { + id: "Group.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2 [(buf.validate.field).required = true]; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + option (buf.validate.message).cel = { + id: "Idp.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6 [(buf.validate.field).required = true]; +} + +message KbArticle { + option (buf.validate.message).cel = { + id: "KbArticle.at_least_one", + message: "at least one of [src_url, uid] must be set", + expression: "has(this.src_url) || has(this.uid)" + }; + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + option (buf.validate.message).cel = { + id: "KeyValueObject.at_least_one", + message: "at least one of [value, values] must be set", + expression: "has(this.value) || has(this.values)" + }; + string name = 1 [(buf.validate.field).required = true]; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2 [(buf.validate.field).required = true]; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string department = 6; + string display_name = 7; + repeated string email_addrs = 8; + string employee_uid = 9; + string given_name = 10; + int64 hire_time = 11; + string hire_time_dt = 12; + string job_title = 13; + repeated string labels = 14; + int64 last_login_time = 15; + string last_login_time_dt = 16; + string ldap_cn = 17; + string ldap_dn = 18; + int64 leave_time = 19; + string leave_time_dt = 20; + Location location = 21; + User manager = 22; + int64 modified_time = 23; + string modified_time_dt = 24; + string office_location = 25; + string phone_number = 26; + string surname = 27; + repeated KeyValueObject tags = 28; +} + +message Location { + option (buf.validate.message).cel = { + id: "Location.at_least_one", + message: "at least one of [city, country, postal_code, region] must be set", + expression: "has(this.city) || has(this.country) || has(this.postal_code) || has(this.region)" + }; + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + option (buf.validate.message).cel = { + id: "Logger.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3 [(buf.validate.field).required = true]; +} + +message Malware { + option (buf.validate.message).cel = { + id: "Malware.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + option (buf.validate.message).cel = { + id: "MalwareScanInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11 [(buf.validate.field).required = true]; + string uid = 12; + int32 unique_malware_count = 13; +} + +message ManagedEntity { + option (buf.validate.message).cel = { + id: "ManagedEntity.at_least_one", + message: "at least one of [device, group, name, org, policy, uid, user] must be set", + expression: "has(this.device) || has(this.group) || has(this.name) || has(this.org) || has(this.policy) || has(this.uid) || has(this.user)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_DEVICE = 1; + TYPE_ID_USER = 2; + TYPE_ID_GROUP = 3; + TYPE_ID_ORGANIZATION = 4; + TYPE_ID_POLICY = 5; + TYPE_ID_EMAIL = 6; + TYPE_ID_NETWORK_ZONE = 7; + TYPE_ID_OTHER = 99; + } + google.protobuf.Value data = 1; + Device device = 2; + Email email = 3; + Group group = 4; + Location location = 5; + string name = 6; + Organization org = 7; + Policy policy = 8; + string type = 9; + TypeId type_id = 10; + string uid = 11; + User user = 12; + string version = 13; +} + +message MessageContext { + option (buf.validate.message).cel = { + id: "MessageContext.at_least_one", + message: "at least one of [application, service] must be set", + expression: "has(this.application) || has(this.service)" + }; + enum AiRoleId { + AI_ROLE_ID_UNKNOWN = 0; + AI_ROLE_ID_USER = 1; + AI_ROLE_ID_ASSISTANT = 2; + AI_ROLE_ID_TOOL = 3; + AI_ROLE_ID_AGENT = 4; + AI_ROLE_ID_ORCHESTRATOR = 5; + AI_ROLE_ID_RETRIEVER = 6; + AI_ROLE_ID_OTHER = 99; + } + string ai_role = 1; + AiRoleId ai_role_id = 2; + Application application = 3; + int32 completion_tokens = 4; + string name = 5; + int32 prompt_tokens = 6; + Service service = 7; + int32 total_tokens = 8; + string uid = 9; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25 [(buf.validate.field).required = true]; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + Timespan total_queued_duration = 32; + repeated TransformationInfo transformation_info_list = 33; + int64 transmit_time = 34; + string transmit_time_dt = 35; + string type = 36; + string uid = 37; + int32 untruncated_size = 38; + string version = 39 [(buf.validate.field).required = true]; +} + +message Metric { + string name = 1 [(buf.validate.field).required = true]; + string value = 2 [(buf.validate.field).required = true]; +} + +message Mitigation { + option (buf.validate.message).cel = { + id: "Mitigation.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + option (buf.validate.message).cel = { + id: "NetworkEndpoint.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message NetworkInterface { + option (buf.validate.message).cel = { + id: "NetworkInterface.at_least_one", + message: "at least one of [hostname, ip, mac, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.mac) || has(this.name) || has(this.uid)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + option (buf.validate.message).cel = { + id: "NetworkProxy.at_least_one", + message: "at least one of [domain, hostname, instance_uid, interface_name, interface_uid, ip, name, svc_name, uid] must be set", + expression: "has(this.domain) || has(this.hostname) || has(this.instance_uid) || has(this.interface_name) || has(this.interface_uid) || has(this.ip) || has(this.name) || has(this.svc_name) || has(this.uid)" + }; + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message Node { + google.protobuf.Value data = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5 [(buf.validate.field).required = true]; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5 [(buf.validate.field).required = true]; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + option (buf.validate.message).cel = { + id: "OccurrenceDetails.at_least_one", + message: "at least one of [cell_name, column_name, column_number, end_line, json_path, page_number, record_index_in_array, row_number, start_line] must be set", + expression: "has(this.cell_name) || has(this.column_name) || has(this.column_number) || has(this.end_line) || has(this.json_path) || has(this.page_number) || has(this.record_index_in_array) || has(this.row_number) || has(this.start_line)" + }; + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + option (buf.validate.message).cel = { + id: "Organization.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8 [(buf.validate.field).required = true]; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12 [(buf.validate.field).required = true]; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44 [(buf.validate.field).required = true]; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48 [(buf.validate.field).required = true]; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7 [(buf.validate.field).required = true]; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17 [(buf.validate.field).required = true]; +} + +message Policy { + option (buf.validate.message).cel = { + id: "Policy.at_least_one", + message: "at least one of [name, type, uid] must be set", + expression: "has(this.name) || has(this.type) || has(this.uid)" + }; + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1 [(buf.validate.field).required = true]; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + option (buf.validate.message).cel = { + id: "Process.at_least_one", + message: "at least one of [cpid, pid, uid] must be set", + expression: "has(this.cpid) || has(this.pid) || has(this.uid)" + }; + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + option (buf.validate.message).cel = { + id: "ProcessEntity.at_least_one", + message: "at least one of [cmd_line, cpid, name, path, pid, uid] must be set", + expression: "has(this.cmd_line) || has(this.cpid) || has(this.name) || has(this.path) || has(this.pid) || has(this.uid)" + }; + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + option (buf.validate.message).cel = { + id: "Product.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2 [(buf.validate.field).required = true]; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + option (buf.validate.message).cel = { + id: "Reporter.at_least_one", + message: "at least one of [hostname, ip, name, uid] must be set", + expression: "has(this.hostname) || has(this.ip) || has(this.name) || has(this.uid)" + }; + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1 [(buf.validate.field).required = true]; + string provider = 2; + string score = 3; + ScoreId score_id = 4 [(buf.validate.field).required = true]; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4 [(buf.validate.field).required = true]; +} + +message ResourceDetails { + option (buf.validate.message).cel = { + id: "ResourceDetails.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + enum RoleId { + ROLE_ID_UNKNOWN = 0; + ROLE_ID_TARGET = 1; + ROLE_ID_ACTOR = 2; + ROLE_ID_AFFECTED = 3; + ROLE_ID_RELATED = 4; + ROLE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string cloud_partition = 2; + int64 created_time = 3; + string created_time_dt = 4; + string criticality = 5; + google.protobuf.Value data = 6; + DataClassification data_classification = 7; + repeated DataClassification data_classifications = 8; + Group group = 9; + string hostname = 10; + string ip = 11; + bool is_backed_up = 12; + repeated string labels = 13; + int64 modified_time = 14; + string modified_time_dt = 15; + string name = 16; + string namespace = 17; + User owner = 18; + string provider = 19; + string region = 20; + Graph resource_relationship = 21; + string role = 22; + RoleId role_id = 23; + repeated KeyValueObject tags = 24; + string type = 25; + string uid = 26; + string uid_alt = 27; + string version = 28; + string zone = 29; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + option (buf.validate.message).cel = { + id: "Rule.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1 [(buf.validate.field).required = true]; + string type = 2 [(buf.validate.field).required = true]; +} + +message Sbom { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SPDX = 1; + TYPE_ID_CYCLONEDX = 2; + TYPE_ID_SWID = 3; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + Package package = 3 [(buf.validate.field).required = true]; + Product product = 4; + repeated SoftwareComponent software_components = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; + string version = 9; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5 [(buf.validate.field).required = true]; + string type = 6; + TypeId type_id = 7 [(buf.validate.field).required = true]; + string uid = 8; +} + +message Service { + option (buf.validate.message).cel = { + id: "Service.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message SoftwareComponent { + enum RelationshipId { + RELATIONSHIP_ID_UNKNOWN = 0; + RELATIONSHIP_ID_DEPENDS_ON = 1; + RELATIONSHIP_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_FRAMEWORK = 1; + TYPE_ID_LIBRARY = 2; + TYPE_ID_OPERATING_SYSTEM = 3; + TYPE_ID_OTHER = 99; + } + string author = 1; + Fingerprint hash = 2; + string license = 3; + string name = 4 [(buf.validate.field).required = true]; + string purl = 5; + string related_component = 6; + string relationship = 7; + RelationshipId relationship_id = 8; + string type = 9; + TypeId type_id = 10; + string version = 11 [(buf.validate.field).required = true]; +} + +message Span { + int64 duration = 1; + int64 end_time = 2 [(buf.validate.field).required = true]; + string end_time_dt = 3; + string message = 4; + string operation = 5; + string parent_uid = 6; + Service service = 7; + int64 start_time = 8 [(buf.validate.field).required = true]; + string start_time_dt = 9; + string status_code = 10; + string uid = 11 [(buf.validate.field).required = true]; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + option (buf.validate.message).cel = { + id: "SubTechnique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + option (buf.validate.message).cel = { + id: "Tactic.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + option (buf.validate.message).cel = { + id: "Technique.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1 [(buf.validate.field).required = true]; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + option (buf.validate.message).cel = { + id: "Timespan.at_least_one", + message: "at least one of [duration, duration_days, duration_hours, duration_mins, duration_months, duration_secs, duration_weeks, duration_years, end_time, start_time] must be set", + expression: "has(this.duration) || has(this.duration_days) || has(this.duration_hours) || has(this.duration_mins) || has(this.duration_months) || has(this.duration_secs) || has(this.duration_weeks) || has(this.duration_years) || has(this.end_time) || has(this.start_time)" + }; + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message Trace { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + repeated string flags = 4; + Service service = 5; + Span span = 6; + int64 start_time = 7; + string start_time_dt = 8; + string uid = 9 [(buf.validate.field).required = true]; +} + +message TransformationInfo { + option (buf.validate.message).cel = { + id: "TransformationInfo.at_least_one", + message: "at least one of [name, uid] must be set", + expression: "has(this.name) || has(this.uid)" + }; + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + option (buf.validate.message).cel = { + id: "Url.at_least_one", + message: "at least one of [path, url_string] must be set", + expression: "has(this.path) || has(this.url_string)" + }; + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + option (buf.validate.message).cel = { + id: "User.at_least_one", + message: "at least one of [account, name, uid] must be set", + expression: "has(this.account) || has(this.name) || has(this.uid)" + }; + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + option (buf.validate.message).cel = { + id: "Vulnerability.just_one", + message: "exactly one of [advisory, cve, cwe] must be set", + expression: "(has(this.advisory) ? 1 : 0) + (has(this.cve) ? 1 : 0) + (has(this.cwe) ? 1 : 0) == 1" + }; + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + option (buf.validate.message).cel = { + id: "WinService.at_least_one", + message: "at least one of [cmd_line, service_category_id, service_dependencies, service_error_control_id, service_start_name, service_start_type_id, service_type_id] must be set", + expression: "has(this.cmd_line) || has(this.service_category_id) || has(this.service_dependencies) || has(this.service_error_control_id) || has(this.service_start_name) || has(this.service_start_type_id) || has(this.service_type_id)" + }; + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5 [(buf.validate.field).required = true]; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/sr/audit_event.sr.proto b/ocsf/internal/ocsf/gen/testdata/golden-merged/sr/audit_event.sr.proto new file mode 100644 index 0000000..c36c6f8 --- /dev/null +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/sr/audit_event.sr.proto @@ -0,0 +1,2656 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "google/protobuf/struct.proto"; + +message AuditEvent { + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + // Class-scoped enum: value semantics depend on class_uid; see TypeUid. + int32 activity_id = 5; + string activity_name = 6; + Actor actor = 7; + AiModel ai_model = 8; + Api api = 9; + repeated Attack attacks = 10; + repeated Authorization authorizations = 11; + string category_name = 12; + CategoryUid category_uid = 13; + string class_name = 14; + ClassUid class_uid = 15; + Cloud cloud = 16; + string comment = 17; + string confidence = 18; + ConfidenceId confidence_id = 19; + int32 confidence_score = 20; + int32 count = 21; + Device device = 22; + string disposition = 23; + DispositionId disposition_id = 24; + NetworkEndpoint dst_endpoint = 25; + int64 duration = 26; + int64 end_time = 27; + string end_time_dt = 28; + repeated Enrichment enrichments = 29; + ManagedEntity entity = 30; + ManagedEntity entity_result = 31; + FirewallRule firewall_rule = 32; + HttpRequest http_request = 33; + HttpResponse http_response = 34; + bool is_alert = 35; + repeated Malware malware = 36; + MalwareScanInfo malware_scan_info = 37; + string message = 38; + MessageContext message_context = 39; + Metadata metadata = 40; + repeated Observable observables = 41; + repeated Osint osint = 42; + Policy policy = 43; + string raw_data = 44; + Fingerprint raw_data_hash = 45; + int64 raw_data_size = 46; + repeated ResourceDetails resources = 47; + string risk_details = 48; + string risk_level = 49; + RiskLevelId risk_level_id = 50; + int32 risk_score = 51; + string severity = 52; + SeverityId severity_id = 53; + NetworkEndpoint src_endpoint = 54; + int64 start_time = 55; + string start_time_dt = 56; + string status = 57; + string status_code = 58; + string status_detail = 59; + StatusId status_id = 60; + int64 time = 61; + string time_dt = 62; + int32 timezone_offset = 63; + Trace trace = 64; + string type_name = 65; + TypeUid type_uid = 66; + google.protobuf.Value unmapped = 67; +} + +message Account { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_LDAP_ACCOUNT = 1; + TYPE_ID_WINDOWS_ACCOUNT = 2; + TYPE_ID_AWS_IAM_USER = 3; + TYPE_ID_AWS_IAM_ROLE = 4; + TYPE_ID_GCP_ACCOUNT = 5; + TYPE_ID_AZURE_AD_ACCOUNT = 6; + TYPE_ID_MAC_OS_ACCOUNT = 7; + TYPE_ID_APPLE_ACCOUNT = 8; + TYPE_ID_LINUX_ACCOUNT = 9; + TYPE_ID_AWS_ACCOUNT = 10; + TYPE_ID_GCP_PROJECT = 11; + TYPE_ID_OCI_COMPARTMENT = 12; + TYPE_ID_AZURE_SUBSCRIPTION = 13; + TYPE_ID_SALESFORCE_ACCOUNT = 14; + TYPE_ID_GOOGLE_WORKSPACE = 15; + TYPE_ID_SERVICENOW_INSTANCE = 16; + TYPE_ID_M365_TENANT = 17; + TYPE_ID_EMAIL_ACCOUNT = 18; + TYPE_ID_ACTIVEDIRECTORY_ACCOUNT = 19; + TYPE_ID_OTHER = 99; + } + bool is_disabled = 1; + bool is_locked = 2; + bool is_on_premises_sync_enabled = 3; + repeated string labels = 4; + string name = 5; + repeated KeyValueObject tags = 6; + string type = 7; + TypeId type_id = 8; + string uid = 9; +} + +message Actor { + string app_name = 1; + string app_uid = 2; + repeated Authorization authorizations = 3; + Idp idp = 4; + string invoked_by = 5; + Process process = 6; + Session session = 7; + User user = 8; +} + +message Advisory { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string desc = 6; + string install_state = 7; + InstallStateId install_state_id = 8; + bool is_superseded = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + Os os = 12; + Product product = 13; + repeated string references = 14; + repeated Cve related_cves = 15; + repeated Cwe related_cwes = 16; + int64 size = 17; + string src_url = 18; + string title = 19; + string uid = 20; +} + +message AffectedCode { + int32 end_column = 1; + int32 end_line = 2; + File file = 3; + User owner = 4; + Remediation remediation = 5; + Rule rule = 6; + int32 start_column = 7; + int32 start_line = 8; +} + +message AffectedPackage { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + string fixed_in_version = 4; + Fingerprint hash = 5; + string license = 6; + string license_url = 7; + string name = 8; + string package_manager = 9; + string package_manager_url = 10; + string path = 11; + string purl = 12; + string release = 13; + Remediation remediation = 14; + string src_url = 15; + string type = 16; + TypeId type_id = 17; + string uid = 18; + string vendor_name = 19; + string version = 20; +} + +message Agent { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_ENDPOINT_DETECTION_AND_RESPONSE = 1; + TYPE_ID_DATA_LOSS_PREVENTION = 2; + TYPE_ID_BACKUP_RECOVERY = 3; + TYPE_ID_PERFORMANCE_MONITORING_OBSERVABILITY = 4; + TYPE_ID_VULNERABILITY_MANAGEMENT = 5; + TYPE_ID_LOG_FORWARDING = 6; + TYPE_ID_MOBILE_DEVICE_MANAGEMENT = 7; + TYPE_ID_CONFIGURATION_MANAGEMENT = 8; + TYPE_ID_REMOTE_ACCESS = 9; + TYPE_ID_OTHER = 99; + } + string name = 1; + repeated Policy policies = 2; + string type = 3; + TypeId type_id = 4; + string uid = 5; + string uid_alt = 6; + string vendor_name = 7; + string version = 8; +} + +message AiModel { + string ai_provider = 1; + string name = 2; + string uid = 3; + string version = 4; +} + +message Analytic { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUPPRESSED = 2; + STATE_ID_EXPERIMENTAL = 3; + STATE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_RULE = 1; + TYPE_ID_BEHAVIORAL = 2; + TYPE_ID_STATISTICAL = 3; + TYPE_ID_LEARNING_ML_DL = 4; + TYPE_ID_FINGERPRINTING = 5; + TYPE_ID_TAGGING = 6; + TYPE_ID_KEYWORD_MATCH = 7; + TYPE_ID_REGULAR_EXPRESSIONS = 8; + TYPE_ID_EXACT_DATA_MATCH = 9; + TYPE_ID_PARTIAL_DATA_MATCH = 10; + TYPE_ID_INDEXED_DATA_MATCH = 11; + TYPE_ID_OTHER = 99; + } + string algorithm = 1; + string category = 2; + string desc = 3; + string name = 4; + repeated Analytic related_analytics = 5; + string state = 6; + StateId state_id = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; + string version = 11; +} + +message Api { + Group group = 1; + string operation = 2; + Request request = 3; + Response response = 4; + Service service = 5; + Token token = 6; + string version = 7; +} + +message Application { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + string criticality = 1; + google.protobuf.Value data = 2; + string desc = 3; + Group group = 4; + string hostname = 5; + repeated string labels = 6; + string name = 7; + User owner = 8; + string region = 9; + Graph resource_relationship = 10; + string risk_level = 11; + RiskLevelId risk_level_id = 12; + int32 risk_score = 13; + Sbom sbom = 14; + repeated KeyValueObject tags = 15; + string type = 16; + string uid = 17; + string uid_alt = 18; + Url url = 19; + string version = 20; +} + +message Attack { + Mitigation mitigation = 1; + SubTechnique sub_technique = 2; + Tactic tactic = 3; + repeated Tactic tactics = 4; + Technique technique = 5; + string version = 6; +} + +message AuthFactor { + enum FactorTypeId { + FACTOR_TYPE_ID_UNKNOWN = 0; + FACTOR_TYPE_ID_SMS = 1; + FACTOR_TYPE_ID_SECURITY_QUESTION = 2; + FACTOR_TYPE_ID_PHONE_CALL = 3; + FACTOR_TYPE_ID_BIOMETRIC = 4; + FACTOR_TYPE_ID_PUSH_NOTIFICATION = 5; + FACTOR_TYPE_ID_HARDWARE_TOKEN = 6; + FACTOR_TYPE_ID_OTP = 7; + FACTOR_TYPE_ID_EMAIL = 8; + FACTOR_TYPE_ID_U2F = 9; + FACTOR_TYPE_ID_WEBAUTHN = 10; + FACTOR_TYPE_ID_PASSWORD = 11; + FACTOR_TYPE_ID_OTHER = 99; + } + Device device = 1; + string email_addr = 2; + string factor_type = 3; + FactorTypeId factor_type_id = 4; + bool is_hotp = 5; + bool is_totp = 6; + string phone_number = 7; + string provider = 8; + repeated string security_questions = 9; +} + +message Authorization { + string decision = 1; + Policy policy = 2; +} + +message AutonomousSystem { + string name = 1; + int32 number = 2; +} + +message Campaign { + string name = 1; +} + +message Certificate { + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + repeated Fingerprint fingerprints = 5; + bool is_self_signed = 6; + string issuer = 7; + repeated San sans = 8; + string serial_number = 9; + string subject = 10; + string uid = 11; + string version = 12; +} + +message CisControl { + string desc = 1; + string name = 2; + string version = 3; +} + +message ClassifierDetails { + string name = 1; + string type = 2; + string uid = 3; +} + +message Cloud { + Account account = 1; + string cloud_partition = 2; + Organization org = 3; + string project_uid = 4; + string provider = 5; + string region = 6; + string zone = 7; +} + +message Container { + Fingerprint hash = 1; + Image image = 2; + repeated string labels = 3; + string name = 4; + string network_driver = 5; + string orchestrator = 6; + string pod_uuid = 7; + string runtime = 8; + int64 size = 9; + string tag = 10; + repeated KeyValueObject tags = 11; + string uid = 12; +} + +message Cve { + int64 created_time = 1; + string created_time_dt = 2; + repeated Cvss cvss = 3; + Cwe cwe = 4; + string cwe_uid = 5; + string cwe_url = 6; + string desc = 7; + Epss epss = 8; + int64 modified_time = 9; + string modified_time_dt = 10; + Product product = 11; + repeated string references = 12; + repeated Cwe related_cwes = 13; + string title = 14; + string type = 15; + string uid = 16; +} + +message Cvss { + double base_score = 1; + string depth = 2; + repeated Metric metrics = 3; + double overall_score = 4; + string severity = 5; + string src_url = 6; + string vector_string = 7; + string vendor_name = 8; + string version = 9; +} + +message Cwe { + string caption = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message D3fend { + D3fTactic d3f_tactic = 1; + D3fTechnique d3f_technique = 2; + string version = 3; +} + +message DataClassification { + enum CategoryId { + CATEGORY_ID_UNKNOWN = 0; + CATEGORY_ID_PERSONAL = 1; + CATEGORY_ID_GOVERNMENTAL = 2; + CATEGORY_ID_FINANCIAL = 3; + CATEGORY_ID_BUSINESS = 4; + CATEGORY_ID_MILITARY_AND_LAW_ENFORCEMENT = 5; + CATEGORY_ID_SECURITY = 6; + CATEGORY_ID_OTHER = 99; + } + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_COMPLETE = 1; + STATUS_ID_PARTIAL = 2; + STATUS_ID_FAIL = 3; + STATUS_ID_OTHER = 99; + } + string category = 1; + CategoryId category_id = 2; + ClassifierDetails classifier_details = 3; + string confidentiality = 4; + ConfidentialityId confidentiality_id = 5; + repeated DiscoveryDetails discovery_details = 6; + Policy policy = 7; + int64 size = 8; + string src_url = 9; + string status = 10; + repeated string status_details = 11; + StatusId status_id = 12; + int32 total = 13; + string uid = 14; +} + +message Device { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string autoscale_uid = 2; + int64 boot_time = 3; + string boot_time_dt = 4; + string boot_uid = 5; + Container container = 6; + int64 created_time = 7; + string created_time_dt = 8; + string desc = 9; + string domain = 10; + string eid = 11; + int64 first_seen_time = 12; + string first_seen_time_dt = 13; + repeated Group groups = 14; + string hostname = 15; + DeviceHwInfo hw_info = 16; + string hypervisor = 17; + string iccid = 18; + Image image = 19; + string imei = 20; + repeated string imei_list = 21; + string instance_uid = 22; + string interface_name = 23; + string interface_uid = 24; + string ip = 25; + bool is_backed_up = 26; + bool is_compliant = 27; + bool is_managed = 28; + bool is_mobile_account_active = 29; + bool is_personal = 30; + bool is_shared = 31; + bool is_supervised = 32; + bool is_trusted = 33; + int64 last_seen_time = 34; + string last_seen_time_dt = 35; + Location location = 36; + string mac = 37; + string mac_vendor = 38; + string meid = 39; + string model = 40; + int64 modified_time = 41; + string modified_time_dt = 42; + string name = 43; + int32 namespace_pid = 44; + repeated NetworkInterface network_interfaces = 45; + Organization org = 46; + Os os = 47; + string os_machine_uuid = 48; + User owner = 49; + Group pool = 50; + string region = 51; + string risk_level = 52; + RiskLevelId risk_level_id = 53; + int32 risk_score = 54; + string subnet = 55; + string subnet_uid = 56; + string type = 57; + TypeId type_id = 58; + string udid = 59; + string uid = 60; + string uid_alt = 61; + string vendor_name = 62; + string vlan_uid = 63; + string vpc_uid = 64; + string zone = 65; +} + +message DeviceHwInfo { + enum CpuArchitectureId { + CPU_ARCHITECTURE_ID_UNKNOWN = 0; + CPU_ARCHITECTURE_ID_X86 = 1; + CPU_ARCHITECTURE_ID_ARM = 2; + CPU_ARCHITECTURE_ID_RISC_V = 3; + CPU_ARCHITECTURE_ID_OTHER = 99; + } + string bios_date = 1; + string bios_manufacturer = 2; + string bios_ver = 3; + string chassis = 4; + string cpu_architecture = 5; + CpuArchitectureId cpu_architecture_id = 6; + int32 cpu_bits = 7; + int32 cpu_cores = 8; + int32 cpu_count = 9; + int32 cpu_speed = 10; + string cpu_type = 11; + Display desktop_display = 12; + int32 gpu_count = 13; + repeated GpuInfo gpu_info_list = 14; + KeyboardInfo keyboard_info = 15; + int32 ram_size = 16; + string serial_number = 17; + string uuid = 18; + string vendor_name = 19; +} + +message DigitalSignature { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DSA = 1; + ALGORITHM_ID_RSA = 2; + ALGORITHM_ID_ECDSA = 3; + ALGORITHM_ID_AUTHENTICODE = 4; + ALGORITHM_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_VALID = 1; + STATE_ID_EXPIRED = 2; + STATE_ID_REVOKED = 3; + STATE_ID_SUSPENDED = 4; + STATE_ID_PENDING = 5; + STATE_ID_UNTRUSTED = 6; + STATE_ID_DISTRUSTED = 7; + STATE_ID_WRONGUSAGE = 8; + STATE_ID_BAD = 9; + STATE_ID_BROKEN = 10; + STATE_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + string developer_uid = 6; + Fingerprint digest = 7; + string state = 8; + StateId state_id = 9; +} + +message DiscoveryDetails { + int32 count = 1; + OccurrenceDetails occurrence_details = 2; + repeated OccurrenceDetails occurrences = 3; + string type = 4; + string value = 5; +} + +message Display { + int32 color_depth = 1; + int32 physical_height = 2; + int32 physical_orientation = 3; + int32 physical_width = 4; + int32 scale_factor = 5; +} + +message DnsAnswer { + enum FlagIds { + FLAG_IDS_UNKNOWN = 0; + FLAG_IDS_AUTHORITATIVE_ANSWER = 1; + FLAG_IDS_TRUNCATED_RESPONSE = 2; + FLAG_IDS_RECURSION_DESIRED = 3; + FLAG_IDS_RECURSION_AVAILABLE = 4; + FLAG_IDS_AUTHENTIC_DATA = 5; + FLAG_IDS_CHECKING_DISABLED = 6; + FLAG_IDS_OTHER = 99; + } + string class = 1; + repeated FlagIds flag_ids = 2; + repeated string flags = 3; + int32 packet_uid = 4; + string rdata = 5; + int32 ttl = 6; + string type = 7; +} + +message DomainContact { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGISTRANT = 1; + TYPE_ID_ADMINISTRATIVE = 2; + TYPE_ID_TECHNICAL = 3; + TYPE_ID_BILLING = 4; + TYPE_ID_ABUSE = 5; + TYPE_ID_OTHER = 99; + } + string email_addr = 1; + Location location = 2; + string name = 3; + string phone_number = 4; + string type = 5; + TypeId type_id = 6; + string uid = 7; +} + +message Edge { + google.protobuf.Value data = 1; + bool is_directed = 2; + string name = 3; + string relation = 4; + string source = 5; + string target = 6; + string uid = 7; +} + +message Email { + repeated string cc = 1; + repeated string cc_mailboxes = 2; + DataClassification data_classification = 3; + repeated DataClassification data_classifications = 4; + string delivered_to = 5; + repeated string delivered_to_list = 6; + repeated File files = 7; + string from = 8; + repeated string from_list = 9; + string from_mailbox = 10; + repeated string from_mailboxes = 11; + repeated HttpHeader http_headers = 12; + bool is_read = 13; + string message_uid = 14; + string raw_header = 15; + string reply_to = 16; + repeated string reply_to_list = 17; + repeated string reply_to_mailboxes = 18; + string return_path = 19; + string sender = 20; + string sender_mailbox = 21; + int64 size = 22; + string smtp_from = 23; + repeated string smtp_to = 24; + string subject = 25; + repeated string to = 26; + repeated string to_mailboxes = 27; + string uid = 28; + repeated Url urls = 29; + repeated string x_originating_ip = 30; +} + +message EmailAuth { + string dkim = 1; + string dkim_domain = 2; + string dkim_signature = 3; + string dmarc = 4; + string dmarc_override = 5; + string dmarc_policy = 6; + string spf = 7; +} + +message EncryptionDetails { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_DES = 1; + ALGORITHM_ID_TRIPLEDES = 2; + ALGORITHM_ID_AES = 3; + ALGORITHM_ID_RSA = 4; + ALGORITHM_ID_ECC = 5; + ALGORITHM_ID_SM2 = 6; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + int32 key_length = 3; + string key_uid = 4; + string type = 5; +} + +message Enrichment { + int64 created_time = 1; + string created_time_dt = 2; + google.protobuf.Value data = 3; + string desc = 4; + string name = 5; + string provider = 6; + Reputation reputation = 7; + string short_desc = 8; + string src_url = 9; + string type = 10; + string value = 11; +} + +message EnvironmentVariable { + string name = 1; + string value = 2; +} + +message Epss { + int64 created_time = 1; + string created_time_dt = 2; + double percentile = 3; + string score = 4; + string version = 5; +} + +message Extension { + string name = 1; + string uid = 2; + string version = 3; +} + +message Feature { + string name = 1; + string uid = 2; + string version = 3; +} + +message File { + enum ConfidentialityId { + CONFIDENTIALITY_ID_UNKNOWN = 0; + CONFIDENTIALITY_ID_NOT_CONFIDENTIAL = 1; + CONFIDENTIALITY_ID_CONFIDENTIAL = 2; + CONFIDENTIALITY_ID_SECRET = 3; + CONFIDENTIALITY_ID_TOP_SECRET = 4; + CONFIDENTIALITY_ID_PRIVATE = 5; + CONFIDENTIALITY_ID_RESTRICTED = 6; + CONFIDENTIALITY_ID_OTHER = 99; + } + enum DriveTypeId { + DRIVE_TYPE_ID_UNKNOWN = 0; + DRIVE_TYPE_ID_REMOVABLE = 1; + DRIVE_TYPE_ID_FIXED = 2; + DRIVE_TYPE_ID_REMOTE = 3; + DRIVE_TYPE_ID_CD_ROM = 4; + DRIVE_TYPE_ID_RAM_DISK = 5; + DRIVE_TYPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_REGULAR_FILE = 1; + TYPE_ID_FOLDER = 2; + TYPE_ID_CHARACTER_DEVICE = 3; + TYPE_ID_BLOCK_DEVICE = 4; + TYPE_ID_LOCAL_SOCKET = 5; + TYPE_ID_NAMED_PIPE = 6; + TYPE_ID_SYMBOLIC_LINK = 7; + TYPE_ID_EXECUTABLE_FILE = 8; + TYPE_ID_OTHER = 99; + } + int64 accessed_time = 1; + string accessed_time_dt = 2; + User accessor = 3; + int32 attributes = 4; + string company_name = 5; + string confidentiality = 6; + ConfidentialityId confidentiality_id = 7; + int64 created_time = 8; + string created_time_dt = 9; + User creator = 10; + DataClassification data_classification = 11; + repeated DataClassification data_classifications = 12; + string desc = 13; + string drive_type = 14; + DriveTypeId drive_type_id = 15; + EncryptionDetails encryption_details = 16; + string ext = 17; + repeated Fingerprint hashes = 18; + repeated string imported_symbols = 19; + string internal_name = 20; + bool is_deleted = 21; + bool is_encrypted = 22; + bool is_public = 23; + bool is_readonly = 24; + bool is_system = 25; + string mime_type = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + User modifier = 29; + string name = 30; + User owner = 31; + string parent_folder = 32; + string path = 33; + Product product = 34; + string security_descriptor = 35; + DigitalSignature signature = 36; + repeated DigitalSignature signatures = 37; + int64 size = 38; + string storage_class = 39; + repeated KeyValueObject tags = 40; + string type = 41; + TypeId type_id = 42; + string uid = 43; + string uri = 44; + Url url = 45; + string version = 46; + string volume = 47; + google.protobuf.Value xattributes = 48; +} + +message Fingerprint { + enum AlgorithmId { + ALGORITHM_ID_UNKNOWN = 0; + ALGORITHM_ID_MD5 = 1; + ALGORITHM_ID_SHA_1 = 2; + ALGORITHM_ID_SHA_256 = 3; + ALGORITHM_ID_SHA_512 = 4; + ALGORITHM_ID_CTPH = 5; + ALGORITHM_ID_TLSH = 6; + ALGORITHM_ID_QUICKXORHASH = 7; + ALGORITHM_ID_SHA_224 = 8; + ALGORITHM_ID_SHA_384 = 9; + ALGORITHM_ID_SHA_512_224 = 10; + ALGORITHM_ID_SHA_512_256 = 11; + ALGORITHM_ID_SHA3_224 = 12; + ALGORITHM_ID_SHA3_256 = 13; + ALGORITHM_ID_SHA3_384 = 14; + ALGORITHM_ID_SHA3_512 = 15; + ALGORITHM_ID_XXHASH_H3_64_BIT = 16; + ALGORITHM_ID_XXHASH_H3_128_BIT = 17; + ALGORITHM_ID_IMPHASH = 18; + ALGORITHM_ID_NPF = 19; + ALGORITHM_ID_HASSH = 20; + ALGORITHM_ID_OTHER = 99; + } + string algorithm = 1; + AlgorithmId algorithm_id = 2; + string value = 3; +} + +message FirewallRule { + string category = 1; + string condition = 2; + string desc = 3; + int64 duration = 4; + repeated string match_details = 5; + string match_location = 6; + string name = 7; + int32 rate_limit = 8; + string sensitivity = 9; + string type = 10; + string uid = 11; + string version = 12; +} + +message GpuInfo { + enum BusTypeId { + BUS_TYPE_ID_UNKNOWN = 0; + BUS_TYPE_ID_ONBOARD = 1; + BUS_TYPE_ID_PCIE_X16 = 2; + BUS_TYPE_ID_PCIE_X8 = 3; + BUS_TYPE_ID_MXM_TYPE_A = 4; + BUS_TYPE_ID_MXM_TYPE_B = 5; + BUS_TYPE_ID_M_2 = 6; + BUS_TYPE_ID_CXL = 7; + BUS_TYPE_ID_OTHER = 99; + } + enum VramModeId { + VRAM_MODE_ID_UNKNOWN = 0; + VRAM_MODE_ID_SHARED = 1; + VRAM_MODE_ID_DEDICATED = 2; + VRAM_MODE_ID_OTHER = 99; + } + string bus_type = 1; + BusTypeId bus_type_id = 2; + int32 cores = 3; + string model = 4; + string vendor_name = 5; + string vram_mode = 6; + VramModeId vram_mode_id = 7; + int32 vram_size = 8; +} + +message Graph { + enum QueryLanguageId { + QUERY_LANGUAGE_ID_UNKNOWN = 0; + QUERY_LANGUAGE_ID_CYPHER = 1; + QUERY_LANGUAGE_ID_GRAPHQL = 2; + QUERY_LANGUAGE_ID_GREMLIN = 3; + QUERY_LANGUAGE_ID_GQL = 4; + QUERY_LANGUAGE_ID_G_CORE = 5; + QUERY_LANGUAGE_ID_PGQL = 6; + QUERY_LANGUAGE_ID_SPARQL = 7; + QUERY_LANGUAGE_ID_OTHER = 99; + } + string desc = 1; + repeated Edge edges = 2; + bool is_directed = 3; + string name = 4; + repeated Node nodes = 5; + string query_language = 6; + QueryLanguageId query_language_id = 7; + string type = 8; + string uid = 9; +} + +message Group { + string desc = 1; + string domain = 2; + string name = 3; + repeated string privileges = 4; + string type = 5; + string uid = 6; + string uid_alt = 7; +} + +message HttpHeader { + string name = 1; + string value = 2; +} + +message HttpRequest { + string args = 1; + int32 body_length = 2; + repeated HttpHeader http_headers = 3; + string http_method = 4; + int32 length = 5; + string referrer = 6; + string uid = 7; + Url url = 8; + string user_agent = 9; + string version = 10; + repeated string x_forwarded_for = 11; +} + +message HttpResponse { + int32 body_length = 1; + int32 code = 2; + string content_type = 3; + repeated HttpHeader http_headers = 4; + int32 latency = 5; + int32 length = 6; + string message = 7; + string status = 8; +} + +message Idp { + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_ACTIVE = 1; + STATE_ID_SUSPENDED = 2; + STATE_ID_DEPRECATED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + repeated AuthFactor auth_factors = 1; + string domain = 2; + Fingerprint fingerprint = 3; + bool has_mfa = 4; + string issuer = 5; + string name = 6; + string protocol_name = 7; + Scim scim = 8; + Sso sso = 9; + string state = 10; + StateId state_id = 11; + string tenant_uid = 12; + string uid = 13; + string url_string = 14; +} + +message Image { + repeated string labels = 1; + string name = 2; + string path = 3; + string tag = 4; + repeated KeyValueObject tags = 5; + string uid = 6; +} + +message KbArticle { + enum InstallStateId { + INSTALL_STATE_ID_UNKNOWN = 0; + INSTALL_STATE_ID_INSTALLED = 1; + INSTALL_STATE_ID_NOT_INSTALLED = 2; + INSTALL_STATE_ID_INSTALLED_PENDING_REBOOT = 3; + INSTALL_STATE_ID_OTHER = 99; + } + Timespan avg_timespan = 1; + string bulletin = 2; + string classification = 3; + int64 created_time = 4; + string created_time_dt = 5; + string install_state = 6; + InstallStateId install_state_id = 7; + bool is_superseded = 8; + Os os = 9; + Product product = 10; + string severity = 11; + int64 size = 12; + string src_url = 13; + string title = 14; + string uid = 15; +} + +message KeyValueObject { + string name = 1; + string value = 2; + repeated string values = 3; +} + +message KeyboardInfo { + int32 function_keys = 1; + string ime = 2; + string keyboard_layout = 3; + int32 keyboard_subtype = 4; + string keyboard_type = 5; +} + +message KillChainPhase { + enum PhaseId { + PHASE_ID_UNKNOWN = 0; + PHASE_ID_RECONNAISSANCE = 1; + PHASE_ID_WEAPONIZATION = 2; + PHASE_ID_DELIVERY = 3; + PHASE_ID_EXPLOITATION = 4; + PHASE_ID_INSTALLATION = 5; + PHASE_ID_COMMAND_CONTROL = 6; + PHASE_ID_ACTIONS_ON_OBJECTIVES = 7; + PHASE_ID_OTHER = 99; + } + string phase = 1; + PhaseId phase_id = 2; +} + +message LdapPerson { + string cost_center = 1; + int64 created_time = 2; + string created_time_dt = 3; + int64 deleted_time = 4; + string deleted_time_dt = 5; + string department = 6; + string display_name = 7; + repeated string email_addrs = 8; + string employee_uid = 9; + string given_name = 10; + int64 hire_time = 11; + string hire_time_dt = 12; + string job_title = 13; + repeated string labels = 14; + int64 last_login_time = 15; + string last_login_time_dt = 16; + string ldap_cn = 17; + string ldap_dn = 18; + int64 leave_time = 19; + string leave_time_dt = 20; + Location location = 21; + User manager = 22; + int64 modified_time = 23; + string modified_time_dt = 24; + string office_location = 25; + string phone_number = 26; + string surname = 27; + repeated KeyValueObject tags = 28; +} + +message Location { + string aerial_height = 1; + string city = 2; + string continent = 3; + repeated double coordinates = 4; + string country = 5; + string desc = 6; + string geodetic_altitude = 7; + string geodetic_vertical_accuracy = 8; + string geohash = 9; + string horizontal_accuracy = 10; + bool is_on_premises = 11; + string isp = 12; + double lat = 13; + double long = 14; + string postal_code = 15; + string pressure_altitude = 16; + string provider = 17; + string region = 18; +} + +message Logger { + Device device = 1; + string event_uid = 2; + bool is_truncated = 3; + string log_format = 4; + string log_level = 5; + string log_name = 6; + string log_provider = 7; + string log_version = 8; + int64 logged_time = 9; + string logged_time_dt = 10; + string name = 11; + Product product = 12; + int64 transmit_time = 13; + string transmit_time_dt = 14; + string uid = 15; + int32 untruncated_size = 16; + string version = 17; +} + +message LongString { + bool is_truncated = 1; + int32 untruncated_size = 2; + string value = 3; +} + +message Malware { + enum ClassificationIds { + CLASSIFICATION_IDS_UNKNOWN = 0; + CLASSIFICATION_IDS_ADWARE = 1; + CLASSIFICATION_IDS_BACKDOOR = 2; + CLASSIFICATION_IDS_BOT = 3; + CLASSIFICATION_IDS_BOOTKIT = 4; + CLASSIFICATION_IDS_DDOS = 5; + CLASSIFICATION_IDS_DOWNLOADER = 6; + CLASSIFICATION_IDS_DROPPER = 7; + CLASSIFICATION_IDS_EXPLOIT_KIT = 8; + CLASSIFICATION_IDS_KEYLOGGER = 9; + CLASSIFICATION_IDS_RANSOMWARE = 10; + CLASSIFICATION_IDS_REMOTE_ACCESS_TROJAN = 11; + CLASSIFICATION_IDS_RESOURCE_EXPLOITATION = 13; + CLASSIFICATION_IDS_ROGUE_SECURITY_SOFTWARE = 14; + CLASSIFICATION_IDS_ROOTKIT = 15; + CLASSIFICATION_IDS_SCREEN_CAPTURE = 16; + CLASSIFICATION_IDS_SPYWARE = 17; + CLASSIFICATION_IDS_TROJAN = 18; + CLASSIFICATION_IDS_VIRUS = 19; + CLASSIFICATION_IDS_WEBSHELL = 20; + CLASSIFICATION_IDS_WIPER = 21; + CLASSIFICATION_IDS_WORM = 22; + CLASSIFICATION_IDS_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + repeated ClassificationIds classification_ids = 1; + repeated string classifications = 2; + repeated Cve cves = 3; + repeated File files = 4; + string name = 5; + int32 num_infected = 6; + string path = 7; + string provider = 8; + string severity = 9; + SeverityId severity_id = 10; + string uid = 11; +} + +message MalwareScanInfo { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MANUAL = 1; + TYPE_ID_SCHEDULED = 2; + TYPE_ID_UPDATED_CONTENT = 3; + TYPE_ID_QUARANTINED_ITEMS = 4; + TYPE_ID_ATTACHED_MEDIA = 5; + TYPE_ID_USER_LOGON = 6; + TYPE_ID_ELAM = 7; + TYPE_ID_OTHER = 99; + } + int64 end_time = 1; + string end_time_dt = 2; + string name = 3; + int32 num_files = 4; + int32 num_infected = 5; + int32 num_volumes = 6; + int64 size = 7; + int64 start_time = 8; + string start_time_dt = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + int32 unique_malware_count = 13; +} + +message ManagedEntity { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_DEVICE = 1; + TYPE_ID_USER = 2; + TYPE_ID_GROUP = 3; + TYPE_ID_ORGANIZATION = 4; + TYPE_ID_POLICY = 5; + TYPE_ID_EMAIL = 6; + TYPE_ID_NETWORK_ZONE = 7; + TYPE_ID_OTHER = 99; + } + google.protobuf.Value data = 1; + Device device = 2; + Email email = 3; + Group group = 4; + Location location = 5; + string name = 6; + Organization org = 7; + Policy policy = 8; + string type = 9; + TypeId type_id = 10; + string uid = 11; + User user = 12; + string version = 13; +} + +message MessageContext { + enum AiRoleId { + AI_ROLE_ID_UNKNOWN = 0; + AI_ROLE_ID_USER = 1; + AI_ROLE_ID_ASSISTANT = 2; + AI_ROLE_ID_TOOL = 3; + AI_ROLE_ID_AGENT = 4; + AI_ROLE_ID_ORCHESTRATOR = 5; + AI_ROLE_ID_RETRIEVER = 6; + AI_ROLE_ID_OTHER = 99; + } + string ai_role = 1; + AiRoleId ai_role_id = 2; + Application application = 3; + int32 completion_tokens = 4; + string name = 5; + int32 prompt_tokens = 6; + Service service = 7; + int32 total_tokens = 8; + string uid = 9; +} + +message Metadata { + string correlation_uid = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + repeated string debug = 4; + string event_code = 5; + Extension extension = 6; + repeated Extension extensions = 7; + bool is_truncated = 8; + repeated string labels = 9; + string log_format = 10; + string log_level = 11; + string log_name = 12; + string log_provider = 13; + string log_source = 14; + string log_version = 15; + int64 logged_time = 16; + string logged_time_dt = 17; + repeated Logger loggers = 18; + int64 modified_time = 19; + string modified_time_dt = 20; + string original_event_uid = 21; + string original_time = 22; + int64 processed_time = 23; + string processed_time_dt = 24; + Product product = 25; + repeated string profiles = 26; + Reporter reporter = 27; + int32 sequence = 28; + string source = 29; + repeated KeyValueObject tags = 30; + string tenant_uid = 31; + Timespan total_queued_duration = 32; + repeated TransformationInfo transformation_info_list = 33; + int64 transmit_time = 34; + string transmit_time_dt = 35; + string type = 36; + string uid = 37; + int32 untruncated_size = 38; + string version = 39; +} + +message Metric { + string name = 1; + string value = 2; +} + +message Mitigation { + repeated D3fend countermeasures = 1; + string name = 2; + string src_url = 3; + string uid = 4; +} + +message NetworkEndpoint { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message NetworkInterface { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WIRED = 1; + TYPE_ID_WIRELESS = 2; + TYPE_ID_MOBILE = 3; + TYPE_ID_TUNNEL = 4; + TYPE_ID_OTHER = 99; + } + string hostname = 1; + string ip = 2; + string mac = 3; + string name = 4; + string namespace = 5; + repeated PortInfo open_ports = 6; + int32 subnet_prefix = 7; + string type = 8; + TypeId type_id = 9; + string uid = 10; +} + +message NetworkProxy { + enum NetworkScopeId { + NETWORK_SCOPE_ID_UNKNOWN = 0; + NETWORK_SCOPE_ID_INTERNAL = 1; + NETWORK_SCOPE_ID_EXTERNAL = 2; + NETWORK_SCOPE_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SERVER = 1; + TYPE_ID_DESKTOP = 2; + TYPE_ID_LAPTOP = 3; + TYPE_ID_TABLET = 4; + TYPE_ID_MOBILE = 5; + TYPE_ID_VIRTUAL = 6; + TYPE_ID_IOT = 7; + TYPE_ID_BROWSER = 8; + TYPE_ID_FIREWALL = 9; + TYPE_ID_SWITCH = 10; + TYPE_ID_HUB = 11; + TYPE_ID_ROUTER = 12; + TYPE_ID_IDS = 13; + TYPE_ID_IPS = 14; + TYPE_ID_LOAD_BALANCER = 15; + TYPE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + AutonomousSystem autonomous_system = 2; + Container container = 3; + string domain = 4; + repeated Fingerprint fingerprints = 5; + string hostname = 6; + DeviceHwInfo hw_info = 7; + string instance_uid = 8; + string interface_name = 9; + string interface_uid = 10; + repeated string intermediate_ips = 11; + string ip = 12; + string isp = 13; + string isp_org = 14; + Location location = 15; + string mac = 16; + string mac_vendor = 17; + string name = 18; + int32 namespace_pid = 19; + string network_scope = 20; + NetworkScopeId network_scope_id = 21; + Os os = 22; + User owner = 23; + Group pool = 24; + int32 port = 25; + NetworkProxy proxy_endpoint = 26; + string subnet_uid = 27; + string svc_name = 28; + string type = 29; + TypeId type_id = 30; + string uid = 31; + string vlan_uid = 32; + string vpc_uid = 33; + string zone = 34; +} + +message Node { + google.protobuf.Value data = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; +} + +message Observable { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_HOSTNAME = 1; + TYPE_ID_IP_ADDRESS = 2; + TYPE_ID_MAC_ADDRESS = 3; + TYPE_ID_USER_NAME = 4; + TYPE_ID_EMAIL_ADDRESS = 5; + TYPE_ID_URL_STRING = 6; + TYPE_ID_FILE_NAME = 7; + TYPE_ID_HASH = 8; + TYPE_ID_PROCESS_NAME = 9; + TYPE_ID_RESOURCE_UID = 10; + TYPE_ID_PORT = 11; + TYPE_ID_SUBNET = 12; + TYPE_ID_COMMAND_LINE = 13; + TYPE_ID_COUNTRY = 14; + TYPE_ID_PROCESS_ID = 15; + TYPE_ID_HTTP_USER_AGENT = 16; + TYPE_ID_CWE_OBJECT_UID = 17; + TYPE_ID_CVE_OBJECT_UID = 18; + TYPE_ID_USER_CREDENTIAL_ID = 19; + TYPE_ID_ENDPOINT = 20; + TYPE_ID_USER = 21; + TYPE_ID_EMAIL = 22; + TYPE_ID_UNIFORM_RESOURCE_LOCATOR = 23; + TYPE_ID_FILE = 24; + TYPE_ID_PROCESS = 25; + TYPE_ID_GEO_LOCATION = 26; + TYPE_ID_CONTAINER = 27; + TYPE_ID_REGISTRY_KEY = 28; + TYPE_ID_REGISTRY_VALUE = 29; + TYPE_ID_FINGERPRINT = 30; + TYPE_ID_USER_OBJECT_UID = 31; + TYPE_ID_GROUP_OBJECT_NAME = 32; + TYPE_ID_GROUP_OBJECT_UID = 33; + TYPE_ID_ACCOUNT_OBJECT_NAME = 34; + TYPE_ID_ACCOUNT_OBJECT_UID = 35; + TYPE_ID_SCRIPT_CONTENT = 36; + TYPE_ID_SERIAL_NUMBER = 37; + TYPE_ID_RESOURCE_DETAILS_OBJECT_NAME = 38; + TYPE_ID_PROCESS_ENTITY_OBJECT_UID = 39; + TYPE_ID_EMAIL_OBJECT_SUBJECT = 40; + TYPE_ID_EMAIL_OBJECT_UID = 41; + TYPE_ID_MESSAGE_UID = 42; + TYPE_ID_REGISTRY_VALUE_OBJECT_NAME = 43; + TYPE_ID_ADVISORY_OBJECT_UID = 44; + TYPE_ID_FILE_PATH = 45; + TYPE_ID_REGISTRY_KEY_PATH = 46; + TYPE_ID_DEVICE_OBJECT_UID = 47; + TYPE_ID_NETWORK_ENDPOINT_OBJECT_UID = 48; + TYPE_ID_OTHER = 99; + } + string event_uid = 1; + string name = 2; + Reputation reputation = 3; + string type = 4; + TypeId type_id = 5; + int64 type_uid = 6; + string value = 7; +} + +message OccurrenceDetails { + string cell_name = 1; + string column_name = 2; + int32 column_number = 3; + int32 end_line = 4; + string json_path = 5; + int32 page_number = 6; + int32 record_index_in_array = 7; + int32 row_number = 8; + int32 start_line = 9; +} + +message Organization { + string name = 1; + string ou_name = 2; + string ou_uid = 3; + string uid = 4; +} + +message Os { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_OTHER = 99; + TYPE_ID_WINDOWS = 100; + TYPE_ID_WINDOWS_MOBILE = 101; + TYPE_ID_LINUX = 200; + TYPE_ID_ANDROID = 201; + TYPE_ID_MACOS = 300; + TYPE_ID_IOS = 301; + TYPE_ID_IPADOS = 302; + TYPE_ID_SOLARIS = 400; + TYPE_ID_AIX = 401; + TYPE_ID_HP_UX = 402; + } + string build = 1; + string country = 2; + string cpe_name = 3; + int32 cpu_bits = 4; + string edition = 5; + string kernel_release = 6; + string lang = 7; + string name = 8; + string sp_name = 9; + int32 sp_ver = 10; + string type = 11; + TypeId type_id = 12; + string version = 13; +} + +message Osint { + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DetectionPatternTypeId { + DETECTION_PATTERN_TYPE_ID_UNKNOWN = 0; + DETECTION_PATTERN_TYPE_ID_STIX = 1; + DETECTION_PATTERN_TYPE_ID_PCRE = 2; + DETECTION_PATTERN_TYPE_ID_SIGMA = 3; + DETECTION_PATTERN_TYPE_ID_SNORT = 4; + DETECTION_PATTERN_TYPE_ID_SURICATA = 5; + DETECTION_PATTERN_TYPE_ID_YARA = 6; + DETECTION_PATTERN_TYPE_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_IP_ADDRESS = 1; + TYPE_ID_DOMAIN = 2; + TYPE_ID_HOSTNAME = 3; + TYPE_ID_HASH = 4; + TYPE_ID_URL = 5; + TYPE_ID_USER_AGENT = 6; + TYPE_ID_DIGITAL_CERTIFICATE = 7; + TYPE_ID_EMAIL = 8; + TYPE_ID_EMAIL_ADDRESS = 9; + TYPE_ID_VULNERABILITY = 10; + TYPE_ID_FILE = 11; + TYPE_ID_REGISTRY_KEY = 12; + TYPE_ID_REGISTRY_VALUE = 13; + TYPE_ID_COMMAND_LINE = 14; + TYPE_ID_OTHER = 99; + } + repeated DnsAnswer answers = 1; + repeated Attack attacks = 2; + AutonomousSystem autonomous_system = 3; + Campaign campaign = 4; + string category = 5; + string comment = 6; + string confidence = 7; + ConfidenceId confidence_id = 8; + int64 created_time = 9; + string created_time_dt = 10; + User creator = 11; + string desc = 12; + string detection_pattern = 13; + string detection_pattern_type = 14; + DetectionPatternTypeId detection_pattern_type_id = 15; + Email email = 16; + EmailAuth email_auth = 17; + int64 expiration_time = 18; + string expiration_time_dt = 19; + string external_uid = 20; + File file = 21; + repeated string intrusion_sets = 22; + repeated KillChainPhase kill_chain = 23; + repeated string labels = 24; + Location location = 25; + repeated Malware malware = 26; + int64 modified_time = 27; + string modified_time_dt = 28; + string name = 29; + repeated string references = 30; + repeated Analytic related_analytics = 31; + Reputation reputation = 32; + int32 risk_score = 33; + Script script = 34; + string severity = 35; + SeverityId severity_id = 36; + repeated DigitalSignature signatures = 37; + string src_url = 38; + repeated string subdomains = 39; + string subnet = 40; + ThreatActor threat_actor = 41; + string tlp = 42; + string type = 43; + TypeId type_id = 44; + string uid = 45; + int64 uploaded_time = 46; + string uploaded_time_dt = 47; + string value = 48; + string vendor_name = 49; + repeated Vulnerability vulnerabilities = 50; + Whois whois = 51; +} + +message Package { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_APPLICATION = 1; + TYPE_ID_OPERATING_SYSTEM = 2; + TYPE_ID_OTHER = 99; + } + string architecture = 1; + string cpe_name = 2; + int32 epoch = 3; + Fingerprint hash = 4; + string license = 5; + string license_url = 6; + string name = 7; + string package_manager = 8; + string package_manager_url = 9; + string purl = 10; + string release = 11; + string src_url = 12; + string type = 13; + TypeId type_id = 14; + string uid = 15; + string vendor_name = 16; + string version = 17; +} + +message Policy { + google.protobuf.Value data = 1; + string desc = 2; + Group group = 3; + bool is_applied = 4; + string name = 5; + string type = 6; + string uid = 7; + string version = 8; +} + +message PortInfo { + int32 port = 1; + string protocol_name = 2; + int32 protocol_num = 3; +} + +message Process { + enum IntegrityId { + INTEGRITY_ID_UNKNOWN = 0; + INTEGRITY_ID_UNTRUSTED = 1; + INTEGRITY_ID_LOW = 2; + INTEGRITY_ID_MEDIUM = 3; + INTEGRITY_ID_HIGH = 4; + INTEGRITY_ID_SYSTEM = 5; + INTEGRITY_ID_PROTECTED = 6; + INTEGRITY_ID_OTHER = 99; + } + repeated ProcessEntity ancestry = 1; + int32 auid = 2; + string cmd_line = 3; + Container container = 4; + string cpid = 5; + int64 created_time = 6; + string created_time_dt = 7; + int32 egid = 8; + repeated EnvironmentVariable environment_variables = 9; + int32 euid = 10; + File file = 11; + Group group = 12; + repeated WinService hosted_services = 13; + string integrity = 14; + IntegrityId integrity_id = 15; + repeated string lineage = 16; + repeated string loaded_modules = 17; + string name = 18; + int32 namespace_pid = 19; + Process parent_process = 20; + string path = 21; + int32 pid = 22; + int64 ptid = 23; + string sandbox = 24; + Session session = 25; + int64 terminated_time = 26; + string terminated_time_dt = 27; + int32 tid = 28; + string uid = 29; + User user = 30; + string working_directory = 31; + google.protobuf.Value xattributes = 32; +} + +message ProcessEntity { + string cmd_line = 1; + string cpid = 2; + int64 created_time = 3; + string created_time_dt = 4; + string name = 5; + string path = 6; + int32 pid = 7; + string uid = 8; +} + +message Product { + string cpe_name = 1; + DataClassification data_classification = 2; + repeated DataClassification data_classifications = 3; + Feature feature = 4; + string lang = 5; + string name = 6; + string path = 7; + string uid = 8; + string url_string = 9; + string vendor_name = 10; + string version = 11; +} + +message ProgrammaticCredential { + int64 last_used_time = 1; + string last_used_time_dt = 2; + string type = 3; + string uid = 4; +} + +message Remediation { + repeated CisControl cis_controls = 1; + string desc = 2; + repeated KbArticle kb_article_list = 3; + repeated string kb_articles = 4; + repeated string references = 5; +} + +message Reporter { + string hostname = 1; + string ip = 2; + string name = 3; + Organization org = 4; + string uid = 5; +} + +message Reputation { + enum ScoreId { + SCORE_ID_UNKNOWN = 0; + SCORE_ID_VERY_SAFE = 1; + SCORE_ID_SAFE = 2; + SCORE_ID_PROBABLY_SAFE = 3; + SCORE_ID_LEANS_SAFE = 4; + SCORE_ID_MAY_NOT_BE_SAFE = 5; + SCORE_ID_EXERCISE_CAUTION = 6; + SCORE_ID_SUSPICIOUS_RISKY = 7; + SCORE_ID_POSSIBLY_MALICIOUS = 8; + SCORE_ID_PROBABLY_MALICIOUS = 9; + SCORE_ID_MALICIOUS = 10; + SCORE_ID_OTHER = 99; + } + double base_score = 1; + string provider = 2; + string score = 3; + ScoreId score_id = 4; +} + +message Request { + repeated Container containers = 1; + google.protobuf.Value data = 2; + repeated string flags = 3; + string uid = 4; +} + +message ResourceDetails { + enum RoleId { + ROLE_ID_UNKNOWN = 0; + ROLE_ID_TARGET = 1; + ROLE_ID_ACTOR = 2; + ROLE_ID_AFFECTED = 3; + ROLE_ID_RELATED = 4; + ROLE_ID_OTHER = 99; + } + repeated Agent agent_list = 1; + string cloud_partition = 2; + int64 created_time = 3; + string created_time_dt = 4; + string criticality = 5; + google.protobuf.Value data = 6; + DataClassification data_classification = 7; + repeated DataClassification data_classifications = 8; + Group group = 9; + string hostname = 10; + string ip = 11; + bool is_backed_up = 12; + repeated string labels = 13; + int64 modified_time = 14; + string modified_time_dt = 15; + string name = 16; + string namespace = 17; + User owner = 18; + string provider = 19; + string region = 20; + Graph resource_relationship = 21; + string role = 22; + RoleId role_id = 23; + repeated KeyValueObject tags = 24; + string type = 25; + string uid = 26; + string uid_alt = 27; + string version = 28; + string zone = 29; +} + +message Response { + int32 code = 1; + repeated Container containers = 2; + google.protobuf.Value data = 3; + string error = 4; + string error_message = 5; + repeated string flags = 6; + string message = 7; +} + +message Rule { + string category = 1; + string desc = 2; + string name = 3; + string type = 4; + string uid = 5; + string version = 6; +} + +message San { + string name = 1; + string type = 2; +} + +message Sbom { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_SPDX = 1; + TYPE_ID_CYCLONEDX = 2; + TYPE_ID_SWID = 3; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + Package package = 3; + Product product = 4; + repeated SoftwareComponent software_components = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; + string version = 9; +} + +message Scim { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + enum StateId { + STATE_ID_UNKNOWN = 0; + STATE_ID_PENDING = 1; + STATE_ID_ACTIVE = 2; + STATE_ID_FAILED = 3; + STATE_ID_DELETED = 4; + STATE_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + int64 created_time = 3; + string created_time_dt = 4; + string error_message = 5; + bool is_group_provisioning_enabled = 6; + bool is_user_provisioning_enabled = 7; + int64 last_run_time = 8; + string last_run_time_dt = 9; + int64 modified_time = 10; + string modified_time_dt = 11; + string name = 12; + string protocol_name = 13; + int32 rate_limit = 14; + google.protobuf.Value scim_group_schema = 15; + google.protobuf.Value scim_user_schema = 16; + string state = 17; + StateId state_id = 18; + string uid = 19; + string uid_alt = 20; + string url_string = 21; + string vendor_name = 22; + string version = 23; +} + +message Script { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_WINDOWS_COMMAND_PROMPT = 1; + TYPE_ID_POWERSHELL = 2; + TYPE_ID_PYTHON = 3; + TYPE_ID_JAVASCRIPT = 4; + TYPE_ID_VBSCRIPT = 5; + TYPE_ID_UNIX_SHELL = 6; + TYPE_ID_VBA = 7; + TYPE_ID_OTHER = 99; + } + File file = 1; + repeated Fingerprint hashes = 2; + string name = 3; + string parent_uid = 4; + LongString script_content = 5; + string type = 6; + TypeId type_id = 7; + string uid = 8; +} + +message Service { + repeated string labels = 1; + string name = 2; + repeated KeyValueObject tags = 3; + string uid = 4; + string version = 5; +} + +message Session { + int32 count = 1; + int64 created_time = 2; + string created_time_dt = 3; + string credential_uid = 4; + string expiration_reason = 5; + int64 expiration_time = 6; + string expiration_time_dt = 7; + bool is_mfa = 8; + bool is_remote = 9; + bool is_vpn = 10; + string issuer = 11; + string terminal = 12; + string uid = 13; + string uid_alt = 14; + string uuid = 15; +} + +message SoftwareComponent { + enum RelationshipId { + RELATIONSHIP_ID_UNKNOWN = 0; + RELATIONSHIP_ID_DEPENDS_ON = 1; + RELATIONSHIP_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_FRAMEWORK = 1; + TYPE_ID_LIBRARY = 2; + TYPE_ID_OPERATING_SYSTEM = 3; + TYPE_ID_OTHER = 99; + } + string author = 1; + Fingerprint hash = 2; + string license = 3; + string name = 4; + string purl = 5; + string related_component = 6; + string relationship = 7; + RelationshipId relationship_id = 8; + string type = 9; + TypeId type_id = 10; + string version = 11; +} + +message Span { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + string message = 4; + string operation = 5; + string parent_uid = 6; + Service service = 7; + int64 start_time = 8; + string start_time_dt = 9; + string status_code = 10; + string uid = 11; +} + +message Sso { + enum AuthProtocolId { + AUTH_PROTOCOL_ID_UNKNOWN = 0; + AUTH_PROTOCOL_ID_NTLM = 1; + AUTH_PROTOCOL_ID_KERBEROS = 2; + AUTH_PROTOCOL_ID_DIGEST = 3; + AUTH_PROTOCOL_ID_OPENID = 4; + AUTH_PROTOCOL_ID_SAML = 5; + AUTH_PROTOCOL_ID_OAUTH_2_0 = 6; + AUTH_PROTOCOL_ID_PAP = 7; + AUTH_PROTOCOL_ID_CHAP = 8; + AUTH_PROTOCOL_ID_EAP = 9; + AUTH_PROTOCOL_ID_RADIUS = 10; + AUTH_PROTOCOL_ID_BASIC_AUTHENTICATION = 11; + AUTH_PROTOCOL_ID_LDAP = 12; + AUTH_PROTOCOL_ID_OTHER = 99; + } + string auth_protocol = 1; + AuthProtocolId auth_protocol_id = 2; + Certificate certificate = 3; + int64 created_time = 4; + string created_time_dt = 5; + int32 duration_mins = 6; + int32 idle_timeout = 7; + string login_endpoint = 8; + string logout_endpoint = 9; + string metadata_endpoint = 10; + int64 modified_time = 11; + string modified_time_dt = 12; + string name = 13; + string protocol_name = 14; + repeated string scopes = 15; + string uid = 16; + string vendor_name = 17; +} + +message SubTechnique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Tactic { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message Technique { + string name = 1; + string src_url = 2; + string uid = 3; +} + +message ThreatActor { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_NATION_STATE = 1; + TYPE_ID_CYBERCRIMINAL = 2; + TYPE_ID_HACKTIVISTS = 3; + TYPE_ID_INSIDER = 4; + TYPE_ID_OTHER = 99; + } + string name = 1; + string type = 2; + TypeId type_id = 3; +} + +message Timespan { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_MILLISECONDS = 1; + TYPE_ID_SECONDS = 2; + TYPE_ID_MINUTES = 3; + TYPE_ID_HOURS = 4; + TYPE_ID_DAYS = 5; + TYPE_ID_WEEKS = 6; + TYPE_ID_MONTHS = 7; + TYPE_ID_YEARS = 8; + TYPE_ID_TIME_INTERVAL = 9; + TYPE_ID_OTHER = 99; + } + int64 duration = 1; + int32 duration_days = 2; + int32 duration_hours = 3; + int32 duration_mins = 4; + int32 duration_months = 5; + int32 duration_secs = 6; + int32 duration_weeks = 7; + int32 duration_years = 8; + int64 end_time = 9; + string end_time_dt = 10; + int64 start_time = 11; + string start_time_dt = 12; + string type = 13; + TypeId type_id = 14; +} + +message Token { + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_TICKET_GRANTING_TICKET = 1; + TYPE_ID_SERVICE_TICKET = 2; + TYPE_ID_IDENTITY_TOKEN = 3; + TYPE_ID_REFRESH_TOKEN = 4; + TYPE_ID_SAML_ASSERTION = 5; + TYPE_ID_CLIENT_TOKEN = 6; + TYPE_ID_API_TOKEN = 7; + TYPE_ID_OTHER = 99; + } + int64 created_time = 1; + string created_time_dt = 2; + int64 expiration_time = 3; + string expiration_time_dt = 4; + bool is_renewable = 5; + int64 modified_time = 6; + string modified_time_dt = 7; + string name = 8; + string tenant_uid = 9; + string type = 10; + TypeId type_id = 11; + string uid = 12; + string zone = 13; +} + +message Trace { + int64 duration = 1; + int64 end_time = 2; + string end_time_dt = 3; + repeated string flags = 4; + Service service = 5; + Span span = 6; + int64 start_time = 7; + string start_time_dt = 8; + string uid = 9; +} + +message TransformationInfo { + string lang = 1; + string name = 2; + Product product = 3; + int64 time = 4; + string time_dt = 5; + string uid = 6; + string url_string = 7; +} + +message Url { + enum CategoryIds { + CATEGORY_IDS_UNKNOWN = 0; + CATEGORY_IDS_ADULT_MATURE_CONTENT = 1; + CATEGORY_IDS_PORNOGRAPHY = 3; + CATEGORY_IDS_SEX_EDUCATION = 4; + CATEGORY_IDS_INTIMATE_APPAREL_SWIMSUIT = 5; + CATEGORY_IDS_NUDITY = 6; + CATEGORY_IDS_EXTREME = 7; + CATEGORY_IDS_SCAM_QUESTIONABLE_ILLEGAL = 9; + CATEGORY_IDS_GAMBLING = 11; + CATEGORY_IDS_VIOLENCE_HATE_RACISM = 14; + CATEGORY_IDS_WEAPONS = 15; + CATEGORY_IDS_ABORTION = 16; + CATEGORY_IDS_HACKING = 17; + CATEGORY_IDS_PHISHING = 18; + CATEGORY_IDS_ENTERTAINMENT = 20; + CATEGORY_IDS_BUSINESS_ECONOMY = 21; + CATEGORY_IDS_ALTERNATIVE_SPIRITUALITY_BELIEF = 22; + CATEGORY_IDS_ALCOHOL = 23; + CATEGORY_IDS_TOBACCO = 24; + CATEGORY_IDS_CONTROLLED_SUBSTANCES = 25; + CATEGORY_IDS_CHILD_PORNOGRAPHY = 26; + CATEGORY_IDS_EDUCATION = 27; + CATEGORY_IDS_CHARITABLE_ORGANIZATIONS = 29; + CATEGORY_IDS_ART_CULTURE = 30; + CATEGORY_IDS_FINANCIAL_SERVICES = 31; + CATEGORY_IDS_BROKERAGE_TRADING = 32; + CATEGORY_IDS_GAMES = 33; + CATEGORY_IDS_GOVERNMENT_LEGAL = 34; + CATEGORY_IDS_MILITARY = 35; + CATEGORY_IDS_POLITICAL_SOCIAL_ADVOCACY = 36; + CATEGORY_IDS_HEALTH = 37; + CATEGORY_IDS_TECHNOLOGY_INTERNET = 38; + CATEGORY_IDS_SEARCH_ENGINES_PORTALS = 40; + CATEGORY_IDS_MALICIOUS_SOURCES_MALNETS = 43; + CATEGORY_IDS_MALICIOUS_OUTBOUND_DATA_BOTNETS = 44; + CATEGORY_IDS_JOB_SEARCH_CAREERS = 45; + CATEGORY_IDS_NEWS_MEDIA = 46; + CATEGORY_IDS_PERSONALS_DATING = 47; + CATEGORY_IDS_REFERENCE = 49; + CATEGORY_IDS_MIXED_CONTENT_POTENTIALLY_ADULT = 50; + CATEGORY_IDS_CHAT_IM_SMS = 51; + CATEGORY_IDS_EMAIL = 52; + CATEGORY_IDS_NEWSGROUPS_FORUMS = 53; + CATEGORY_IDS_RELIGION = 54; + CATEGORY_IDS_SOCIAL_NETWORKING = 55; + CATEGORY_IDS_FILE_STORAGE_SHARING = 56; + CATEGORY_IDS_REMOTE_ACCESS_TOOLS = 57; + CATEGORY_IDS_SHOPPING = 58; + CATEGORY_IDS_AUCTIONS = 59; + CATEGORY_IDS_REAL_ESTATE = 60; + CATEGORY_IDS_SOCIETY_DAILY_LIVING = 61; + CATEGORY_IDS_PERSONAL_SITES = 63; + CATEGORY_IDS_RESTAURANTS_DINING_FOOD = 64; + CATEGORY_IDS_SPORTS_RECREATION = 65; + CATEGORY_IDS_TRAVEL = 66; + CATEGORY_IDS_VEHICLES = 67; + CATEGORY_IDS_HUMOR_JOKES = 68; + CATEGORY_IDS_SOFTWARE_DOWNLOADS = 71; + CATEGORY_IDS_PEER_TO_PEER_P2P = 83; + CATEGORY_IDS_AUDIO_VIDEO_CLIPS = 84; + CATEGORY_IDS_OFFICE_BUSINESS_APPLICATIONS = 85; + CATEGORY_IDS_PROXY_AVOIDANCE = 86; + CATEGORY_IDS_FOR_KIDS = 87; + CATEGORY_IDS_WEB_ADS_ANALYTICS = 88; + CATEGORY_IDS_WEB_HOSTING = 89; + CATEGORY_IDS_UNCATEGORIZED = 90; + CATEGORY_IDS_SUSPICIOUS = 92; + CATEGORY_IDS_SEXUAL_EXPRESSION = 93; + CATEGORY_IDS_TRANSLATION = 95; + CATEGORY_IDS_NON_VIEWABLE_INFRASTRUCTURE = 96; + CATEGORY_IDS_CONTENT_SERVERS = 97; + CATEGORY_IDS_PLACEHOLDERS = 98; + CATEGORY_IDS_OTHER = 99; + CATEGORY_IDS_SPAM = 101; + CATEGORY_IDS_POTENTIALLY_UNWANTED_SOFTWARE = 102; + CATEGORY_IDS_DYNAMIC_DNS_HOST = 103; + CATEGORY_IDS_E_CARD_INVITATIONS = 106; + CATEGORY_IDS_INFORMATIONAL = 107; + CATEGORY_IDS_COMPUTER_INFORMATION_SECURITY = 108; + CATEGORY_IDS_INTERNET_CONNECTED_DEVICES = 109; + CATEGORY_IDS_INTERNET_TELEPHONY = 110; + CATEGORY_IDS_ONLINE_MEETINGS = 111; + CATEGORY_IDS_MEDIA_SHARING = 112; + CATEGORY_IDS_RADIO_AUDIO_STREAMS = 113; + CATEGORY_IDS_TV_VIDEO_STREAMS = 114; + CATEGORY_IDS_PIRACY_COPYRIGHT_CONCERNS = 118; + CATEGORY_IDS_MARIJUANA = 121; + } + repeated string categories = 1; + repeated CategoryIds category_ids = 2; + string domain = 3; + string hostname = 4; + string path = 5; + int32 port = 6; + string query_string = 7; + string resource_type = 8; + string scheme = 9; + string subdomain = 10; + string url_string = 11; +} + +message User { + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum TypeId { + TYPE_ID_UNKNOWN = 0; + TYPE_ID_USER = 1; + TYPE_ID_ADMIN = 2; + TYPE_ID_SYSTEM = 3; + TYPE_ID_SERVICE = 4; + TYPE_ID_OTHER = 99; + } + Account account = 1; + string credential_uid = 2; + string display_name = 3; + string domain = 4; + string email_addr = 5; + string forward_addr = 6; + string full_name = 7; + repeated Group groups = 8; + bool has_mfa = 9; + LdapPerson ldap_person = 10; + string name = 11; + Organization org = 12; + string phone_number = 13; + repeated ProgrammaticCredential programmatic_credentials = 14; + string risk_level = 15; + RiskLevelId risk_level_id = 16; + int32 risk_score = 17; + string type = 18; + TypeId type_id = 19; + string uid = 20; + string uid_alt = 21; +} + +message Vulnerability { + enum FixCoverageId { + FIX_COVERAGE_ID_UNKNOWN = 0; + FIX_COVERAGE_ID_COMPLETE = 1; + FIX_COVERAGE_ID_PARTIAL = 2; + FIX_COVERAGE_ID_NONE = 3; + FIX_COVERAGE_ID_OTHER = 99; + } + Advisory advisory = 1; + repeated AffectedCode affected_code = 2; + repeated AffectedPackage affected_packages = 3; + string category = 4; + Cve cve = 5; + Cwe cwe = 6; + string dependency_chain = 7; + string desc = 8; + int64 exploit_last_seen_time = 9; + string exploit_last_seen_time_dt = 10; + string exploit_ref_url = 11; + string exploit_requirement = 12; + string exploit_type = 13; + int64 first_seen_time = 14; + string first_seen_time_dt = 15; + bool fix_available = 16; + string fix_coverage = 17; + FixCoverageId fix_coverage_id = 18; + bool is_exploit_available = 19; + bool is_fix_available = 20; + repeated KbArticle kb_article_list = 21; + repeated string kb_articles = 22; + int64 last_seen_time = 23; + string last_seen_time_dt = 24; + repeated Package packages = 25; + repeated string references = 26; + repeated string related_vulnerabilities = 27; + Remediation remediation = 28; + string severity = 29; + string title = 30; + string vendor_name = 31; +} + +message Whois { + enum DnssecStatusId { + DNSSEC_STATUS_ID_UNKNOWN = 0; + DNSSEC_STATUS_ID_SIGNED = 1; + DNSSEC_STATUS_ID_UNSIGNED = 2; + DNSSEC_STATUS_ID_OTHER = 99; + } + AutonomousSystem autonomous_system = 1; + int64 created_time = 2; + string created_time_dt = 3; + string dnssec_status = 4; + DnssecStatusId dnssec_status_id = 5; + string domain = 6; + repeated DomainContact domain_contacts = 7; + string email_addr = 8; + string isp = 9; + string isp_org = 10; + int64 last_seen_time = 11; + string last_seen_time_dt = 12; + repeated string name_servers = 13; + string phone_number = 14; + string registrar = 15; + string status = 16; + repeated string subdomains = 17; + string subnet = 18; +} + +message WinService { + enum ServiceCategoryId { + SERVICE_CATEGORY_ID_UNKNOWN = 0; + SERVICE_CATEGORY_ID_KERNEL_MODE = 1; + SERVICE_CATEGORY_ID_USER_MODE = 2; + SERVICE_CATEGORY_ID_OTHER = 99; + } + enum ServiceErrorControlId { + SERVICE_ERROR_CONTROL_ID_UNKNOWN = 0; + SERVICE_ERROR_CONTROL_ID_IGNORE = 1; + SERVICE_ERROR_CONTROL_ID_NORMAL = 2; + SERVICE_ERROR_CONTROL_ID_SEVERE = 3; + SERVICE_ERROR_CONTROL_ID_CRITICAL = 4; + SERVICE_ERROR_CONTROL_ID_OTHER = 99; + } + enum ServiceStartTypeId { + SERVICE_START_TYPE_ID_UNKNOWN = 0; + SERVICE_START_TYPE_ID_BOOT = 1; + SERVICE_START_TYPE_ID_SYSTEM = 2; + SERVICE_START_TYPE_ID_AUTO = 3; + SERVICE_START_TYPE_ID_DEMAND = 4; + SERVICE_START_TYPE_ID_DISABLED = 5; + SERVICE_START_TYPE_ID_OTHER = 99; + } + enum ServiceTypeId { + SERVICE_TYPE_ID_UNKNOWN = 0; + SERVICE_TYPE_ID_KERNEL_DRIVER = 1; + SERVICE_TYPE_ID_FILE_SYSTEM_DRIVER = 2; + SERVICE_TYPE_ID_OWN_PROCESS = 3; + SERVICE_TYPE_ID_SHARE_PROCESS = 4; + SERVICE_TYPE_ID_OTHER = 99; + } + string cmd_line = 1; + ProcessEntity hosting_process = 2; + repeated string labels = 3; + string load_order_group = 4; + string name = 5; + string service_category = 6; + ServiceCategoryId service_category_id = 7; + repeated string service_dependencies = 8; + File service_dll_file = 9; + string service_error_control = 10; + ServiceErrorControlId service_error_control_id = 11; + File service_file = 12; + string service_start_name = 13; + string service_start_type = 14; + ServiceStartTypeId service_start_type_id = 15; + string service_type = 16; + ServiceTypeId service_type_id = 17; + repeated KeyValueObject tags = 18; + string uid = 19; + string version = 20; +} + From 3b3f961da140ef5224f7362f4d7e48265c36394e Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:24:30 +0200 Subject: [PATCH 14/26] feat(ocsf): add --merged-message to ocsf-protogen --merged-message (e.g. AuditEvent) emits the merged single-event layout IN ADDITION to the per-class files, into the same output tree and sharing the same tagmap. Both paths emit an identical objects.proto; the duplicate is dropped after an equality check so any divergence surfaces as an error instead of a silent overwrite. With --sr-schema-out, the merged .sr.proto lands next to the per-class SR schemas. --check covers the merged files with the same drift and stray-file detection. The committed testdata baseline is regenerated with the flag: it gains ocsf/v1/audit_event.proto, and field-numbers.json gains the AuditEvent lineage (purely additive; --compat-check against the previous map passes). Co-Authored-By: Claude Fable 5 --- ocsf/cmd/ocsf-protogen/main.go | 2 + ocsf/cmd/ocsf-protogen/protogen/protogen.go | 84 +++++- .../ocsf-protogen/protogen/protogen_test.go | 71 +++++ .../ocsf-protogen/testdata/field-numbers.json | 72 +++++ .../testdata/ocsf/v1/audit_event.proto | 261 ++++++++++++++++++ 5 files changed, 482 insertions(+), 8 deletions(-) create mode 100644 ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go index d0c3cdf..341b63f 100644 --- a/ocsf/cmd/ocsf-protogen/main.go +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -86,6 +86,7 @@ func run(args []string) error { oldFlag := fs.String("old", "", "path to the base-branch tagmap JSON (for --compat-check)") newFlag := fs.String("new", "", "path to the PR tagmap JSON (for --compat-check)") srSchemaOutFlag := fs.String("sr-schema-out", "", "optional directory for self-contained Schema-Registry schemas (.sr.proto); empty disables SR emission") + mergedMessageFlag := fs.String("merged-message", "", "optional message name (e.g. AuditEvent) for a single flat message unioning all selected classes, emitted alongside the per-class files; empty disables merged emission") if err := fs.Parse(args); err != nil { return err @@ -127,6 +128,7 @@ func run(args []string) error { TagmapPath: *tagmapFlag, Check: *checkFlag, SRSchemaOutDir: *srSchemaOutFlag, + MergedMessage: *mergedMessageFlag, } if cfg.Check { diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go index 65f022f..fe65890 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -39,6 +39,14 @@ type Config struct { // after the main Emit. It is unrelated to OutDir: SR files are flat, not // module-relative. Empty disables SR schema emission entirely. SRSchemaOutDir string + // MergedMessage, when non-empty, is the proto message name (e.g. + // "AuditEvent") of the single flat merged event message emitted IN ADDITION + // to the per-class files: the union of all class attributes in one message, + // for a single-topic audit log. The merged file lands next to the per-class + // files (ocsf/v/.proto) and shares the same tagmap. + // When SRSchemaOutDir is also set, a merged .sr.proto is + // written there too. Empty disables merged emission. + MergedMessage string } // Generate loads the schema, emits the proto, writes --out and --tagmap. @@ -58,9 +66,9 @@ func Generate(cfg Config) (stubbed []string, err error) { return nil, fmt.Errorf("load tagmap: %w", err) } - files, stubbed, err := gen.Emit(s, cfg.Classes, tm, cfg.Version) + files, stubbed, err := emitAll(s, cfg, tm) if err != nil { - return nil, fmt.Errorf("emit proto: %w", err) + return nil, err } if err := writeFiles(cfg.OutDir, files); err != nil { @@ -71,9 +79,9 @@ func Generate(cfg Config) (stubbed []string, err error) { // the main output. Do this before tm.Save so the (idempotent) Assign calls are // persisted too. if strings.TrimSpace(cfg.SRSchemaOutDir) != "" { - srFiles, err := gen.EmitSRSchemas(s, cfg.Classes, tm, cfg.Version) + srFiles, err := emitAllSRSchemas(s, cfg, tm) if err != nil { - return nil, fmt.Errorf("emit sr schemas: %w", err) + return nil, err } if err := writeFiles(cfg.SRSchemaOutDir, srFiles); err != nil { return nil, err @@ -87,6 +95,66 @@ func Generate(cfg Config) (stubbed []string, err error) { return stubbed, nil } +// emitAll runs the per-class Emit plus, when cfg.MergedMessage is set, the +// merged single-event EmitMerged, and combines the file lists. +// +// Both paths emit an identical objects.proto (same object closure, same tags +// from the shared tagmap); the duplicate is dropped after an equality check so +// a divergence surfaces as an error instead of a silent overwrite. +func emitAll(s *schema.Schema, cfg Config, tm *tagmap.TagMap) (files []gen.GeneratedFile, stubbed []string, err error) { + files, stubbed, err = gen.Emit(s, cfg.Classes, tm, cfg.Version) + if err != nil { + return nil, nil, fmt.Errorf("emit proto: %w", err) + } + + if strings.TrimSpace(cfg.MergedMessage) == "" { + return files, stubbed, nil + } + + mergedFiles, mergedStubbed, err := gen.EmitMerged(s, cfg.Classes, tm, cfg.Version, cfg.MergedMessage) + if err != nil { + return nil, nil, fmt.Errorf("emit merged proto: %w", err) + } + // Stub sets are identical by construction (same classes, same closure), so + // the per-class stub list already covers the merged run. + _ = mergedStubbed + + byPath := make(map[string]string, len(files)) + for _, f := range files { + byPath[f.Path] = f.Content + } + for _, f := range mergedFiles { + existing, ok := byPath[f.Path] + if !ok { + files = append(files, f) + continue + } + if existing != f.Content { + return nil, nil, fmt.Errorf("merged emission produced %q with different content than per-class emission", f.Path) + } + } + sort.Slice(files, func(i, j int) bool { return files[i].Path < files[j].Path }) + return files, stubbed, nil +} + +// emitAllSRSchemas runs the per-class EmitSRSchemas plus, when +// cfg.MergedMessage is set, the merged EmitMergedSRSchema. +func emitAllSRSchemas(s *schema.Schema, cfg Config, tm *tagmap.TagMap) ([]gen.GeneratedFile, error) { + srFiles, err := gen.EmitSRSchemas(s, cfg.Classes, tm, cfg.Version) + if err != nil { + return nil, fmt.Errorf("emit sr schemas: %w", err) + } + if strings.TrimSpace(cfg.MergedMessage) != "" { + mergedSR, err := gen.EmitMergedSRSchema(s, cfg.Classes, tm, cfg.Version, cfg.MergedMessage) + if err != nil { + return nil, fmt.Errorf("emit merged sr schema: %w", err) + } + srFiles = append(srFiles, mergedSR) + sort.Slice(srFiles, func(i, j int) bool { return srFiles[i].Path < srFiles[j].Path }) + } + return srFiles, nil +} + // writeFiles writes each generated file to /, creating parent // directories as needed. Paths are slash-separated and converted to the host // separator. @@ -132,9 +200,9 @@ func Check(cfg Config) error { return fmt.Errorf("copy tagmap for check: %w", err) } - files, stubbed, err := gen.Emit(s, cfg.Classes, newTM, cfg.Version) + files, stubbed, err := emitAll(s, cfg, newTM) if err != nil { - return fmt.Errorf("emit proto: %w", err) + return err } // Read the committed tree so we can compare stub lists and full content. @@ -170,9 +238,9 @@ func Check(cfg Config) error { // written flat under SRSchemaOutDir, so we compare each generated file against // its committed counterpart there. if strings.TrimSpace(cfg.SRSchemaOutDir) != "" { - srFiles, err := gen.EmitSRSchemas(s, cfg.Classes, newTM, cfg.Version) + srFiles, err := emitAllSRSchemas(s, cfg, newTM) if err != nil { - return fmt.Errorf("emit sr schemas: %w", err) + return err } if err := diffSRSchemas(cfg.SRSchemaOutDir, srFiles); err != nil { return err diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go index a09bca7..624b98a 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -331,12 +331,83 @@ func TestCheckAgainstCommittedBaseline(t *testing.T) { OutDir: outDir, TagmapPath: tagmapPath, Check: true, + // The committed baseline includes the merged single-event layout + // (audit_event.proto); --check must be configured identically to the + // generation run (see the ocsf-checks CI job). + MergedMessage: "AuditEvent", } err := protogen.Check(cfg) require.NoError(t, err, "--check must pass against the committed baseline") } +// ─── Merged single-event layout ─────────────────────────────────────────────── + +// TestGenerateMergedThenCheck verifies MergedMessage emission: the merged +// audit_event.proto lands next to the per-class files, the merged SR schema is +// written, and --check with the same config passes. +func TestGenerateMergedThenCheck(t *testing.T) { + dir := t.TempDir() + srDir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + MergedMessage: "AuditEvent", + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // Per-class files AND the merged file coexist in one tree. + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "api_activity.proto")) + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "entity_management.proto")) + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "audit_event.proto")) + require.FileExists(t, filepath.Join(dir, "ocsf", "v1", "objects.proto")) + + // SR schemas: per-class plus the merged one. + require.FileExists(t, filepath.Join(srDir, "api_activity.sr.proto")) + require.FileExists(t, filepath.Join(srDir, "entity_management.sr.proto")) + require.FileExists(t, filepath.Join(srDir, "audit_event.sr.proto")) + + checkCfg := cfg + checkCfg.Check = true + require.NoError(t, protogen.Check(checkCfg), + "--check must pass immediately after Generate on the same merged baseline") +} + +// TestCheckFailsWithoutMergedFlagOnMergedBaseline verifies that a baseline +// generated WITH MergedMessage fails --check when the flag is omitted (the +// merged file is then a stray), so CI cannot silently drop the merged layout. +func TestCheckFailsWithoutMergedFlagOnMergedBaseline(t *testing.T) { + dir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + MergedMessage: "AuditEvent", + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + checkCfg := cfg + checkCfg.Check = true + checkCfg.MergedMessage = "" + err = protogen.Check(checkCfg) + require.Error(t, err) + require.Contains(t, err.Error(), "audit_event.proto") +} + // ─── Version cross-check ────────────────────────────────────────────────────── // TestGenerateVersionMismatch verifies that Generate returns an error when diff --git a/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json b/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json index 84dccc0..96c5765 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json +++ b/ocsf/cmd/ocsf-protogen/testdata/field-numbers.json @@ -242,6 +242,78 @@ }, "reserved": [] }, + "AuditEvent": { + "fields": { + "access_list": 1, + "access_mask": 2, + "action": 3, + "action_id": 4, + "activity_id": 5, + "activity_name": 6, + "actor": 7, + "ai_model": 8, + "api": 9, + "attacks": 10, + "authorizations": 11, + "category_name": 12, + "category_uid": 13, + "class_name": 14, + "class_uid": 15, + "cloud": 16, + "comment": 17, + "confidence": 18, + "confidence_id": 19, + "confidence_score": 20, + "count": 21, + "device": 22, + "disposition": 23, + "disposition_id": 24, + "dst_endpoint": 25, + "duration": 26, + "end_time": 27, + "end_time_dt": 28, + "enrichments": 29, + "entity": 30, + "entity_result": 31, + "firewall_rule": 32, + "http_request": 33, + "http_response": 34, + "is_alert": 35, + "malware": 36, + "malware_scan_info": 37, + "message": 38, + "message_context": 39, + "metadata": 40, + "observables": 41, + "osint": 42, + "policy": 43, + "raw_data": 44, + "raw_data_hash": 45, + "raw_data_size": 46, + "resources": 47, + "risk_details": 48, + "risk_level": 49, + "risk_level_id": 50, + "risk_score": 51, + "severity": 52, + "severity_id": 53, + "src_endpoint": 54, + "start_time": 55, + "start_time_dt": 56, + "status": 57, + "status_code": 58, + "status_detail": 59, + "status_id": 60, + "time": 61, + "time_dt": 62, + "timezone_offset": 63, + "trace": 64, + "type_name": 65, + "type_uid": 66, + "unmapped": 67 + }, + "reserved": [] + }, "AuthFactor": { "fields": { "device": 1, diff --git a/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto new file mode 100644 index 0000000..5527372 --- /dev/null +++ b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto @@ -0,0 +1,261 @@ +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +syntax = "proto3"; + +package ocsf.v1; + +import "buf/validate/validate.proto"; +import "google/protobuf/struct.proto"; +import "ocsf/v1/objects.proto"; + +message AuditEvent { + option (buf.validate.message).cel = { + id: "AuditEvent.type_uid", + message: "type_uid must equal class_uid * 100 + activity_id", + expression: "this.type_uid == this.class_uid * 100 + this.activity_id" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.access_list", + message: "access_list is only valid for class_uid 3004", + expression: "!has(this.access_list) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.access_mask", + message: "access_mask is only valid for class_uid 3004", + expression: "!has(this.access_mask) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.ai_model", + message: "ai_model is only valid for class_uid 6003", + expression: "!has(this.ai_model) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.comment", + message: "comment is only valid for class_uid 3004", + expression: "!has(this.comment) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.dst_endpoint", + message: "dst_endpoint is only valid for class_uid 6003", + expression: "!has(this.dst_endpoint) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.entity", + message: "entity is only valid for class_uid 3004", + expression: "!has(this.entity) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.entity_result", + message: "entity_result is only valid for class_uid 3004", + expression: "!has(this.entity_result) || this.class_uid == 3004" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.message_context", + message: "message_context is only valid for class_uid 6003", + expression: "!has(this.message_context) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.resources", + message: "resources is only valid for class_uid 6003", + expression: "!has(this.resources) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.own.trace", + message: "trace is only valid for class_uid 6003", + expression: "!has(this.trace) || this.class_uid == 6003" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.actor", + message: "actor is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.actor)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.api", + message: "api is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.api)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.api_activity.src_endpoint", + message: "src_endpoint is required when class_uid == 6003 (api_activity)", + expression: "this.class_uid != 6003 || has(this.src_endpoint)" + }; + option (buf.validate.message).cel = { + id: "AuditEvent.req.entity_management.entity", + message: "entity is required when class_uid == 3004 (entity_management)", + expression: "this.class_uid != 3004 || has(this.entity)" + }; + enum ActionId { + ACTION_ID_UNKNOWN = 0; + ACTION_ID_ALLOWED = 1; + ACTION_ID_DENIED = 2; + ACTION_ID_OBSERVED = 3; + ACTION_ID_MODIFIED = 4; + ACTION_ID_OTHER = 99; + } + enum CategoryUid { + CATEGORY_UID_UNKNOWN = 0; + CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT = 3; + CATEGORY_UID_APPLICATION_ACTIVITY = 6; + } + enum ClassUid { + CLASS_UID_UNKNOWN = 0; + CLASS_UID_ENTITY_MANAGEMENT = 3004; + CLASS_UID_API_ACTIVITY = 6003; + } + enum ConfidenceId { + CONFIDENCE_ID_UNKNOWN = 0; + CONFIDENCE_ID_LOW = 1; + CONFIDENCE_ID_MEDIUM = 2; + CONFIDENCE_ID_HIGH = 3; + CONFIDENCE_ID_OTHER = 99; + } + enum DispositionId { + DISPOSITION_ID_UNKNOWN = 0; + DISPOSITION_ID_ALLOWED = 1; + DISPOSITION_ID_BLOCKED = 2; + DISPOSITION_ID_QUARANTINED = 3; + DISPOSITION_ID_ISOLATED = 4; + DISPOSITION_ID_DELETED = 5; + DISPOSITION_ID_DROPPED = 6; + DISPOSITION_ID_CUSTOM_ACTION = 7; + DISPOSITION_ID_APPROVED = 8; + DISPOSITION_ID_RESTORED = 9; + DISPOSITION_ID_EXONERATED = 10; + DISPOSITION_ID_CORRECTED = 11; + DISPOSITION_ID_PARTIALLY_CORRECTED = 12; + DISPOSITION_ID_UNCORRECTED = 13; + DISPOSITION_ID_DELAYED = 14; + DISPOSITION_ID_DETECTED = 15; + DISPOSITION_ID_NO_ACTION = 16; + DISPOSITION_ID_LOGGED = 17; + DISPOSITION_ID_TAGGED = 18; + DISPOSITION_ID_ALERT = 19; + DISPOSITION_ID_COUNT = 20; + DISPOSITION_ID_RESET = 21; + DISPOSITION_ID_CAPTCHA = 22; + DISPOSITION_ID_CHALLENGE = 23; + DISPOSITION_ID_ACCESS_REVOKED = 24; + DISPOSITION_ID_REJECTED = 25; + DISPOSITION_ID_UNAUTHORIZED = 26; + DISPOSITION_ID_ERROR = 27; + DISPOSITION_ID_OTHER = 99; + } + enum RiskLevelId { + RISK_LEVEL_ID_INFO = 0; + RISK_LEVEL_ID_LOW = 1; + RISK_LEVEL_ID_MEDIUM = 2; + RISK_LEVEL_ID_HIGH = 3; + RISK_LEVEL_ID_CRITICAL = 4; + RISK_LEVEL_ID_OTHER = 99; + } + enum SeverityId { + SEVERITY_ID_UNKNOWN = 0; + SEVERITY_ID_INFORMATIONAL = 1; + SEVERITY_ID_LOW = 2; + SEVERITY_ID_MEDIUM = 3; + SEVERITY_ID_HIGH = 4; + SEVERITY_ID_CRITICAL = 5; + SEVERITY_ID_FATAL = 6; + SEVERITY_ID_OTHER = 99; + } + enum StatusId { + STATUS_ID_UNKNOWN = 0; + STATUS_ID_SUCCESS = 1; + STATUS_ID_FAILURE = 2; + STATUS_ID_OTHER = 99; + } + enum TypeUid { + TYPE_UID_UNKNOWN = 0; + TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN = 300400; + TYPE_UID_ENTITY_MANAGEMENT_CREATE = 300401; + TYPE_UID_ENTITY_MANAGEMENT_READ = 300402; + TYPE_UID_ENTITY_MANAGEMENT_UPDATE = 300403; + TYPE_UID_ENTITY_MANAGEMENT_DELETE = 300404; + TYPE_UID_ENTITY_MANAGEMENT_MOVE = 300405; + TYPE_UID_ENTITY_MANAGEMENT_ENROLL = 300406; + TYPE_UID_ENTITY_MANAGEMENT_UNENROLL = 300407; + TYPE_UID_ENTITY_MANAGEMENT_ENABLE = 300408; + TYPE_UID_ENTITY_MANAGEMENT_DISABLE = 300409; + TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE = 300410; + TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE = 300411; + TYPE_UID_ENTITY_MANAGEMENT_SUSPEND = 300412; + TYPE_UID_ENTITY_MANAGEMENT_RESUME = 300413; + TYPE_UID_ENTITY_MANAGEMENT_OTHER = 300499; + TYPE_UID_API_ACTIVITY_UNKNOWN = 600300; + TYPE_UID_API_ACTIVITY_CREATE = 600301; + TYPE_UID_API_ACTIVITY_READ = 600302; + TYPE_UID_API_ACTIVITY_UPDATE = 600303; + TYPE_UID_API_ACTIVITY_DELETE = 600304; + TYPE_UID_API_ACTIVITY_OTHER = 600399; + } + repeated string access_list = 1; + int32 access_mask = 2; + string action = 3; + ActionId action_id = 4; + // Class-scoped enum: value semantics depend on class_uid; see TypeUid. + int32 activity_id = 5 [(buf.validate.field).required = true]; + string activity_name = 6; + Actor actor = 7; + AiModel ai_model = 8; + Api api = 9; + repeated Attack attacks = 10; + repeated Authorization authorizations = 11; + string category_name = 12; + CategoryUid category_uid = 13 [(buf.validate.field).required = true]; + string class_name = 14; + ClassUid class_uid = 15 [(buf.validate.field).required = true]; + Cloud cloud = 16 [(buf.validate.field).required = true]; + string comment = 17; + string confidence = 18; + ConfidenceId confidence_id = 19; + int32 confidence_score = 20; + int32 count = 21; + Device device = 22; + string disposition = 23; + DispositionId disposition_id = 24; + NetworkEndpoint dst_endpoint = 25; + int64 duration = 26; + int64 end_time = 27; + string end_time_dt = 28; + repeated Enrichment enrichments = 29; + ManagedEntity entity = 30; + ManagedEntity entity_result = 31; + FirewallRule firewall_rule = 32; + HttpRequest http_request = 33; + HttpResponse http_response = 34; + bool is_alert = 35; + repeated Malware malware = 36; + MalwareScanInfo malware_scan_info = 37; + string message = 38; + MessageContext message_context = 39; + Metadata metadata = 40 [(buf.validate.field).required = true]; + repeated Observable observables = 41; + repeated Osint osint = 42; + Policy policy = 43; + string raw_data = 44; + Fingerprint raw_data_hash = 45; + int64 raw_data_size = 46; + repeated ResourceDetails resources = 47; + string risk_details = 48; + string risk_level = 49; + RiskLevelId risk_level_id = 50; + int32 risk_score = 51; + string severity = 52; + SeverityId severity_id = 53 [(buf.validate.field).required = true]; + NetworkEndpoint src_endpoint = 54; + int64 start_time = 55; + string start_time_dt = 56; + string status = 57; + string status_code = 58; + string status_detail = 59; + StatusId status_id = 60; + int64 time = 61 [(buf.validate.field).required = true]; + string time_dt = 62; + int32 timezone_offset = 63; + Trace trace = 64; + string type_name = 65; + TypeUid type_uid = 66 [(buf.validate.field).required = true]; + google.protobuf.Value unmapped = 67; +} + From 794e0ba9990e417422d832c5b18509d150fd9fb2 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:24:44 +0200 Subject: [PATCH 15/26] ci(ocsf): gate the merged single-event layout Pass --merged-message AuditEvent to the baseline-drift check so CI verifies the committed audit_event.proto and the AuditEvent tagmap lineage exactly like the per-class files (the existing --compat-check already covers the new lineage since the tagmap is shared). Add buf lint/build over the golden-merged tree used by the gen tests. Co-Authored-By: Claude Fable 5 --- .github/workflows/test.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 5034df1..91941cb 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -90,7 +90,8 @@ jobs: --classes api_activity,entity_management \ --version 1.8.0 \ --out cmd/ocsf-protogen/testdata \ - --tagmap cmd/ocsf-protogen/testdata/field-numbers.json + --tagmap cmd/ocsf-protogen/testdata/field-numbers.json \ + --merged-message AuditEvent # buf lint + build on the committed proto baseline. - name: buf lint (ocsf testdata) @@ -110,6 +111,15 @@ jobs: working-directory: ocsf/internal/ocsf/gen/testdata/golden run: buf build + # buf lint + build on the merged single-event golden (AuditEvent layout). + - name: buf lint (gen golden-merged) + working-directory: ocsf/internal/ocsf/gen/testdata/golden-merged + run: buf lint + + - name: buf build (gen golden-merged) + working-directory: ocsf/internal/ocsf/gen/testdata/golden-merged + run: buf build + # Run the full ocsf test suite including TestServerConformance which # POSTs exported OCSF JSON to schema.ocsf.io/api/v2/validate and gates # on error_count == 0. This test skips automatically when From af53e0f29101ba9d27662b45b71a4ac03db43871 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:25:00 +0200 Subject: [PATCH 16/26] feat(ocsf): add FromOCSFJSON, the OCSF-JSON-to-proto importer The exporter only went one way; audit events also need to come back from OCSF JSON (topic consumers, Postgres JSONB columns, events produced by other OCSF tools). FromOCSFJSON is the exact inverse of ToOCSFJSON: - snake_case keys resolve by proto field name; enums decode from OCSF integer values, keeping unknown numbers verbatim (proto3 enums are open, so newer-revision events survive), - 64-bit integers decode from unquoted JSON numbers without float64 precision loss, plus quoted decimal strings for protojson interop; fractional or exponent forms into integer fields are rejected rather than truncated, - google.protobuf.Value/Struct/ListValue fields take their natural JSON; for Value fields JSON null decodes to a set NullValue (protojson semantics), preserving the present-with-null vs absent distinction, - JSON null on other fields leaves them unset; null is rejected as a message body or array element (encoding/json would otherwise no-op and silently zero the value), - unknown keys land in the message's unmapped field (merged with any explicit unmapped object), mirroring OCSF's forward-compat model; a message without one errors, naming the keys. Conformance now proves both directions on the real generated classes: proto -> JSON -> proto is proto.Equal-lossless, JSON -> proto -> JSON is byte-identical, and spliced unknown keys survive via unmapped. Co-Authored-By: Claude Fable 5 --- .../ocsf/conformance/roundtrip_test.go | 115 +++++ ocsf/internal/ocsf/exporter/importer.go | 419 ++++++++++++++++++ ocsf/internal/ocsf/exporter/importer_test.go | 176 ++++++++ 3 files changed, 710 insertions(+) create mode 100644 ocsf/internal/ocsf/conformance/roundtrip_test.go create mode 100644 ocsf/internal/ocsf/exporter/importer.go create mode 100644 ocsf/internal/ocsf/exporter/importer_test.go diff --git a/ocsf/internal/ocsf/conformance/roundtrip_test.go b/ocsf/internal/ocsf/conformance/roundtrip_test.go new file mode 100644 index 0000000..8dfd6ae --- /dev/null +++ b/ocsf/internal/ocsf/conformance/roundtrip_test.go @@ -0,0 +1,115 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package conformance_test + +import ( + "encoding/json" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" +) + +// TestJSONRoundTrip_ProtoJSONProto proves proto → OCSF JSON → proto is +// lossless on the real generated classes: FromOCSFJSON(ToOCSFJSON(evt)) +// equals evt for every conformance event. +func TestJSONRoundTrip_ProtoJSONProto(t *testing.T) { + cases := []struct { + name string + event proto.Message + decoded proto.Message + }{ + {"ApiActivity/Allowed", buildApiActivityAllowed(), &ocsfv1.ApiActivity{}}, + {"ApiActivity/Unauthorized", buildApiActivityUnauthorized(), &ocsfv1.ApiActivity{}}, + {"EntityManagement/Create", buildEntityManagement(), &ocsfv1.EntityManagement{}}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + b, err := exporter.ToOCSFJSON(tc.event) + require.NoError(t, err) + + require.NoError(t, exporter.FromOCSFJSON(b, tc.decoded)) + require.True(t, proto.Equal(tc.event, tc.decoded), + "proto → JSON → proto must be lossless\njson: %s", b) + }) + } +} + +// TestJSONRoundTrip_JSONProtoJSON proves OCSF JSON → proto → OCSF JSON is +// byte-identical: an event ingested from JSON re-exports to the same bytes. +// This is the property that lets external OCSF JSON (from other producers) +// pass through the proto representation without loss. +func TestJSONRoundTrip_JSONProtoJSON(t *testing.T) { + cases := []struct { + name string + event proto.Message + decoded proto.Message + }{ + {"ApiActivity/Allowed", buildApiActivityAllowed(), &ocsfv1.ApiActivity{}}, + {"ApiActivity/Unauthorized", buildApiActivityUnauthorized(), &ocsfv1.ApiActivity{}}, + {"EntityManagement/Create", buildEntityManagement(), &ocsfv1.EntityManagement{}}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + b, err := exporter.ToOCSFJSON(tc.event) + require.NoError(t, err) + + require.NoError(t, exporter.FromOCSFJSON(b, tc.decoded)) + b2, err := exporter.ToOCSFJSON(tc.decoded) + require.NoError(t, err) + + require.Equal(t, string(b), string(b2), + "JSON → proto → JSON must be byte-identical") + }) + } +} + +// TestJSONRoundTrip_UnknownKeysToUnmapped verifies OCSF's forward-compat +// model: JSON keys not in the proto schema land in the class's unmapped field +// and survive re-export. +func TestJSONRoundTrip_UnknownKeysToUnmapped(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildApiActivityAllowed()) + require.NoError(t, err) + + // Splice two unknown keys into the event JSON, as a producer on a newer + // OCSF revision would. + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + m["future_attribute"] = "hello" + m["future_block"] = map[string]any{"a": float64(1)} + spliced, err := json.Marshal(m) + require.NoError(t, err) + + var evt ocsfv1.ApiActivity + require.NoError(t, exporter.FromOCSFJSON(spliced, &evt)) + + require.NotNil(t, evt.Unmapped, "unknown keys must land in unmapped") + unmapped := evt.Unmapped.GetStructValue() + require.NotNil(t, unmapped) + require.Equal(t, "hello", unmapped.Fields["future_attribute"].GetStringValue()) + require.Equal(t, float64(1), unmapped.Fields["future_block"].GetStructValue().Fields["a"].GetNumberValue()) + + // Known fields are unaffected. + require.Equal(t, ocsfv1.ApiActivity_CLASS_UID_API_ACTIVITY, evt.ClassUid) + + // Re-export keeps the data (under unmapped, per OCSF). + b2, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + var m2 map[string]any + require.NoError(t, json.Unmarshal(b2, &m2)) + un, ok := m2["unmapped"].(map[string]any) + require.True(t, ok, "unmapped must re-export as a JSON object") + require.Equal(t, "hello", un["future_attribute"]) +} diff --git a/ocsf/internal/ocsf/exporter/importer.go b/ocsf/internal/ocsf/exporter/importer.go new file mode 100644 index 0000000..5e1da26 --- /dev/null +++ b/ocsf/internal/ocsf/exporter/importer.go @@ -0,0 +1,419 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package exporter + +import ( + "bytes" + "encoding/base64" + "encoding/json" + "fmt" + "maps" + "math" + + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/reflect/protoreflect" +) + +// unmappedFieldName is the OCSF base_event attribute that carries data the +// producer could not map to schema attributes. FromOCSFJSON routes unknown +// JSON keys into it, mirroring OCSF's own forward-compatibility model. +const unmappedFieldName = "unmapped" + +// FromOCSFJSON unmarshals OCSF JSON produced by ToOCSFJSON (or any +// OCSF-conformant producer) into m, the exact inverse of ToOCSFJSON: +// +// - Keys are the proto field names (snake_case). +// - Enum fields accept JSON numbers (the OCSF integer convention). Unknown +// numeric values are stored as-is: proto3 enums are open, so events from a +// newer OCSF revision round-trip without loss. +// - 64-bit integers accept unquoted JSON numbers (the OCSF convention) and, +// for interoperability with protojson producers, quoted decimal strings. +// - google.protobuf.Value/Struct/ListValue fields take their natural JSON. +// For Value fields, JSON null decodes to a set NullValue (protojson +// semantics), preserving the present-with-null vs absent distinction. +// - JSON null on any other field leaves it unset. Absent keys leave fields +// at their proto3 defaults, so ToOCSFJSON(FromOCSFJSON(x)) == x for +// conformant x. +// - Unknown JSON keys are collected into the message's "unmapped" field +// (json_t in OCSF base_event) when the message declares one; if it does +// not, unknown keys are an error naming them. +// +// m is reset before decoding. +func FromOCSFJSON(data []byte, m proto.Message) error { + proto.Reset(m) + return unmarshalMessage(data, m.ProtoReflect()) +} + +// unmarshalMessage decodes a JSON object into msg. +func unmarshalMessage(data []byte, msg protoreflect.Message) error { + // Well-known structural types take their natural JSON form (including + // null, which is a valid google.protobuf.Value). + if wellKnownStructural[msg.Descriptor().FullName()] { + return protojson.Unmarshal(data, msg.Interface()) + } + + // encoding/json decodes null into a map as a silent no-op; reject it + // explicitly so `null` never masquerades as an empty event. + if isJSONNull(data) { + return fmt.Errorf("%s: expected JSON object, got null", msg.Descriptor().FullName()) + } + + var raw map[string]json.RawMessage + if err := json.Unmarshal(data, &raw); err != nil { + return fmt.Errorf("%s: decode JSON object: %w", msg.Descriptor().FullName(), err) + } + + fields := msg.Descriptor().Fields() + var unknown map[string]json.RawMessage + + for key, val := range raw { + fd := fields.ByName(protoreflect.Name(key)) + if fd == nil { + if isJSONNull(val) { + continue + } + if unknown == nil { + unknown = make(map[string]json.RawMessage) + } + unknown[key] = val + continue + } + // JSON null leaves a field unset — except for google.protobuf.Value, + // where null IS a value (NullValue) and dropping it would break the + // export/import symmetry: ToOCSFJSON emits a set null Value as + // `"key":null`, so that byte sequence must decode back to a set field. + if isJSONNull(val) && !isValueField(fd) { + continue + } + if err := unmarshalField(msg, fd, val); err != nil { + return fmt.Errorf("field %q: %w", key, err) + } + } + + if len(unknown) > 0 { + if err := storeUnmapped(msg, fields, unknown); err != nil { + return err + } + } + return nil +} + +// storeUnmapped routes unknown JSON keys into the message's unmapped field. +func storeUnmapped(msg protoreflect.Message, fields protoreflect.FieldDescriptors, unknown map[string]json.RawMessage) error { + fd := fields.ByName(unmappedFieldName) + if fd == nil || fd.Kind() != protoreflect.MessageKind || + fd.Message().FullName() != "google.protobuf.Value" || fd.IsList() || fd.IsMap() { + keys := make([]string, 0, len(unknown)) + for k := range unknown { + keys = append(keys, k) + } + return fmt.Errorf("%s: unknown JSON keys %v and no %q google.protobuf.Value field to store them", + msg.Descriptor().FullName(), keys, unmappedFieldName) + } + + // If the input itself carried an "unmapped" object, merge the unknown keys + // into it rather than overwriting. + obj := make(map[string]json.RawMessage, len(unknown)+4) + if msg.Has(fd) { + existing, err := protojson.Marshal(msg.Get(fd).Message().Interface()) + if err != nil { + return fmt.Errorf("re-marshal existing %s: %w", unmappedFieldName, err) + } + // Non-object unmapped (string, list, ...) cannot absorb extra keys. + if err := json.Unmarshal(existing, &obj); err != nil { + return fmt.Errorf("%s: %q is set to a non-object value; cannot merge unknown JSON keys into it", + msg.Descriptor().FullName(), unmappedFieldName) + } + // json.Unmarshal of `null` nils the map without error: an explicit + // null unmapped carries no data, so treat it as empty and let the + // unknown keys replace it. + if obj == nil { + obj = make(map[string]json.RawMessage, len(unknown)) + } + } + maps.Copy(obj, unknown) + + merged, err := json.Marshal(obj) + if err != nil { + return err + } + val := msg.NewField(fd) + if err := protojson.Unmarshal(merged, val.Message().Interface()); err != nil { + return fmt.Errorf("store unknown keys in %q: %w", unmappedFieldName, err) + } + msg.Set(fd, val) + return nil +} + +// unmarshalField decodes a single JSON value into fd on msg. +func unmarshalField(msg protoreflect.Message, fd protoreflect.FieldDescriptor, data json.RawMessage) error { + switch { + case fd.IsList(): + var items []json.RawMessage + if err := json.Unmarshal(data, &items); err != nil { + return fmt.Errorf("expected JSON array: %w", err) + } + list := msg.Mutable(fd).List() + for i, item := range items { + v, err := unmarshalSingular(fd, item, list.NewElement) + if err != nil { + return fmt.Errorf("index %d: %w", i, err) + } + list.Append(v) + } + return nil + + case fd.IsMap(): + var obj map[string]json.RawMessage + if err := json.Unmarshal(data, &obj); err != nil { + return fmt.Errorf("expected JSON object: %w", err) + } + mp := msg.Mutable(fd).Map() + valFD := fd.MapValue() + for k, item := range obj { + key, err := mapKey(fd.MapKey(), k) + if err != nil { + return fmt.Errorf("key %q: %w", k, err) + } + v, err := unmarshalSingular(valFD, item, func() protoreflect.Value { return mp.NewValue() }) + if err != nil { + return fmt.Errorf("key %q: %w", k, err) + } + mp.Set(key, v) + } + return nil + + case fd.Kind() == protoreflect.MessageKind || fd.Kind() == protoreflect.GroupKind: + val := msg.NewField(fd) + if err := unmarshalMessage(data, val.Message()); err != nil { + return err + } + msg.Set(fd, val) + return nil + + default: + v, err := unmarshalScalar(fd, data) + if err != nil { + return err + } + msg.Set(fd, v) + return nil + } +} + +// unmarshalSingular decodes one array element or map value. +func unmarshalSingular(fd protoreflect.FieldDescriptor, data json.RawMessage, newMessage func() protoreflect.Value) (protoreflect.Value, error) { + if fd.Kind() == protoreflect.MessageKind || fd.Kind() == protoreflect.GroupKind { + val := newMessage() + if err := unmarshalMessage(data, val.Message()); err != nil { + return protoreflect.Value{}, err + } + return val, nil + } + return unmarshalScalar(fd, data) +} + +// unmarshalScalar decodes a JSON scalar into a proto scalar value, the inverse +// of marshalSingular's non-message cases. Numeric kinds are dispatched to +// unmarshalNumericScalar. +func unmarshalScalar(fd protoreflect.FieldDescriptor, data json.RawMessage) (protoreflect.Value, error) { + // encoding/json decodes null into string/bool targets as a silent no-op; + // reject it explicitly so array elements and map values never silently + // become zero values (OCSF arrays carry no nulls). + if isJSONNull(data) { + return protoreflect.Value{}, fmt.Errorf("unexpected JSON null for %v", fd.Kind()) + } + + switch fd.Kind() { + case protoreflect.BoolKind: + var b bool + if err := json.Unmarshal(data, &b); err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfBool(b), nil + + case protoreflect.StringKind: + var s string + if err := json.Unmarshal(data, &s); err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfString(s), nil + + case protoreflect.BytesKind: + var s string + if err := json.Unmarshal(data, &s); err != nil { + return protoreflect.Value{}, err + } + b, err := base64.StdEncoding.DecodeString(s) + if err != nil { + return protoreflect.Value{}, fmt.Errorf("base64: %w", err) + } + return protoreflect.ValueOfBytes(b), nil + + default: + return unmarshalNumericScalar(fd, data) + } +} + +// unmarshalNumericScalar decodes the enum, integer, and floating-point kinds. +func unmarshalNumericScalar(fd protoreflect.FieldDescriptor, data json.RawMessage) (protoreflect.Value, error) { + switch fd.Kind() { + case protoreflect.EnumKind: + n, err := decodeInt32(data) + if err != nil { + return protoreflect.Value{}, fmt.Errorf("enum: %w", err) + } + return protoreflect.ValueOfEnum(protoreflect.EnumNumber(n)), nil + + case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind: + n, err := decodeInt32(data) + if err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfInt32(n), nil + + case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind: + n, err := decodeInt(data) + if err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfInt64(n), nil + + case protoreflect.Uint32Kind, protoreflect.Fixed32Kind: + n, err := decodeUint32(data) + if err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfUint32(n), nil + + case protoreflect.Uint64Kind, protoreflect.Fixed64Kind: + n, err := decodeUint(data) + if err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfUint64(n), nil + + case protoreflect.FloatKind: + var f float64 + if err := json.Unmarshal(data, &f); err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfFloat32(float32(f)), nil + + case protoreflect.DoubleKind: + var f float64 + if err := json.Unmarshal(data, &f); err != nil { + return protoreflect.Value{}, err + } + return protoreflect.ValueOfFloat64(f), nil + + default: + return protoreflect.Value{}, fmt.Errorf("unsupported proto kind %v", fd.Kind()) + } +} + +// mapKey converts a JSON object key string into a proto map key. +func mapKey(fd protoreflect.FieldDescriptor, key string) (protoreflect.MapKey, error) { + v, err := unmarshalScalar(fd, mustQuote(fd, key)) + if err != nil { + return protoreflect.MapKey{}, err + } + return v.MapKey(), nil +} + +// mustQuote re-encodes a map key string as the JSON literal the scalar decoder +// expects: quoted for string keys, bare for numeric/bool keys. +func mustQuote(fd protoreflect.FieldDescriptor, key string) json.RawMessage { + if fd.Kind() == protoreflect.StringKind { + quoted, _ := json.Marshal(key) + return quoted + } + return json.RawMessage(key) +} + +// decodeNumber extracts the decimal literal from data: a bare JSON number, or +// (for protojson interoperability, which quotes 64-bit integers) a JSON string +// containing one. +func decodeNumber(data json.RawMessage) (json.Number, error) { + trimmed := bytes.TrimSpace(data) + if len(trimmed) > 0 && trimmed[0] == '"' { + var s string + if err := json.Unmarshal(trimmed, &s); err != nil { + return "", fmt.Errorf("expected JSON number: %w", err) + } + return json.Number(s), nil + } + var n json.Number + dec := json.NewDecoder(bytes.NewReader(trimmed)) + dec.UseNumber() + if err := dec.Decode(&n); err != nil { + return "", fmt.Errorf("expected JSON number: %w", err) + } + return n, nil +} + +// decodeInt parses a JSON number (or quoted decimal string) as int64 without +// float64 precision loss. +func decodeInt(data json.RawMessage) (int64, error) { + n, err := decodeNumber(data) + if err != nil { + return 0, err + } + return n.Int64() +} + +// decodeInt32 parses a JSON number as int32, rejecting overflow. +func decodeInt32(data json.RawMessage) (int32, error) { + n, err := decodeInt(data) + if err != nil { + return 0, err + } + if n < math.MinInt32 || n > math.MaxInt32 { + return 0, fmt.Errorf("value %d overflows int32", n) + } + return int32(n), nil +} + +// decodeUint32 parses a JSON number as uint32, rejecting overflow. +func decodeUint32(data json.RawMessage) (uint32, error) { + n, err := decodeUint(data) + if err != nil { + return 0, err + } + if n > math.MaxUint32 { + return 0, fmt.Errorf("value %d overflows uint32", n) + } + return uint32(n), nil +} + +// decodeUint parses a JSON number (or quoted decimal string) as uint64. +func decodeUint(data json.RawMessage) (uint64, error) { + n, err := decodeNumber(data) + if err != nil { + return 0, err + } + var u uint64 + if _, err := fmt.Sscanf(n.String(), "%d", &u); err != nil { + return 0, fmt.Errorf("parse %q as uint64: %w", n.String(), err) + } + return u, nil +} + +// isJSONNull reports whether data is the JSON literal null. +func isJSONNull(data json.RawMessage) bool { + return bytes.Equal(bytes.TrimSpace(data), []byte("null")) +} + +// isValueField reports whether fd is a singular google.protobuf.Value field. +func isValueField(fd protoreflect.FieldDescriptor) bool { + return fd.Kind() == protoreflect.MessageKind && !fd.IsList() && !fd.IsMap() && + fd.Message().FullName() == "google.protobuf.Value" +} diff --git a/ocsf/internal/ocsf/exporter/importer_test.go b/ocsf/internal/ocsf/exporter/importer_test.go new file mode 100644 index 0000000..08a301f --- /dev/null +++ b/ocsf/internal/ocsf/exporter/importer_test.go @@ -0,0 +1,176 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package exporter_test + +import ( + "encoding/json" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/types/known/structpb" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" + samplev1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter/testdata/sample" +) + +// fullSample builds a SampleEvent exercising every field kind the importer +// must invert: enum, int64, int32, string, bool, double, Value, repeated +// string, nested message, optional string, repeated enum. +func fullSample(t *testing.T) *samplev1.SampleEvent { + t.Helper() + metadata, err := structpb.NewValue(map[string]any{ + "labels": []any{"a", "b"}, + "depth": 2.5, + "nested": map[string]any{"k": "v"}, + }) + require.NoError(t, err) + note := "a note" + return &samplev1.SampleEvent{ + SeverityId: samplev1.SampleEvent_SEVERITY_ID_CRITICAL, + Time: 1751313600000, + Count: 42, + MessageText: "hello", + IsAlert: true, + Score: 99.5, + Metadata: metadata, + Tags: []string{"x", "y"}, + Actor: &samplev1.Actor{Name: "alice", Uid: 9007199254740993}, // > 2^53 + Note: ¬e, + Severities: []samplev1.SampleEvent_SeverityId{ + samplev1.SampleEvent_SEVERITY_ID_CRITICAL, + samplev1.SampleEvent_SEVERITY_ID_OTHER, + }, + } +} + +// TestFromOCSFJSON_RoundTripProtoJSONProto proves proto → JSON → proto is +// lossless: FromOCSFJSON(ToOCSFJSON(evt)) equals evt. +func TestFromOCSFJSON_RoundTripProtoJSONProto(t *testing.T) { + original := fullSample(t) + + b, err := exporter.ToOCSFJSON(original) + require.NoError(t, err) + + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.True(t, proto.Equal(original, &decoded), + "proto → JSON → proto must be lossless\njson: %s", b) +} + +// TestFromOCSFJSON_RoundTripJSONProtoJSON proves JSON → proto → JSON is +// byte-identical for conformant input (ToOCSFJSON output is deterministic). +func TestFromOCSFJSON_RoundTripJSONProtoJSON(t *testing.T) { + b, err := exporter.ToOCSFJSON(fullSample(t)) + require.NoError(t, err) + + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + + b2, err := exporter.ToOCSFJSON(&decoded) + require.NoError(t, err) + require.Equal(t, string(b), string(b2), "JSON → proto → JSON must be byte-identical") +} + +// TestFromOCSFJSON_IntegerEnums verifies enums decode from OCSF integer +// values, including values with no named constant (open-enum forward compat). +func TestFromOCSFJSON_IntegerEnums(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"severity_id":5,"severities":[99,7]}`), &evt)) + require.Equal(t, samplev1.SampleEvent_SEVERITY_ID_CRITICAL, evt.SeverityId) + require.Len(t, evt.Severities, 2) + require.Equal(t, samplev1.SampleEvent_SEVERITY_ID_OTHER, evt.Severities[0]) + // 7 has no named constant; the raw number must be preserved. + require.Equal(t, samplev1.SampleEvent_SeverityId(7), evt.Severities[1]) +} + +// TestFromOCSFJSON_Int64Precision verifies int64 decodes beyond 2^53 without +// float64 truncation, from both unquoted (OCSF) and quoted (protojson) forms. +func TestFromOCSFJSON_Int64Precision(t *testing.T) { + const big = int64(9007199254740993) // 2^53 + 1 + + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"time":9007199254740993}`), &evt)) + require.Equal(t, big, evt.Time) + + var quoted samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"time":"9007199254740993"}`), "ed)) + require.Equal(t, big, quoted.Time) +} + +// TestFromOCSFJSON_UnknownKeysGoToUnmapped verifies unknown top-level keys +// land in the message's unmapped-style Value field ("metadata" on SampleEvent +// has the json_t role but is named differently, so this test uses a payload +// with the field absent to check the error path, and the merge path is +// covered by the conformance suite on real classes with "unmapped"). +func TestFromOCSFJSON_UnknownKeysError(t *testing.T) { + // SampleEvent has no "unmapped" field: unknown keys must error, naming them. + var evt samplev1.SampleEvent + err := exporter.FromOCSFJSON([]byte(`{"count":1,"never_heard_of_it":true}`), &evt) + require.ErrorContains(t, err, "never_heard_of_it") + require.ErrorContains(t, err, "unmapped") +} + +// TestFromOCSFJSON_NullAndAbsent verifies JSON null and absent keys both leave +// fields unset. +func TestFromOCSFJSON_NullAndAbsent(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"note":null,"count":3}`), &evt)) + require.Nil(t, evt.Note) + require.Equal(t, int32(3), evt.Count) + require.Zero(t, evt.Time) +} + +// TestFromOCSFJSON_ValueField verifies google.protobuf.Value fields take +// arbitrary JSON. +func TestFromOCSFJSON_ValueField(t *testing.T) { + payload := []byte(`{"metadata":{"a":[1,2,{"b":"c"}],"d":null}}`) + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(payload, &evt)) + + got, err := evt.Metadata.MarshalJSON() + require.NoError(t, err) + + var want, gotAny any + require.NoError(t, json.Unmarshal([]byte(`{"a":[1,2,{"b":"c"}],"d":null}`), &want)) + require.NoError(t, json.Unmarshal(got, &gotAny)) + require.Equal(t, want, gotAny) +} + +// TestFromOCSFJSON_ResetsTarget verifies the target message is reset before +// decoding, so reuse does not leak fields between events. +func TestFromOCSFJSON_ResetsTarget(t *testing.T) { + evt := fullSample(t) + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"count":1}`), evt)) + require.Equal(t, int32(1), evt.Count) + require.Empty(t, evt.MessageText, "previous contents must be cleared") + require.Nil(t, evt.Actor) +} + +// TestFromOCSFJSON_TypeMismatchErrors verifies a JSON type mismatch surfaces +// as an error naming the field. +func TestFromOCSFJSON_TypeMismatchErrors(t *testing.T) { + var evt samplev1.SampleEvent + err := exporter.FromOCSFJSON([]byte(`{"count":"not-a-number"}`), &evt) + require.ErrorContains(t, err, `field "count"`) + + err = exporter.FromOCSFJSON([]byte(`{"tags":"not-an-array"}`), &evt) + require.ErrorContains(t, err, `field "tags"`) + + err = exporter.FromOCSFJSON([]byte(`{"actor":[1,2]}`), &evt) + require.ErrorContains(t, err, `field "actor"`) +} + +// TestFromOCSFJSON_EmptyObject verifies {} decodes to the zero message. +func TestFromOCSFJSON_EmptyObject(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{}`), &evt)) + require.True(t, proto.Equal(&samplev1.SampleEvent{}, &evt)) +} From e7bfa3363c62ab16b5d546a3dd0effd501ddd61f Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:25:17 +0200 Subject: [PATCH 17/26] test(ocsf): conformance for the merged AuditEvent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generate Go bindings for the merged layout (buf.gen.merged.yaml over golden-merged; objects.proto maps to the same Go package as the per-class bindings and is byte-identical, so only audit_event.pb.go is new) and prove the four properties the single-topic design rests on: 1. Wire round-trip on the AuditEvent bindings for events of both classes. 2. JSON equivalence: an AuditEvent exports OCSF JSON deeply equal to the per-class message carrying the same event, and per-class JSON decodes into the equivalent AuditEvent — one topic loses nothing. 3. JSON round-trip both ways (lossless / byte-identical). 4. protovalidate (new test dependency buf.build/go/protovalidate) enforces the generated class-aware CEL: valid events of both classes pass, and type_uid inconsistency, foreign-class fields, and missing per-class required fields are each rejected. The merged events also validate CLEAN against the live OCSF server (schema.ocsf.io api/v2/validate), same skip-on-connectivity contract as the per-class conformance test. Co-Authored-By: Claude Fable 5 --- ocsf/go.mod | 12 +- ocsf/go.sum | 33 +- .../conformance/genpb/buf.gen.merged.yaml | 27 + .../genpb/ocsf/v1/audit_event.pb.go | 1546 +++++++++++++++++ ocsf/internal/ocsf/conformance/merged_test.go | 302 ++++ 5 files changed, 1915 insertions(+), 5 deletions(-) create mode 100644 ocsf/internal/ocsf/conformance/genpb/buf.gen.merged.yaml create mode 100644 ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go create mode 100644 ocsf/internal/ocsf/conformance/merged_test.go diff --git a/ocsf/go.mod b/ocsf/go.mod index cdd7ea5..356bdad 100644 --- a/ocsf/go.mod +++ b/ocsf/go.mod @@ -3,13 +3,21 @@ module github.com/redpanda-data/common-go/ocsf go 1.24.3 require ( - github.com/stretchr/testify v1.10.0 + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 + buf.build/go/protovalidate v1.2.0 + github.com/stretchr/testify v1.11.1 google.golang.org/protobuf v1.36.11 ) require ( - buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect + cel.dev/expr v0.25.1 // indirect + github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect + github.com/google/cel-go v0.28.0 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect + golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect + golang.org/x/text v0.28.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/ocsf/go.sum b/ocsf/go.sum index 57299fc..5cd8f52 100644 --- a/ocsf/go.sum +++ b/ocsf/go.sum @@ -1,16 +1,43 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg= buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= +buf.build/go/protovalidate v1.2.0 h1:DQVrUWkmGTBij+kOYv/x2LLxwcLaGKMdzShj1/6/3H0= +buf.build/go/protovalidate v1.2.0/go.mod h1:7rYiQEhqvAipoazpVNBBH2S2f8bjG4huMVy1V2Yofn4= +cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4= +cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= +github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ= +github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw= +github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4= +github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc= +github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8= +github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE= +golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4= +golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= +golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= +google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58= +google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/ocsf/internal/ocsf/conformance/genpb/buf.gen.merged.yaml b/ocsf/internal/ocsf/conformance/genpb/buf.gen.merged.yaml new file mode 100644 index 0000000..4863fb2 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/buf.gen.merged.yaml @@ -0,0 +1,27 @@ +# buf.gen.merged.yaml — how audit_event.pb.go is produced from the MERGED +# golden proto tree (the single-event AuditEvent layout). +# +# Regenerate from the ocsf MODULE ROOT: +# +# cd ocsf +# buf generate --template internal/ocsf/conformance/genpb/buf.gen.merged.yaml +# task fmt # gci/gofumpt the freshly generated .pb.go +# +# golden-merged/ocsf/v1/objects.proto is byte-identical to +# golden/ocsf/v1/objects.proto (both are emitted by emitObjectsFile from the +# same closure and tagmap keys), so this template maps it to the SAME Go +# package as the per-class bindings and its regenerated objects.pb.go is a +# no-op diff. Only audit_event.pb.go is new. Everything lands in Go package +# ocsfv1 next to the per-class bindings; the proto file path +# "ocsf/v1/audit_event.proto" is unique in the registry, so both layouts +# coexist in one binary. +version: v2 +plugins: + - local: protoc-gen-go + out: internal/ocsf/conformance/genpb + opt: + - paths=source_relative + - Mocsf/v1/audit_event.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1;ocsfv1 + - Mocsf/v1/objects.proto=github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1;ocsfv1 +inputs: + - directory: internal/ocsf/gen/testdata/golden-merged diff --git a/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go new file mode 100644 index 0000000..8ee9227 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go @@ -0,0 +1,1546 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Code generated by ocsf-protogen. DO NOT EDIT. +// Source: OCSF schema 1.8.0 + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.6 +// protoc (unknown) +// source: ocsf/v1/audit_event.proto + +package ocsfv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + structpb "google.golang.org/protobuf/types/known/structpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type AuditEvent_ActionId int32 + +const ( + AuditEvent_ACTION_ID_UNKNOWN AuditEvent_ActionId = 0 + AuditEvent_ACTION_ID_ALLOWED AuditEvent_ActionId = 1 + AuditEvent_ACTION_ID_DENIED AuditEvent_ActionId = 2 + AuditEvent_ACTION_ID_OBSERVED AuditEvent_ActionId = 3 + AuditEvent_ACTION_ID_MODIFIED AuditEvent_ActionId = 4 + AuditEvent_ACTION_ID_OTHER AuditEvent_ActionId = 99 +) + +// Enum value maps for AuditEvent_ActionId. +var ( + AuditEvent_ActionId_name = map[int32]string{ + 0: "ACTION_ID_UNKNOWN", + 1: "ACTION_ID_ALLOWED", + 2: "ACTION_ID_DENIED", + 3: "ACTION_ID_OBSERVED", + 4: "ACTION_ID_MODIFIED", + 99: "ACTION_ID_OTHER", + } + AuditEvent_ActionId_value = map[string]int32{ + "ACTION_ID_UNKNOWN": 0, + "ACTION_ID_ALLOWED": 1, + "ACTION_ID_DENIED": 2, + "ACTION_ID_OBSERVED": 3, + "ACTION_ID_MODIFIED": 4, + "ACTION_ID_OTHER": 99, + } +) + +func (x AuditEvent_ActionId) Enum() *AuditEvent_ActionId { + p := new(AuditEvent_ActionId) + *p = x + return p +} + +func (x AuditEvent_ActionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_ActionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[0].Descriptor() +} + +func (AuditEvent_ActionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[0] +} + +func (x AuditEvent_ActionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_ActionId.Descriptor instead. +func (AuditEvent_ActionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 0} +} + +type AuditEvent_CategoryUid int32 + +const ( + AuditEvent_CATEGORY_UID_UNKNOWN AuditEvent_CategoryUid = 0 + AuditEvent_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT AuditEvent_CategoryUid = 3 + AuditEvent_CATEGORY_UID_APPLICATION_ACTIVITY AuditEvent_CategoryUid = 6 +) + +// Enum value maps for AuditEvent_CategoryUid. +var ( + AuditEvent_CategoryUid_name = map[int32]string{ + 0: "CATEGORY_UID_UNKNOWN", + 3: "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT", + 6: "CATEGORY_UID_APPLICATION_ACTIVITY", + } + AuditEvent_CategoryUid_value = map[string]int32{ + "CATEGORY_UID_UNKNOWN": 0, + "CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT": 3, + "CATEGORY_UID_APPLICATION_ACTIVITY": 6, + } +) + +func (x AuditEvent_CategoryUid) Enum() *AuditEvent_CategoryUid { + p := new(AuditEvent_CategoryUid) + *p = x + return p +} + +func (x AuditEvent_CategoryUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_CategoryUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[1].Descriptor() +} + +func (AuditEvent_CategoryUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[1] +} + +func (x AuditEvent_CategoryUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_CategoryUid.Descriptor instead. +func (AuditEvent_CategoryUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 1} +} + +type AuditEvent_ClassUid int32 + +const ( + AuditEvent_CLASS_UID_UNKNOWN AuditEvent_ClassUid = 0 + AuditEvent_CLASS_UID_ENTITY_MANAGEMENT AuditEvent_ClassUid = 3004 + AuditEvent_CLASS_UID_API_ACTIVITY AuditEvent_ClassUid = 6003 +) + +// Enum value maps for AuditEvent_ClassUid. +var ( + AuditEvent_ClassUid_name = map[int32]string{ + 0: "CLASS_UID_UNKNOWN", + 3004: "CLASS_UID_ENTITY_MANAGEMENT", + 6003: "CLASS_UID_API_ACTIVITY", + } + AuditEvent_ClassUid_value = map[string]int32{ + "CLASS_UID_UNKNOWN": 0, + "CLASS_UID_ENTITY_MANAGEMENT": 3004, + "CLASS_UID_API_ACTIVITY": 6003, + } +) + +func (x AuditEvent_ClassUid) Enum() *AuditEvent_ClassUid { + p := new(AuditEvent_ClassUid) + *p = x + return p +} + +func (x AuditEvent_ClassUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_ClassUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[2].Descriptor() +} + +func (AuditEvent_ClassUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[2] +} + +func (x AuditEvent_ClassUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_ClassUid.Descriptor instead. +func (AuditEvent_ClassUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 2} +} + +type AuditEvent_ConfidenceId int32 + +const ( + AuditEvent_CONFIDENCE_ID_UNKNOWN AuditEvent_ConfidenceId = 0 + AuditEvent_CONFIDENCE_ID_LOW AuditEvent_ConfidenceId = 1 + AuditEvent_CONFIDENCE_ID_MEDIUM AuditEvent_ConfidenceId = 2 + AuditEvent_CONFIDENCE_ID_HIGH AuditEvent_ConfidenceId = 3 + AuditEvent_CONFIDENCE_ID_OTHER AuditEvent_ConfidenceId = 99 +) + +// Enum value maps for AuditEvent_ConfidenceId. +var ( + AuditEvent_ConfidenceId_name = map[int32]string{ + 0: "CONFIDENCE_ID_UNKNOWN", + 1: "CONFIDENCE_ID_LOW", + 2: "CONFIDENCE_ID_MEDIUM", + 3: "CONFIDENCE_ID_HIGH", + 99: "CONFIDENCE_ID_OTHER", + } + AuditEvent_ConfidenceId_value = map[string]int32{ + "CONFIDENCE_ID_UNKNOWN": 0, + "CONFIDENCE_ID_LOW": 1, + "CONFIDENCE_ID_MEDIUM": 2, + "CONFIDENCE_ID_HIGH": 3, + "CONFIDENCE_ID_OTHER": 99, + } +) + +func (x AuditEvent_ConfidenceId) Enum() *AuditEvent_ConfidenceId { + p := new(AuditEvent_ConfidenceId) + *p = x + return p +} + +func (x AuditEvent_ConfidenceId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_ConfidenceId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[3].Descriptor() +} + +func (AuditEvent_ConfidenceId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[3] +} + +func (x AuditEvent_ConfidenceId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_ConfidenceId.Descriptor instead. +func (AuditEvent_ConfidenceId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 3} +} + +type AuditEvent_DispositionId int32 + +const ( + AuditEvent_DISPOSITION_ID_UNKNOWN AuditEvent_DispositionId = 0 + AuditEvent_DISPOSITION_ID_ALLOWED AuditEvent_DispositionId = 1 + AuditEvent_DISPOSITION_ID_BLOCKED AuditEvent_DispositionId = 2 + AuditEvent_DISPOSITION_ID_QUARANTINED AuditEvent_DispositionId = 3 + AuditEvent_DISPOSITION_ID_ISOLATED AuditEvent_DispositionId = 4 + AuditEvent_DISPOSITION_ID_DELETED AuditEvent_DispositionId = 5 + AuditEvent_DISPOSITION_ID_DROPPED AuditEvent_DispositionId = 6 + AuditEvent_DISPOSITION_ID_CUSTOM_ACTION AuditEvent_DispositionId = 7 + AuditEvent_DISPOSITION_ID_APPROVED AuditEvent_DispositionId = 8 + AuditEvent_DISPOSITION_ID_RESTORED AuditEvent_DispositionId = 9 + AuditEvent_DISPOSITION_ID_EXONERATED AuditEvent_DispositionId = 10 + AuditEvent_DISPOSITION_ID_CORRECTED AuditEvent_DispositionId = 11 + AuditEvent_DISPOSITION_ID_PARTIALLY_CORRECTED AuditEvent_DispositionId = 12 + AuditEvent_DISPOSITION_ID_UNCORRECTED AuditEvent_DispositionId = 13 + AuditEvent_DISPOSITION_ID_DELAYED AuditEvent_DispositionId = 14 + AuditEvent_DISPOSITION_ID_DETECTED AuditEvent_DispositionId = 15 + AuditEvent_DISPOSITION_ID_NO_ACTION AuditEvent_DispositionId = 16 + AuditEvent_DISPOSITION_ID_LOGGED AuditEvent_DispositionId = 17 + AuditEvent_DISPOSITION_ID_TAGGED AuditEvent_DispositionId = 18 + AuditEvent_DISPOSITION_ID_ALERT AuditEvent_DispositionId = 19 + AuditEvent_DISPOSITION_ID_COUNT AuditEvent_DispositionId = 20 + AuditEvent_DISPOSITION_ID_RESET AuditEvent_DispositionId = 21 + AuditEvent_DISPOSITION_ID_CAPTCHA AuditEvent_DispositionId = 22 + AuditEvent_DISPOSITION_ID_CHALLENGE AuditEvent_DispositionId = 23 + AuditEvent_DISPOSITION_ID_ACCESS_REVOKED AuditEvent_DispositionId = 24 + AuditEvent_DISPOSITION_ID_REJECTED AuditEvent_DispositionId = 25 + AuditEvent_DISPOSITION_ID_UNAUTHORIZED AuditEvent_DispositionId = 26 + AuditEvent_DISPOSITION_ID_ERROR AuditEvent_DispositionId = 27 + AuditEvent_DISPOSITION_ID_OTHER AuditEvent_DispositionId = 99 +) + +// Enum value maps for AuditEvent_DispositionId. +var ( + AuditEvent_DispositionId_name = map[int32]string{ + 0: "DISPOSITION_ID_UNKNOWN", + 1: "DISPOSITION_ID_ALLOWED", + 2: "DISPOSITION_ID_BLOCKED", + 3: "DISPOSITION_ID_QUARANTINED", + 4: "DISPOSITION_ID_ISOLATED", + 5: "DISPOSITION_ID_DELETED", + 6: "DISPOSITION_ID_DROPPED", + 7: "DISPOSITION_ID_CUSTOM_ACTION", + 8: "DISPOSITION_ID_APPROVED", + 9: "DISPOSITION_ID_RESTORED", + 10: "DISPOSITION_ID_EXONERATED", + 11: "DISPOSITION_ID_CORRECTED", + 12: "DISPOSITION_ID_PARTIALLY_CORRECTED", + 13: "DISPOSITION_ID_UNCORRECTED", + 14: "DISPOSITION_ID_DELAYED", + 15: "DISPOSITION_ID_DETECTED", + 16: "DISPOSITION_ID_NO_ACTION", + 17: "DISPOSITION_ID_LOGGED", + 18: "DISPOSITION_ID_TAGGED", + 19: "DISPOSITION_ID_ALERT", + 20: "DISPOSITION_ID_COUNT", + 21: "DISPOSITION_ID_RESET", + 22: "DISPOSITION_ID_CAPTCHA", + 23: "DISPOSITION_ID_CHALLENGE", + 24: "DISPOSITION_ID_ACCESS_REVOKED", + 25: "DISPOSITION_ID_REJECTED", + 26: "DISPOSITION_ID_UNAUTHORIZED", + 27: "DISPOSITION_ID_ERROR", + 99: "DISPOSITION_ID_OTHER", + } + AuditEvent_DispositionId_value = map[string]int32{ + "DISPOSITION_ID_UNKNOWN": 0, + "DISPOSITION_ID_ALLOWED": 1, + "DISPOSITION_ID_BLOCKED": 2, + "DISPOSITION_ID_QUARANTINED": 3, + "DISPOSITION_ID_ISOLATED": 4, + "DISPOSITION_ID_DELETED": 5, + "DISPOSITION_ID_DROPPED": 6, + "DISPOSITION_ID_CUSTOM_ACTION": 7, + "DISPOSITION_ID_APPROVED": 8, + "DISPOSITION_ID_RESTORED": 9, + "DISPOSITION_ID_EXONERATED": 10, + "DISPOSITION_ID_CORRECTED": 11, + "DISPOSITION_ID_PARTIALLY_CORRECTED": 12, + "DISPOSITION_ID_UNCORRECTED": 13, + "DISPOSITION_ID_DELAYED": 14, + "DISPOSITION_ID_DETECTED": 15, + "DISPOSITION_ID_NO_ACTION": 16, + "DISPOSITION_ID_LOGGED": 17, + "DISPOSITION_ID_TAGGED": 18, + "DISPOSITION_ID_ALERT": 19, + "DISPOSITION_ID_COUNT": 20, + "DISPOSITION_ID_RESET": 21, + "DISPOSITION_ID_CAPTCHA": 22, + "DISPOSITION_ID_CHALLENGE": 23, + "DISPOSITION_ID_ACCESS_REVOKED": 24, + "DISPOSITION_ID_REJECTED": 25, + "DISPOSITION_ID_UNAUTHORIZED": 26, + "DISPOSITION_ID_ERROR": 27, + "DISPOSITION_ID_OTHER": 99, + } +) + +func (x AuditEvent_DispositionId) Enum() *AuditEvent_DispositionId { + p := new(AuditEvent_DispositionId) + *p = x + return p +} + +func (x AuditEvent_DispositionId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_DispositionId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[4].Descriptor() +} + +func (AuditEvent_DispositionId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[4] +} + +func (x AuditEvent_DispositionId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_DispositionId.Descriptor instead. +func (AuditEvent_DispositionId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 4} +} + +type AuditEvent_RiskLevelId int32 + +const ( + AuditEvent_RISK_LEVEL_ID_INFO AuditEvent_RiskLevelId = 0 + AuditEvent_RISK_LEVEL_ID_LOW AuditEvent_RiskLevelId = 1 + AuditEvent_RISK_LEVEL_ID_MEDIUM AuditEvent_RiskLevelId = 2 + AuditEvent_RISK_LEVEL_ID_HIGH AuditEvent_RiskLevelId = 3 + AuditEvent_RISK_LEVEL_ID_CRITICAL AuditEvent_RiskLevelId = 4 + AuditEvent_RISK_LEVEL_ID_OTHER AuditEvent_RiskLevelId = 99 +) + +// Enum value maps for AuditEvent_RiskLevelId. +var ( + AuditEvent_RiskLevelId_name = map[int32]string{ + 0: "RISK_LEVEL_ID_INFO", + 1: "RISK_LEVEL_ID_LOW", + 2: "RISK_LEVEL_ID_MEDIUM", + 3: "RISK_LEVEL_ID_HIGH", + 4: "RISK_LEVEL_ID_CRITICAL", + 99: "RISK_LEVEL_ID_OTHER", + } + AuditEvent_RiskLevelId_value = map[string]int32{ + "RISK_LEVEL_ID_INFO": 0, + "RISK_LEVEL_ID_LOW": 1, + "RISK_LEVEL_ID_MEDIUM": 2, + "RISK_LEVEL_ID_HIGH": 3, + "RISK_LEVEL_ID_CRITICAL": 4, + "RISK_LEVEL_ID_OTHER": 99, + } +) + +func (x AuditEvent_RiskLevelId) Enum() *AuditEvent_RiskLevelId { + p := new(AuditEvent_RiskLevelId) + *p = x + return p +} + +func (x AuditEvent_RiskLevelId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_RiskLevelId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[5].Descriptor() +} + +func (AuditEvent_RiskLevelId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[5] +} + +func (x AuditEvent_RiskLevelId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_RiskLevelId.Descriptor instead. +func (AuditEvent_RiskLevelId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 5} +} + +type AuditEvent_SeverityId int32 + +const ( + AuditEvent_SEVERITY_ID_UNKNOWN AuditEvent_SeverityId = 0 + AuditEvent_SEVERITY_ID_INFORMATIONAL AuditEvent_SeverityId = 1 + AuditEvent_SEVERITY_ID_LOW AuditEvent_SeverityId = 2 + AuditEvent_SEVERITY_ID_MEDIUM AuditEvent_SeverityId = 3 + AuditEvent_SEVERITY_ID_HIGH AuditEvent_SeverityId = 4 + AuditEvent_SEVERITY_ID_CRITICAL AuditEvent_SeverityId = 5 + AuditEvent_SEVERITY_ID_FATAL AuditEvent_SeverityId = 6 + AuditEvent_SEVERITY_ID_OTHER AuditEvent_SeverityId = 99 +) + +// Enum value maps for AuditEvent_SeverityId. +var ( + AuditEvent_SeverityId_name = map[int32]string{ + 0: "SEVERITY_ID_UNKNOWN", + 1: "SEVERITY_ID_INFORMATIONAL", + 2: "SEVERITY_ID_LOW", + 3: "SEVERITY_ID_MEDIUM", + 4: "SEVERITY_ID_HIGH", + 5: "SEVERITY_ID_CRITICAL", + 6: "SEVERITY_ID_FATAL", + 99: "SEVERITY_ID_OTHER", + } + AuditEvent_SeverityId_value = map[string]int32{ + "SEVERITY_ID_UNKNOWN": 0, + "SEVERITY_ID_INFORMATIONAL": 1, + "SEVERITY_ID_LOW": 2, + "SEVERITY_ID_MEDIUM": 3, + "SEVERITY_ID_HIGH": 4, + "SEVERITY_ID_CRITICAL": 5, + "SEVERITY_ID_FATAL": 6, + "SEVERITY_ID_OTHER": 99, + } +) + +func (x AuditEvent_SeverityId) Enum() *AuditEvent_SeverityId { + p := new(AuditEvent_SeverityId) + *p = x + return p +} + +func (x AuditEvent_SeverityId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_SeverityId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[6].Descriptor() +} + +func (AuditEvent_SeverityId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[6] +} + +func (x AuditEvent_SeverityId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_SeverityId.Descriptor instead. +func (AuditEvent_SeverityId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 6} +} + +type AuditEvent_StatusId int32 + +const ( + AuditEvent_STATUS_ID_UNKNOWN AuditEvent_StatusId = 0 + AuditEvent_STATUS_ID_SUCCESS AuditEvent_StatusId = 1 + AuditEvent_STATUS_ID_FAILURE AuditEvent_StatusId = 2 + AuditEvent_STATUS_ID_OTHER AuditEvent_StatusId = 99 +) + +// Enum value maps for AuditEvent_StatusId. +var ( + AuditEvent_StatusId_name = map[int32]string{ + 0: "STATUS_ID_UNKNOWN", + 1: "STATUS_ID_SUCCESS", + 2: "STATUS_ID_FAILURE", + 99: "STATUS_ID_OTHER", + } + AuditEvent_StatusId_value = map[string]int32{ + "STATUS_ID_UNKNOWN": 0, + "STATUS_ID_SUCCESS": 1, + "STATUS_ID_FAILURE": 2, + "STATUS_ID_OTHER": 99, + } +) + +func (x AuditEvent_StatusId) Enum() *AuditEvent_StatusId { + p := new(AuditEvent_StatusId) + *p = x + return p +} + +func (x AuditEvent_StatusId) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_StatusId) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[7].Descriptor() +} + +func (AuditEvent_StatusId) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[7] +} + +func (x AuditEvent_StatusId) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_StatusId.Descriptor instead. +func (AuditEvent_StatusId) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 7} +} + +type AuditEvent_TypeUid int32 + +const ( + AuditEvent_TYPE_UID_UNKNOWN AuditEvent_TypeUid = 0 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN AuditEvent_TypeUid = 300400 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_CREATE AuditEvent_TypeUid = 300401 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_READ AuditEvent_TypeUid = 300402 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_UPDATE AuditEvent_TypeUid = 300403 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_DELETE AuditEvent_TypeUid = 300404 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_MOVE AuditEvent_TypeUid = 300405 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_ENROLL AuditEvent_TypeUid = 300406 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_UNENROLL AuditEvent_TypeUid = 300407 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_ENABLE AuditEvent_TypeUid = 300408 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_DISABLE AuditEvent_TypeUid = 300409 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE AuditEvent_TypeUid = 300410 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE AuditEvent_TypeUid = 300411 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_SUSPEND AuditEvent_TypeUid = 300412 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_RESUME AuditEvent_TypeUid = 300413 + AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_OTHER AuditEvent_TypeUid = 300499 + AuditEvent_TYPE_UID_API_ACTIVITY_UNKNOWN AuditEvent_TypeUid = 600300 + AuditEvent_TYPE_UID_API_ACTIVITY_CREATE AuditEvent_TypeUid = 600301 + AuditEvent_TYPE_UID_API_ACTIVITY_READ AuditEvent_TypeUid = 600302 + AuditEvent_TYPE_UID_API_ACTIVITY_UPDATE AuditEvent_TypeUid = 600303 + AuditEvent_TYPE_UID_API_ACTIVITY_DELETE AuditEvent_TypeUid = 600304 + AuditEvent_TYPE_UID_API_ACTIVITY_OTHER AuditEvent_TypeUid = 600399 +) + +// Enum value maps for AuditEvent_TypeUid. +var ( + AuditEvent_TypeUid_name = map[int32]string{ + 0: "TYPE_UID_UNKNOWN", + 300400: "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN", + 300401: "TYPE_UID_ENTITY_MANAGEMENT_CREATE", + 300402: "TYPE_UID_ENTITY_MANAGEMENT_READ", + 300403: "TYPE_UID_ENTITY_MANAGEMENT_UPDATE", + 300404: "TYPE_UID_ENTITY_MANAGEMENT_DELETE", + 300405: "TYPE_UID_ENTITY_MANAGEMENT_MOVE", + 300406: "TYPE_UID_ENTITY_MANAGEMENT_ENROLL", + 300407: "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL", + 300408: "TYPE_UID_ENTITY_MANAGEMENT_ENABLE", + 300409: "TYPE_UID_ENTITY_MANAGEMENT_DISABLE", + 300410: "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE", + 300411: "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE", + 300412: "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND", + 300413: "TYPE_UID_ENTITY_MANAGEMENT_RESUME", + 300499: "TYPE_UID_ENTITY_MANAGEMENT_OTHER", + 600300: "TYPE_UID_API_ACTIVITY_UNKNOWN", + 600301: "TYPE_UID_API_ACTIVITY_CREATE", + 600302: "TYPE_UID_API_ACTIVITY_READ", + 600303: "TYPE_UID_API_ACTIVITY_UPDATE", + 600304: "TYPE_UID_API_ACTIVITY_DELETE", + 600399: "TYPE_UID_API_ACTIVITY_OTHER", + } + AuditEvent_TypeUid_value = map[string]int32{ + "TYPE_UID_UNKNOWN": 0, + "TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN": 300400, + "TYPE_UID_ENTITY_MANAGEMENT_CREATE": 300401, + "TYPE_UID_ENTITY_MANAGEMENT_READ": 300402, + "TYPE_UID_ENTITY_MANAGEMENT_UPDATE": 300403, + "TYPE_UID_ENTITY_MANAGEMENT_DELETE": 300404, + "TYPE_UID_ENTITY_MANAGEMENT_MOVE": 300405, + "TYPE_UID_ENTITY_MANAGEMENT_ENROLL": 300406, + "TYPE_UID_ENTITY_MANAGEMENT_UNENROLL": 300407, + "TYPE_UID_ENTITY_MANAGEMENT_ENABLE": 300408, + "TYPE_UID_ENTITY_MANAGEMENT_DISABLE": 300409, + "TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE": 300410, + "TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE": 300411, + "TYPE_UID_ENTITY_MANAGEMENT_SUSPEND": 300412, + "TYPE_UID_ENTITY_MANAGEMENT_RESUME": 300413, + "TYPE_UID_ENTITY_MANAGEMENT_OTHER": 300499, + "TYPE_UID_API_ACTIVITY_UNKNOWN": 600300, + "TYPE_UID_API_ACTIVITY_CREATE": 600301, + "TYPE_UID_API_ACTIVITY_READ": 600302, + "TYPE_UID_API_ACTIVITY_UPDATE": 600303, + "TYPE_UID_API_ACTIVITY_DELETE": 600304, + "TYPE_UID_API_ACTIVITY_OTHER": 600399, + } +) + +func (x AuditEvent_TypeUid) Enum() *AuditEvent_TypeUid { + p := new(AuditEvent_TypeUid) + *p = x + return p +} + +func (x AuditEvent_TypeUid) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEvent_TypeUid) Descriptor() protoreflect.EnumDescriptor { + return file_ocsf_v1_audit_event_proto_enumTypes[8].Descriptor() +} + +func (AuditEvent_TypeUid) Type() protoreflect.EnumType { + return &file_ocsf_v1_audit_event_proto_enumTypes[8] +} + +func (x AuditEvent_TypeUid) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEvent_TypeUid.Descriptor instead. +func (AuditEvent_TypeUid) EnumDescriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0, 8} +} + +type AuditEvent struct { + state protoimpl.MessageState `protogen:"open.v1"` + AccessList []string `protobuf:"bytes,1,rep,name=access_list,json=accessList,proto3" json:"access_list,omitempty"` + AccessMask int32 `protobuf:"varint,2,opt,name=access_mask,json=accessMask,proto3" json:"access_mask,omitempty"` + Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` + ActionId AuditEvent_ActionId `protobuf:"varint,4,opt,name=action_id,json=actionId,proto3,enum=ocsf.v1.AuditEvent_ActionId" json:"action_id,omitempty"` + // Class-scoped enum: value semantics depend on class_uid; see TypeUid. + ActivityId int32 `protobuf:"varint,5,opt,name=activity_id,json=activityId,proto3" json:"activity_id,omitempty"` + ActivityName string `protobuf:"bytes,6,opt,name=activity_name,json=activityName,proto3" json:"activity_name,omitempty"` + Actor *Actor `protobuf:"bytes,7,opt,name=actor,proto3" json:"actor,omitempty"` + AiModel *AiModel `protobuf:"bytes,8,opt,name=ai_model,json=aiModel,proto3" json:"ai_model,omitempty"` + Api *Api `protobuf:"bytes,9,opt,name=api,proto3" json:"api,omitempty"` + Attacks []*Attack `protobuf:"bytes,10,rep,name=attacks,proto3" json:"attacks,omitempty"` + Authorizations []*Authorization `protobuf:"bytes,11,rep,name=authorizations,proto3" json:"authorizations,omitempty"` + CategoryName string `protobuf:"bytes,12,opt,name=category_name,json=categoryName,proto3" json:"category_name,omitempty"` + CategoryUid AuditEvent_CategoryUid `protobuf:"varint,13,opt,name=category_uid,json=categoryUid,proto3,enum=ocsf.v1.AuditEvent_CategoryUid" json:"category_uid,omitempty"` + ClassName string `protobuf:"bytes,14,opt,name=class_name,json=className,proto3" json:"class_name,omitempty"` + ClassUid AuditEvent_ClassUid `protobuf:"varint,15,opt,name=class_uid,json=classUid,proto3,enum=ocsf.v1.AuditEvent_ClassUid" json:"class_uid,omitempty"` + Cloud *Cloud `protobuf:"bytes,16,opt,name=cloud,proto3" json:"cloud,omitempty"` + Comment string `protobuf:"bytes,17,opt,name=comment,proto3" json:"comment,omitempty"` + Confidence string `protobuf:"bytes,18,opt,name=confidence,proto3" json:"confidence,omitempty"` + ConfidenceId AuditEvent_ConfidenceId `protobuf:"varint,19,opt,name=confidence_id,json=confidenceId,proto3,enum=ocsf.v1.AuditEvent_ConfidenceId" json:"confidence_id,omitempty"` + ConfidenceScore int32 `protobuf:"varint,20,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"` + Count int32 `protobuf:"varint,21,opt,name=count,proto3" json:"count,omitempty"` + Device *Device `protobuf:"bytes,22,opt,name=device,proto3" json:"device,omitempty"` + Disposition string `protobuf:"bytes,23,opt,name=disposition,proto3" json:"disposition,omitempty"` + DispositionId AuditEvent_DispositionId `protobuf:"varint,24,opt,name=disposition_id,json=dispositionId,proto3,enum=ocsf.v1.AuditEvent_DispositionId" json:"disposition_id,omitempty"` + DstEndpoint *NetworkEndpoint `protobuf:"bytes,25,opt,name=dst_endpoint,json=dstEndpoint,proto3" json:"dst_endpoint,omitempty"` + Duration int64 `protobuf:"varint,26,opt,name=duration,proto3" json:"duration,omitempty"` + EndTime int64 `protobuf:"varint,27,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"` + EndTimeDt string `protobuf:"bytes,28,opt,name=end_time_dt,json=endTimeDt,proto3" json:"end_time_dt,omitempty"` + Enrichments []*Enrichment `protobuf:"bytes,29,rep,name=enrichments,proto3" json:"enrichments,omitempty"` + Entity *ManagedEntity `protobuf:"bytes,30,opt,name=entity,proto3" json:"entity,omitempty"` + EntityResult *ManagedEntity `protobuf:"bytes,31,opt,name=entity_result,json=entityResult,proto3" json:"entity_result,omitempty"` + FirewallRule *FirewallRule `protobuf:"bytes,32,opt,name=firewall_rule,json=firewallRule,proto3" json:"firewall_rule,omitempty"` + HttpRequest *HttpRequest `protobuf:"bytes,33,opt,name=http_request,json=httpRequest,proto3" json:"http_request,omitempty"` + HttpResponse *HttpResponse `protobuf:"bytes,34,opt,name=http_response,json=httpResponse,proto3" json:"http_response,omitempty"` + IsAlert bool `protobuf:"varint,35,opt,name=is_alert,json=isAlert,proto3" json:"is_alert,omitempty"` + Malware []*Malware `protobuf:"bytes,36,rep,name=malware,proto3" json:"malware,omitempty"` + MalwareScanInfo *MalwareScanInfo `protobuf:"bytes,37,opt,name=malware_scan_info,json=malwareScanInfo,proto3" json:"malware_scan_info,omitempty"` + Message string `protobuf:"bytes,38,opt,name=message,proto3" json:"message,omitempty"` + MessageContext *MessageContext `protobuf:"bytes,39,opt,name=message_context,json=messageContext,proto3" json:"message_context,omitempty"` + Metadata *Metadata `protobuf:"bytes,40,opt,name=metadata,proto3" json:"metadata,omitempty"` + Observables []*Observable `protobuf:"bytes,41,rep,name=observables,proto3" json:"observables,omitempty"` + Osint []*Osint `protobuf:"bytes,42,rep,name=osint,proto3" json:"osint,omitempty"` + Policy *Policy `protobuf:"bytes,43,opt,name=policy,proto3" json:"policy,omitempty"` + RawData string `protobuf:"bytes,44,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"` + RawDataHash *Fingerprint `protobuf:"bytes,45,opt,name=raw_data_hash,json=rawDataHash,proto3" json:"raw_data_hash,omitempty"` + RawDataSize int64 `protobuf:"varint,46,opt,name=raw_data_size,json=rawDataSize,proto3" json:"raw_data_size,omitempty"` + Resources []*ResourceDetails `protobuf:"bytes,47,rep,name=resources,proto3" json:"resources,omitempty"` + RiskDetails string `protobuf:"bytes,48,opt,name=risk_details,json=riskDetails,proto3" json:"risk_details,omitempty"` + RiskLevel string `protobuf:"bytes,49,opt,name=risk_level,json=riskLevel,proto3" json:"risk_level,omitempty"` + RiskLevelId AuditEvent_RiskLevelId `protobuf:"varint,50,opt,name=risk_level_id,json=riskLevelId,proto3,enum=ocsf.v1.AuditEvent_RiskLevelId" json:"risk_level_id,omitempty"` + RiskScore int32 `protobuf:"varint,51,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"` + Severity string `protobuf:"bytes,52,opt,name=severity,proto3" json:"severity,omitempty"` + SeverityId AuditEvent_SeverityId `protobuf:"varint,53,opt,name=severity_id,json=severityId,proto3,enum=ocsf.v1.AuditEvent_SeverityId" json:"severity_id,omitempty"` + SrcEndpoint *NetworkEndpoint `protobuf:"bytes,54,opt,name=src_endpoint,json=srcEndpoint,proto3" json:"src_endpoint,omitempty"` + StartTime int64 `protobuf:"varint,55,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"` + StartTimeDt string `protobuf:"bytes,56,opt,name=start_time_dt,json=startTimeDt,proto3" json:"start_time_dt,omitempty"` + Status string `protobuf:"bytes,57,opt,name=status,proto3" json:"status,omitempty"` + StatusCode string `protobuf:"bytes,58,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"` + StatusDetail string `protobuf:"bytes,59,opt,name=status_detail,json=statusDetail,proto3" json:"status_detail,omitempty"` + StatusId AuditEvent_StatusId `protobuf:"varint,60,opt,name=status_id,json=statusId,proto3,enum=ocsf.v1.AuditEvent_StatusId" json:"status_id,omitempty"` + Time int64 `protobuf:"varint,61,opt,name=time,proto3" json:"time,omitempty"` + TimeDt string `protobuf:"bytes,62,opt,name=time_dt,json=timeDt,proto3" json:"time_dt,omitempty"` + TimezoneOffset int32 `protobuf:"varint,63,opt,name=timezone_offset,json=timezoneOffset,proto3" json:"timezone_offset,omitempty"` + Trace *Trace `protobuf:"bytes,64,opt,name=trace,proto3" json:"trace,omitempty"` + TypeName string `protobuf:"bytes,65,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"` + TypeUid AuditEvent_TypeUid `protobuf:"varint,66,opt,name=type_uid,json=typeUid,proto3,enum=ocsf.v1.AuditEvent_TypeUid" json:"type_uid,omitempty"` + Unmapped *structpb.Value `protobuf:"bytes,67,opt,name=unmapped,proto3" json:"unmapped,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AuditEvent) Reset() { + *x = AuditEvent{} + mi := &file_ocsf_v1_audit_event_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AuditEvent) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AuditEvent) ProtoMessage() {} + +func (x *AuditEvent) ProtoReflect() protoreflect.Message { + mi := &file_ocsf_v1_audit_event_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AuditEvent.ProtoReflect.Descriptor instead. +func (*AuditEvent) Descriptor() ([]byte, []int) { + return file_ocsf_v1_audit_event_proto_rawDescGZIP(), []int{0} +} + +func (x *AuditEvent) GetAccessList() []string { + if x != nil { + return x.AccessList + } + return nil +} + +func (x *AuditEvent) GetAccessMask() int32 { + if x != nil { + return x.AccessMask + } + return 0 +} + +func (x *AuditEvent) GetAction() string { + if x != nil { + return x.Action + } + return "" +} + +func (x *AuditEvent) GetActionId() AuditEvent_ActionId { + if x != nil { + return x.ActionId + } + return AuditEvent_ACTION_ID_UNKNOWN +} + +func (x *AuditEvent) GetActivityId() int32 { + if x != nil { + return x.ActivityId + } + return 0 +} + +func (x *AuditEvent) GetActivityName() string { + if x != nil { + return x.ActivityName + } + return "" +} + +func (x *AuditEvent) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *AuditEvent) GetAiModel() *AiModel { + if x != nil { + return x.AiModel + } + return nil +} + +func (x *AuditEvent) GetApi() *Api { + if x != nil { + return x.Api + } + return nil +} + +func (x *AuditEvent) GetAttacks() []*Attack { + if x != nil { + return x.Attacks + } + return nil +} + +func (x *AuditEvent) GetAuthorizations() []*Authorization { + if x != nil { + return x.Authorizations + } + return nil +} + +func (x *AuditEvent) GetCategoryName() string { + if x != nil { + return x.CategoryName + } + return "" +} + +func (x *AuditEvent) GetCategoryUid() AuditEvent_CategoryUid { + if x != nil { + return x.CategoryUid + } + return AuditEvent_CATEGORY_UID_UNKNOWN +} + +func (x *AuditEvent) GetClassName() string { + if x != nil { + return x.ClassName + } + return "" +} + +func (x *AuditEvent) GetClassUid() AuditEvent_ClassUid { + if x != nil { + return x.ClassUid + } + return AuditEvent_CLASS_UID_UNKNOWN +} + +func (x *AuditEvent) GetCloud() *Cloud { + if x != nil { + return x.Cloud + } + return nil +} + +func (x *AuditEvent) GetComment() string { + if x != nil { + return x.Comment + } + return "" +} + +func (x *AuditEvent) GetConfidence() string { + if x != nil { + return x.Confidence + } + return "" +} + +func (x *AuditEvent) GetConfidenceId() AuditEvent_ConfidenceId { + if x != nil { + return x.ConfidenceId + } + return AuditEvent_CONFIDENCE_ID_UNKNOWN +} + +func (x *AuditEvent) GetConfidenceScore() int32 { + if x != nil { + return x.ConfidenceScore + } + return 0 +} + +func (x *AuditEvent) GetCount() int32 { + if x != nil { + return x.Count + } + return 0 +} + +func (x *AuditEvent) GetDevice() *Device { + if x != nil { + return x.Device + } + return nil +} + +func (x *AuditEvent) GetDisposition() string { + if x != nil { + return x.Disposition + } + return "" +} + +func (x *AuditEvent) GetDispositionId() AuditEvent_DispositionId { + if x != nil { + return x.DispositionId + } + return AuditEvent_DISPOSITION_ID_UNKNOWN +} + +func (x *AuditEvent) GetDstEndpoint() *NetworkEndpoint { + if x != nil { + return x.DstEndpoint + } + return nil +} + +func (x *AuditEvent) GetDuration() int64 { + if x != nil { + return x.Duration + } + return 0 +} + +func (x *AuditEvent) GetEndTime() int64 { + if x != nil { + return x.EndTime + } + return 0 +} + +func (x *AuditEvent) GetEndTimeDt() string { + if x != nil { + return x.EndTimeDt + } + return "" +} + +func (x *AuditEvent) GetEnrichments() []*Enrichment { + if x != nil { + return x.Enrichments + } + return nil +} + +func (x *AuditEvent) GetEntity() *ManagedEntity { + if x != nil { + return x.Entity + } + return nil +} + +func (x *AuditEvent) GetEntityResult() *ManagedEntity { + if x != nil { + return x.EntityResult + } + return nil +} + +func (x *AuditEvent) GetFirewallRule() *FirewallRule { + if x != nil { + return x.FirewallRule + } + return nil +} + +func (x *AuditEvent) GetHttpRequest() *HttpRequest { + if x != nil { + return x.HttpRequest + } + return nil +} + +func (x *AuditEvent) GetHttpResponse() *HttpResponse { + if x != nil { + return x.HttpResponse + } + return nil +} + +func (x *AuditEvent) GetIsAlert() bool { + if x != nil { + return x.IsAlert + } + return false +} + +func (x *AuditEvent) GetMalware() []*Malware { + if x != nil { + return x.Malware + } + return nil +} + +func (x *AuditEvent) GetMalwareScanInfo() *MalwareScanInfo { + if x != nil { + return x.MalwareScanInfo + } + return nil +} + +func (x *AuditEvent) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +func (x *AuditEvent) GetMessageContext() *MessageContext { + if x != nil { + return x.MessageContext + } + return nil +} + +func (x *AuditEvent) GetMetadata() *Metadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *AuditEvent) GetObservables() []*Observable { + if x != nil { + return x.Observables + } + return nil +} + +func (x *AuditEvent) GetOsint() []*Osint { + if x != nil { + return x.Osint + } + return nil +} + +func (x *AuditEvent) GetPolicy() *Policy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *AuditEvent) GetRawData() string { + if x != nil { + return x.RawData + } + return "" +} + +func (x *AuditEvent) GetRawDataHash() *Fingerprint { + if x != nil { + return x.RawDataHash + } + return nil +} + +func (x *AuditEvent) GetRawDataSize() int64 { + if x != nil { + return x.RawDataSize + } + return 0 +} + +func (x *AuditEvent) GetResources() []*ResourceDetails { + if x != nil { + return x.Resources + } + return nil +} + +func (x *AuditEvent) GetRiskDetails() string { + if x != nil { + return x.RiskDetails + } + return "" +} + +func (x *AuditEvent) GetRiskLevel() string { + if x != nil { + return x.RiskLevel + } + return "" +} + +func (x *AuditEvent) GetRiskLevelId() AuditEvent_RiskLevelId { + if x != nil { + return x.RiskLevelId + } + return AuditEvent_RISK_LEVEL_ID_INFO +} + +func (x *AuditEvent) GetRiskScore() int32 { + if x != nil { + return x.RiskScore + } + return 0 +} + +func (x *AuditEvent) GetSeverity() string { + if x != nil { + return x.Severity + } + return "" +} + +func (x *AuditEvent) GetSeverityId() AuditEvent_SeverityId { + if x != nil { + return x.SeverityId + } + return AuditEvent_SEVERITY_ID_UNKNOWN +} + +func (x *AuditEvent) GetSrcEndpoint() *NetworkEndpoint { + if x != nil { + return x.SrcEndpoint + } + return nil +} + +func (x *AuditEvent) GetStartTime() int64 { + if x != nil { + return x.StartTime + } + return 0 +} + +func (x *AuditEvent) GetStartTimeDt() string { + if x != nil { + return x.StartTimeDt + } + return "" +} + +func (x *AuditEvent) GetStatus() string { + if x != nil { + return x.Status + } + return "" +} + +func (x *AuditEvent) GetStatusCode() string { + if x != nil { + return x.StatusCode + } + return "" +} + +func (x *AuditEvent) GetStatusDetail() string { + if x != nil { + return x.StatusDetail + } + return "" +} + +func (x *AuditEvent) GetStatusId() AuditEvent_StatusId { + if x != nil { + return x.StatusId + } + return AuditEvent_STATUS_ID_UNKNOWN +} + +func (x *AuditEvent) GetTime() int64 { + if x != nil { + return x.Time + } + return 0 +} + +func (x *AuditEvent) GetTimeDt() string { + if x != nil { + return x.TimeDt + } + return "" +} + +func (x *AuditEvent) GetTimezoneOffset() int32 { + if x != nil { + return x.TimezoneOffset + } + return 0 +} + +func (x *AuditEvent) GetTrace() *Trace { + if x != nil { + return x.Trace + } + return nil +} + +func (x *AuditEvent) GetTypeName() string { + if x != nil { + return x.TypeName + } + return "" +} + +func (x *AuditEvent) GetTypeUid() AuditEvent_TypeUid { + if x != nil { + return x.TypeUid + } + return AuditEvent_TYPE_UID_UNKNOWN +} + +func (x *AuditEvent) GetUnmapped() *structpb.Value { + if x != nil { + return x.Unmapped + } + return nil +} + +var File_ocsf_v1_audit_event_proto protoreflect.FileDescriptor + +const file_ocsf_v1_audit_event_proto_rawDesc = "" + + "\n" + + "\x19ocsf/v1/audit_event.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x15ocsf/v1/objects.proto\"\xe1;\n" + + "\n" + + "AuditEvent\x12\x1f\n" + + "\vaccess_list\x18\x01 \x03(\tR\n" + + "accessList\x12\x1f\n" + + "\vaccess_mask\x18\x02 \x01(\x05R\n" + + "accessMask\x12\x16\n" + + "\x06action\x18\x03 \x01(\tR\x06action\x129\n" + + "\taction_id\x18\x04 \x01(\x0e2\x1c.ocsf.v1.AuditEvent.ActionIdR\bactionId\x12'\n" + + "\vactivity_id\x18\x05 \x01(\x05B\x06\xbaH\x03\xc8\x01\x01R\n" + + "activityId\x12#\n" + + "\ractivity_name\x18\x06 \x01(\tR\factivityName\x12$\n" + + "\x05actor\x18\a \x01(\v2\x0e.ocsf.v1.ActorR\x05actor\x12+\n" + + "\bai_model\x18\b \x01(\v2\x10.ocsf.v1.AiModelR\aaiModel\x12\x1e\n" + + "\x03api\x18\t \x01(\v2\f.ocsf.v1.ApiR\x03api\x12)\n" + + "\aattacks\x18\n" + + " \x03(\v2\x0f.ocsf.v1.AttackR\aattacks\x12>\n" + + "\x0eauthorizations\x18\v \x03(\v2\x16.ocsf.v1.AuthorizationR\x0eauthorizations\x12#\n" + + "\rcategory_name\x18\f \x01(\tR\fcategoryName\x12J\n" + + "\fcategory_uid\x18\r \x01(\x0e2\x1f.ocsf.v1.AuditEvent.CategoryUidB\x06\xbaH\x03\xc8\x01\x01R\vcategoryUid\x12\x1d\n" + + "\n" + + "class_name\x18\x0e \x01(\tR\tclassName\x12A\n" + + "\tclass_uid\x18\x0f \x01(\x0e2\x1c.ocsf.v1.AuditEvent.ClassUidB\x06\xbaH\x03\xc8\x01\x01R\bclassUid\x12,\n" + + "\x05cloud\x18\x10 \x01(\v2\x0e.ocsf.v1.CloudB\x06\xbaH\x03\xc8\x01\x01R\x05cloud\x12\x18\n" + + "\acomment\x18\x11 \x01(\tR\acomment\x12\x1e\n" + + "\n" + + "confidence\x18\x12 \x01(\tR\n" + + "confidence\x12E\n" + + "\rconfidence_id\x18\x13 \x01(\x0e2 .ocsf.v1.AuditEvent.ConfidenceIdR\fconfidenceId\x12)\n" + + "\x10confidence_score\x18\x14 \x01(\x05R\x0fconfidenceScore\x12\x14\n" + + "\x05count\x18\x15 \x01(\x05R\x05count\x12'\n" + + "\x06device\x18\x16 \x01(\v2\x0f.ocsf.v1.DeviceR\x06device\x12 \n" + + "\vdisposition\x18\x17 \x01(\tR\vdisposition\x12H\n" + + "\x0edisposition_id\x18\x18 \x01(\x0e2!.ocsf.v1.AuditEvent.DispositionIdR\rdispositionId\x12;\n" + + "\fdst_endpoint\x18\x19 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vdstEndpoint\x12\x1a\n" + + "\bduration\x18\x1a \x01(\x03R\bduration\x12\x19\n" + + "\bend_time\x18\x1b \x01(\x03R\aendTime\x12\x1e\n" + + "\vend_time_dt\x18\x1c \x01(\tR\tendTimeDt\x125\n" + + "\venrichments\x18\x1d \x03(\v2\x13.ocsf.v1.EnrichmentR\venrichments\x12.\n" + + "\x06entity\x18\x1e \x01(\v2\x16.ocsf.v1.ManagedEntityR\x06entity\x12;\n" + + "\rentity_result\x18\x1f \x01(\v2\x16.ocsf.v1.ManagedEntityR\fentityResult\x12:\n" + + "\rfirewall_rule\x18 \x01(\v2\x15.ocsf.v1.FirewallRuleR\ffirewallRule\x127\n" + + "\fhttp_request\x18! \x01(\v2\x14.ocsf.v1.HttpRequestR\vhttpRequest\x12:\n" + + "\rhttp_response\x18\" \x01(\v2\x15.ocsf.v1.HttpResponseR\fhttpResponse\x12\x19\n" + + "\bis_alert\x18# \x01(\bR\aisAlert\x12*\n" + + "\amalware\x18$ \x03(\v2\x10.ocsf.v1.MalwareR\amalware\x12D\n" + + "\x11malware_scan_info\x18% \x01(\v2\x18.ocsf.v1.MalwareScanInfoR\x0fmalwareScanInfo\x12\x18\n" + + "\amessage\x18& \x01(\tR\amessage\x12@\n" + + "\x0fmessage_context\x18' \x01(\v2\x17.ocsf.v1.MessageContextR\x0emessageContext\x125\n" + + "\bmetadata\x18( \x01(\v2\x11.ocsf.v1.MetadataB\x06\xbaH\x03\xc8\x01\x01R\bmetadata\x125\n" + + "\vobservables\x18) \x03(\v2\x13.ocsf.v1.ObservableR\vobservables\x12$\n" + + "\x05osint\x18* \x03(\v2\x0e.ocsf.v1.OsintR\x05osint\x12'\n" + + "\x06policy\x18+ \x01(\v2\x0f.ocsf.v1.PolicyR\x06policy\x12\x19\n" + + "\braw_data\x18, \x01(\tR\arawData\x128\n" + + "\rraw_data_hash\x18- \x01(\v2\x14.ocsf.v1.FingerprintR\vrawDataHash\x12\"\n" + + "\rraw_data_size\x18. \x01(\x03R\vrawDataSize\x126\n" + + "\tresources\x18/ \x03(\v2\x18.ocsf.v1.ResourceDetailsR\tresources\x12!\n" + + "\frisk_details\x180 \x01(\tR\vriskDetails\x12\x1d\n" + + "\n" + + "risk_level\x181 \x01(\tR\triskLevel\x12C\n" + + "\rrisk_level_id\x182 \x01(\x0e2\x1f.ocsf.v1.AuditEvent.RiskLevelIdR\vriskLevelId\x12\x1d\n" + + "\n" + + "risk_score\x183 \x01(\x05R\triskScore\x12\x1a\n" + + "\bseverity\x184 \x01(\tR\bseverity\x12G\n" + + "\vseverity_id\x185 \x01(\x0e2\x1e.ocsf.v1.AuditEvent.SeverityIdB\x06\xbaH\x03\xc8\x01\x01R\n" + + "severityId\x12;\n" + + "\fsrc_endpoint\x186 \x01(\v2\x18.ocsf.v1.NetworkEndpointR\vsrcEndpoint\x12\x1d\n" + + "\n" + + "start_time\x187 \x01(\x03R\tstartTime\x12\"\n" + + "\rstart_time_dt\x188 \x01(\tR\vstartTimeDt\x12\x16\n" + + "\x06status\x189 \x01(\tR\x06status\x12\x1f\n" + + "\vstatus_code\x18: \x01(\tR\n" + + "statusCode\x12#\n" + + "\rstatus_detail\x18; \x01(\tR\fstatusDetail\x129\n" + + "\tstatus_id\x18< \x01(\x0e2\x1c.ocsf.v1.AuditEvent.StatusIdR\bstatusId\x12\x1a\n" + + "\x04time\x18= \x01(\x03B\x06\xbaH\x03\xc8\x01\x01R\x04time\x12\x17\n" + + "\atime_dt\x18> \x01(\tR\x06timeDt\x12'\n" + + "\x0ftimezone_offset\x18? \x01(\x05R\x0etimezoneOffset\x12$\n" + + "\x05trace\x18@ \x01(\v2\x0e.ocsf.v1.TraceR\x05trace\x12\x1b\n" + + "\ttype_name\x18A \x01(\tR\btypeName\x12>\n" + + "\btype_uid\x18B \x01(\x0e2\x1b.ocsf.v1.AuditEvent.TypeUidB\x06\xbaH\x03\xc8\x01\x01R\atypeUid\x122\n" + + "\bunmapped\x18C \x01(\v2\x16.google.protobuf.ValueR\bunmapped\"\x93\x01\n" + + "\bActionId\x12\x15\n" + + "\x11ACTION_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11ACTION_ID_ALLOWED\x10\x01\x12\x14\n" + + "\x10ACTION_ID_DENIED\x10\x02\x12\x16\n" + + "\x12ACTION_ID_OBSERVED\x10\x03\x12\x16\n" + + "\x12ACTION_ID_MODIFIED\x10\x04\x12\x13\n" + + "\x0fACTION_ID_OTHER\x10c\"{\n" + + "\vCategoryUid\x12\x18\n" + + "\x14CATEGORY_UID_UNKNOWN\x10\x00\x12+\n" + + "'CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT\x10\x03\x12%\n" + + "!CATEGORY_UID_APPLICATION_ACTIVITY\x10\x06\"`\n" + + "\bClassUid\x12\x15\n" + + "\x11CLASS_UID_UNKNOWN\x10\x00\x12 \n" + + "\x1bCLASS_UID_ENTITY_MANAGEMENT\x10\xbc\x17\x12\x1b\n" + + "\x16CLASS_UID_API_ACTIVITY\x10\xf3.\"\x8b\x01\n" + + "\fConfidenceId\x12\x19\n" + + "\x15CONFIDENCE_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11CONFIDENCE_ID_LOW\x10\x01\x12\x18\n" + + "\x14CONFIDENCE_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12CONFIDENCE_ID_HIGH\x10\x03\x12\x17\n" + + "\x13CONFIDENCE_ID_OTHER\x10c\"\xe3\x06\n" + + "\rDispositionId\x12\x1a\n" + + "\x16DISPOSITION_ID_UNKNOWN\x10\x00\x12\x1a\n" + + "\x16DISPOSITION_ID_ALLOWED\x10\x01\x12\x1a\n" + + "\x16DISPOSITION_ID_BLOCKED\x10\x02\x12\x1e\n" + + "\x1aDISPOSITION_ID_QUARANTINED\x10\x03\x12\x1b\n" + + "\x17DISPOSITION_ID_ISOLATED\x10\x04\x12\x1a\n" + + "\x16DISPOSITION_ID_DELETED\x10\x05\x12\x1a\n" + + "\x16DISPOSITION_ID_DROPPED\x10\x06\x12 \n" + + "\x1cDISPOSITION_ID_CUSTOM_ACTION\x10\a\x12\x1b\n" + + "\x17DISPOSITION_ID_APPROVED\x10\b\x12\x1b\n" + + "\x17DISPOSITION_ID_RESTORED\x10\t\x12\x1d\n" + + "\x19DISPOSITION_ID_EXONERATED\x10\n" + + "\x12\x1c\n" + + "\x18DISPOSITION_ID_CORRECTED\x10\v\x12&\n" + + "\"DISPOSITION_ID_PARTIALLY_CORRECTED\x10\f\x12\x1e\n" + + "\x1aDISPOSITION_ID_UNCORRECTED\x10\r\x12\x1a\n" + + "\x16DISPOSITION_ID_DELAYED\x10\x0e\x12\x1b\n" + + "\x17DISPOSITION_ID_DETECTED\x10\x0f\x12\x1c\n" + + "\x18DISPOSITION_ID_NO_ACTION\x10\x10\x12\x19\n" + + "\x15DISPOSITION_ID_LOGGED\x10\x11\x12\x19\n" + + "\x15DISPOSITION_ID_TAGGED\x10\x12\x12\x18\n" + + "\x14DISPOSITION_ID_ALERT\x10\x13\x12\x18\n" + + "\x14DISPOSITION_ID_COUNT\x10\x14\x12\x18\n" + + "\x14DISPOSITION_ID_RESET\x10\x15\x12\x1a\n" + + "\x16DISPOSITION_ID_CAPTCHA\x10\x16\x12\x1c\n" + + "\x18DISPOSITION_ID_CHALLENGE\x10\x17\x12!\n" + + "\x1dDISPOSITION_ID_ACCESS_REVOKED\x10\x18\x12\x1b\n" + + "\x17DISPOSITION_ID_REJECTED\x10\x19\x12\x1f\n" + + "\x1bDISPOSITION_ID_UNAUTHORIZED\x10\x1a\x12\x18\n" + + "\x14DISPOSITION_ID_ERROR\x10\x1b\x12\x18\n" + + "\x14DISPOSITION_ID_OTHER\x10c\"\xa3\x01\n" + + "\vRiskLevelId\x12\x16\n" + + "\x12RISK_LEVEL_ID_INFO\x10\x00\x12\x15\n" + + "\x11RISK_LEVEL_ID_LOW\x10\x01\x12\x18\n" + + "\x14RISK_LEVEL_ID_MEDIUM\x10\x02\x12\x16\n" + + "\x12RISK_LEVEL_ID_HIGH\x10\x03\x12\x1a\n" + + "\x16RISK_LEVEL_ID_CRITICAL\x10\x04\x12\x17\n" + + "\x13RISK_LEVEL_ID_OTHER\x10c\"\xcf\x01\n" + + "\n" + + "SeverityId\x12\x17\n" + + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x1d\n" + + "\x19SEVERITY_ID_INFORMATIONAL\x10\x01\x12\x13\n" + + "\x0fSEVERITY_ID_LOW\x10\x02\x12\x16\n" + + "\x12SEVERITY_ID_MEDIUM\x10\x03\x12\x14\n" + + "\x10SEVERITY_ID_HIGH\x10\x04\x12\x18\n" + + "\x14SEVERITY_ID_CRITICAL\x10\x05\x12\x15\n" + + "\x11SEVERITY_ID_FATAL\x10\x06\x12\x15\n" + + "\x11SEVERITY_ID_OTHER\x10c\"d\n" + + "\bStatusId\x12\x15\n" + + "\x11STATUS_ID_UNKNOWN\x10\x00\x12\x15\n" + + "\x11STATUS_ID_SUCCESS\x10\x01\x12\x15\n" + + "\x11STATUS_ID_FAILURE\x10\x02\x12\x13\n" + + "\x0fSTATUS_ID_OTHER\x10c\"\xe2\x06\n" + + "\aTypeUid\x12\x14\n" + + "\x10TYPE_UID_UNKNOWN\x10\x00\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_UNKNOWN\x10\xf0\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_CREATE\x10\xf1\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_READ\x10\xf2\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_UPDATE\x10\xf3\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_DELETE\x10\xf4\xaa\x12\x12%\n" + + "\x1fTYPE_UID_ENTITY_MANAGEMENT_MOVE\x10\xf5\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENROLL\x10\xf6\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_UNENROLL\x10\xf7\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_ENABLE\x10\xf8\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_DISABLE\x10\xf9\xaa\x12\x12)\n" + + "#TYPE_UID_ENTITY_MANAGEMENT_ACTIVATE\x10\xfa\xaa\x12\x12+\n" + + "%TYPE_UID_ENTITY_MANAGEMENT_DEACTIVATE\x10\xfb\xaa\x12\x12(\n" + + "\"TYPE_UID_ENTITY_MANAGEMENT_SUSPEND\x10\xfc\xaa\x12\x12'\n" + + "!TYPE_UID_ENTITY_MANAGEMENT_RESUME\x10\xfd\xaa\x12\x12&\n" + + " TYPE_UID_ENTITY_MANAGEMENT_OTHER\x10ӫ\x12\x12#\n" + + "\x1dTYPE_UID_API_ACTIVITY_UNKNOWN\x10\xec\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_CREATE\x10\xed\xd1$\x12 \n" + + "\x1aTYPE_UID_API_ACTIVITY_READ\x10\xee\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_UPDATE\x10\xef\xd1$\x12\"\n" + + "\x1cTYPE_UID_API_ACTIVITY_DELETE\x10\xf0\xd1$\x12!\n" + + "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$:\x94\x0f\xbaH\x90\x0f\x1a\x82\x01\n" + + "\x13AuditEvent.type_uid\x121type_uid must equal class_uid * 100 + activity_id\x1a8this.type_uid == this.class_uid * 100 + this.activity_id\x1a|\n" + + "\x1aAuditEvent.own.access_list\x12,access_list is only valid for class_uid 3004\x1a0!has(this.access_list) || this.class_uid == 3004\x1a|\n" + + "\x1aAuditEvent.own.access_mask\x12,access_mask is only valid for class_uid 3004\x1a0!has(this.access_mask) || this.class_uid == 3004\x1as\n" + + "\x17AuditEvent.own.ai_model\x12)ai_model is only valid for class_uid 6003\x1a-!has(this.ai_model) || this.class_uid == 6003\x1ap\n" + + "\x16AuditEvent.own.comment\x12(comment is only valid for class_uid 3004\x1a,!has(this.comment) || this.class_uid == 3004\x1a\x7f\n" + + "\x1bAuditEvent.own.dst_endpoint\x12-dst_endpoint is only valid for class_uid 6003\x1a1!has(this.dst_endpoint) || this.class_uid == 6003\x1am\n" + + "\x15AuditEvent.own.entity\x12'entity is only valid for class_uid 3004\x1a+!has(this.entity) || this.class_uid == 3004\x1a\x82\x01\n" + + "\x1cAuditEvent.own.entity_result\x12.entity_result is only valid for class_uid 3004\x1a2!has(this.entity_result) || this.class_uid == 3004\x1a\x88\x01\n" + + "\x1eAuditEvent.own.message_context\x120message_context is only valid for class_uid 6003\x1a4!has(this.message_context) || this.class_uid == 6003\x1av\n" + + "\x18AuditEvent.own.resources\x12*resources is only valid for class_uid 6003\x1a.!has(this.resources) || this.class_uid == 6003\x1aj\n" + + "\x14AuditEvent.own.trace\x12&trace is only valid for class_uid 6003\x1a*!has(this.trace) || this.class_uid == 6003\x1a\x87\x01\n" + + "!AuditEvent.req.api_activity.actor\x127actor is required when class_uid == 6003 (api_activity)\x1a)this.class_uid != 6003 || has(this.actor)\x1a\x81\x01\n" + + "\x1fAuditEvent.req.api_activity.api\x125api is required when class_uid == 6003 (api_activity)\x1a'this.class_uid != 6003 || has(this.api)\x1a\x9c\x01\n" + + "(AuditEvent.req.api_activity.src_endpoint\x12>src_endpoint is required when class_uid == 6003 (api_activity)\x1a0this.class_uid != 6003 || has(this.src_endpoint)\x1a\x94\x01\n" + + "'AuditEvent.req.entity_management.entity\x12=entity is required when class_uid == 3004 (entity_management)\x1a*this.class_uid != 3004 || has(this.entity)b\x06proto3" + +var ( + file_ocsf_v1_audit_event_proto_rawDescOnce sync.Once + file_ocsf_v1_audit_event_proto_rawDescData []byte +) + +func file_ocsf_v1_audit_event_proto_rawDescGZIP() []byte { + file_ocsf_v1_audit_event_proto_rawDescOnce.Do(func() { + file_ocsf_v1_audit_event_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_ocsf_v1_audit_event_proto_rawDesc), len(file_ocsf_v1_audit_event_proto_rawDesc))) + }) + return file_ocsf_v1_audit_event_proto_rawDescData +} + +var file_ocsf_v1_audit_event_proto_enumTypes = make([]protoimpl.EnumInfo, 9) +var file_ocsf_v1_audit_event_proto_msgTypes = make([]protoimpl.MessageInfo, 1) +var file_ocsf_v1_audit_event_proto_goTypes = []any{ + (AuditEvent_ActionId)(0), // 0: ocsf.v1.AuditEvent.ActionId + (AuditEvent_CategoryUid)(0), // 1: ocsf.v1.AuditEvent.CategoryUid + (AuditEvent_ClassUid)(0), // 2: ocsf.v1.AuditEvent.ClassUid + (AuditEvent_ConfidenceId)(0), // 3: ocsf.v1.AuditEvent.ConfidenceId + (AuditEvent_DispositionId)(0), // 4: ocsf.v1.AuditEvent.DispositionId + (AuditEvent_RiskLevelId)(0), // 5: ocsf.v1.AuditEvent.RiskLevelId + (AuditEvent_SeverityId)(0), // 6: ocsf.v1.AuditEvent.SeverityId + (AuditEvent_StatusId)(0), // 7: ocsf.v1.AuditEvent.StatusId + (AuditEvent_TypeUid)(0), // 8: ocsf.v1.AuditEvent.TypeUid + (*AuditEvent)(nil), // 9: ocsf.v1.AuditEvent + (*Actor)(nil), // 10: ocsf.v1.Actor + (*AiModel)(nil), // 11: ocsf.v1.AiModel + (*Api)(nil), // 12: ocsf.v1.Api + (*Attack)(nil), // 13: ocsf.v1.Attack + (*Authorization)(nil), // 14: ocsf.v1.Authorization + (*Cloud)(nil), // 15: ocsf.v1.Cloud + (*Device)(nil), // 16: ocsf.v1.Device + (*NetworkEndpoint)(nil), // 17: ocsf.v1.NetworkEndpoint + (*Enrichment)(nil), // 18: ocsf.v1.Enrichment + (*ManagedEntity)(nil), // 19: ocsf.v1.ManagedEntity + (*FirewallRule)(nil), // 20: ocsf.v1.FirewallRule + (*HttpRequest)(nil), // 21: ocsf.v1.HttpRequest + (*HttpResponse)(nil), // 22: ocsf.v1.HttpResponse + (*Malware)(nil), // 23: ocsf.v1.Malware + (*MalwareScanInfo)(nil), // 24: ocsf.v1.MalwareScanInfo + (*MessageContext)(nil), // 25: ocsf.v1.MessageContext + (*Metadata)(nil), // 26: ocsf.v1.Metadata + (*Observable)(nil), // 27: ocsf.v1.Observable + (*Osint)(nil), // 28: ocsf.v1.Osint + (*Policy)(nil), // 29: ocsf.v1.Policy + (*Fingerprint)(nil), // 30: ocsf.v1.Fingerprint + (*ResourceDetails)(nil), // 31: ocsf.v1.ResourceDetails + (*Trace)(nil), // 32: ocsf.v1.Trace + (*structpb.Value)(nil), // 33: google.protobuf.Value +} +var file_ocsf_v1_audit_event_proto_depIdxs = []int32{ + 0, // 0: ocsf.v1.AuditEvent.action_id:type_name -> ocsf.v1.AuditEvent.ActionId + 10, // 1: ocsf.v1.AuditEvent.actor:type_name -> ocsf.v1.Actor + 11, // 2: ocsf.v1.AuditEvent.ai_model:type_name -> ocsf.v1.AiModel + 12, // 3: ocsf.v1.AuditEvent.api:type_name -> ocsf.v1.Api + 13, // 4: ocsf.v1.AuditEvent.attacks:type_name -> ocsf.v1.Attack + 14, // 5: ocsf.v1.AuditEvent.authorizations:type_name -> ocsf.v1.Authorization + 1, // 6: ocsf.v1.AuditEvent.category_uid:type_name -> ocsf.v1.AuditEvent.CategoryUid + 2, // 7: ocsf.v1.AuditEvent.class_uid:type_name -> ocsf.v1.AuditEvent.ClassUid + 15, // 8: ocsf.v1.AuditEvent.cloud:type_name -> ocsf.v1.Cloud + 3, // 9: ocsf.v1.AuditEvent.confidence_id:type_name -> ocsf.v1.AuditEvent.ConfidenceId + 16, // 10: ocsf.v1.AuditEvent.device:type_name -> ocsf.v1.Device + 4, // 11: ocsf.v1.AuditEvent.disposition_id:type_name -> ocsf.v1.AuditEvent.DispositionId + 17, // 12: ocsf.v1.AuditEvent.dst_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 18, // 13: ocsf.v1.AuditEvent.enrichments:type_name -> ocsf.v1.Enrichment + 19, // 14: ocsf.v1.AuditEvent.entity:type_name -> ocsf.v1.ManagedEntity + 19, // 15: ocsf.v1.AuditEvent.entity_result:type_name -> ocsf.v1.ManagedEntity + 20, // 16: ocsf.v1.AuditEvent.firewall_rule:type_name -> ocsf.v1.FirewallRule + 21, // 17: ocsf.v1.AuditEvent.http_request:type_name -> ocsf.v1.HttpRequest + 22, // 18: ocsf.v1.AuditEvent.http_response:type_name -> ocsf.v1.HttpResponse + 23, // 19: ocsf.v1.AuditEvent.malware:type_name -> ocsf.v1.Malware + 24, // 20: ocsf.v1.AuditEvent.malware_scan_info:type_name -> ocsf.v1.MalwareScanInfo + 25, // 21: ocsf.v1.AuditEvent.message_context:type_name -> ocsf.v1.MessageContext + 26, // 22: ocsf.v1.AuditEvent.metadata:type_name -> ocsf.v1.Metadata + 27, // 23: ocsf.v1.AuditEvent.observables:type_name -> ocsf.v1.Observable + 28, // 24: ocsf.v1.AuditEvent.osint:type_name -> ocsf.v1.Osint + 29, // 25: ocsf.v1.AuditEvent.policy:type_name -> ocsf.v1.Policy + 30, // 26: ocsf.v1.AuditEvent.raw_data_hash:type_name -> ocsf.v1.Fingerprint + 31, // 27: ocsf.v1.AuditEvent.resources:type_name -> ocsf.v1.ResourceDetails + 5, // 28: ocsf.v1.AuditEvent.risk_level_id:type_name -> ocsf.v1.AuditEvent.RiskLevelId + 6, // 29: ocsf.v1.AuditEvent.severity_id:type_name -> ocsf.v1.AuditEvent.SeverityId + 17, // 30: ocsf.v1.AuditEvent.src_endpoint:type_name -> ocsf.v1.NetworkEndpoint + 7, // 31: ocsf.v1.AuditEvent.status_id:type_name -> ocsf.v1.AuditEvent.StatusId + 32, // 32: ocsf.v1.AuditEvent.trace:type_name -> ocsf.v1.Trace + 8, // 33: ocsf.v1.AuditEvent.type_uid:type_name -> ocsf.v1.AuditEvent.TypeUid + 33, // 34: ocsf.v1.AuditEvent.unmapped:type_name -> google.protobuf.Value + 35, // [35:35] is the sub-list for method output_type + 35, // [35:35] is the sub-list for method input_type + 35, // [35:35] is the sub-list for extension type_name + 35, // [35:35] is the sub-list for extension extendee + 0, // [0:35] is the sub-list for field type_name +} + +func init() { file_ocsf_v1_audit_event_proto_init() } +func file_ocsf_v1_audit_event_proto_init() { + if File_ocsf_v1_audit_event_proto != nil { + return + } + file_ocsf_v1_objects_proto_init() + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_ocsf_v1_audit_event_proto_rawDesc), len(file_ocsf_v1_audit_event_proto_rawDesc)), + NumEnums: 9, + NumMessages: 1, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_ocsf_v1_audit_event_proto_goTypes, + DependencyIndexes: file_ocsf_v1_audit_event_proto_depIdxs, + EnumInfos: file_ocsf_v1_audit_event_proto_enumTypes, + MessageInfos: file_ocsf_v1_audit_event_proto_msgTypes, + }.Build() + File_ocsf_v1_audit_event_proto = out.File + file_ocsf_v1_audit_event_proto_goTypes = nil + file_ocsf_v1_audit_event_proto_depIdxs = nil +} diff --git a/ocsf/internal/ocsf/conformance/merged_test.go b/ocsf/internal/ocsf/conformance/merged_test.go new file mode 100644 index 0000000..c9e6372 --- /dev/null +++ b/ocsf/internal/ocsf/conformance/merged_test.go @@ -0,0 +1,302 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Merged-event (AuditEvent) conformance: the single flat message that unions +// api_activity + entity_management for a one-topic audit log. +// +// The tests prove four properties: +// +// 1. Wire round-trip on the generated AuditEvent bindings. +// 2. JSON equivalence: an AuditEvent exports to OCSF JSON that is deeply +// equal to the same event built on the per-class message, so a single +// topic loses nothing relative to per-class topics. +// 3. JSON round-trip in both directions (proto → JSON → proto lossless, +// JSON → proto → JSON byte-identical). +// 4. protovalidate enforces the class-aware CEL rules: type_uid consistency, +// class-field ownership, and per-class conditional requiredness. +package conformance_test + +import ( + "encoding/json" + "testing" + + protovalidate "buf.build/go/protovalidate" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" +) + +// buildMergedApiActivityAllowed mirrors buildApiActivityAllowed on the merged +// AuditEvent message. Field values are identical; only the Go type differs. +func buildMergedApiActivityAllowed() *ocsfv1.AuditEvent { + return &ocsfv1.AuditEvent{ + ClassUid: ocsfv1.AuditEvent_CLASS_UID_API_ACTIVITY, // 6003 + CategoryUid: ocsfv1.AuditEvent_CATEGORY_UID_APPLICATION_ACTIVITY, + TypeUid: ocsfv1.AuditEvent_TYPE_UID_API_ACTIVITY_READ, + ActivityId: 2, // Read — plain int32 on the merged message (class-scoped enum) + SeverityId: ocsfv1.AuditEvent_SEVERITY_ID_INFORMATIONAL, + Time: 1751313600000, + + Actor: &ocsfv1.Actor{ + User: &ocsfv1.User{ + Uid: "user:alice@example.com", + Name: "alice", + }, + }, + Api: &ocsfv1.Api{ + Operation: "DescribeTopics", + Service: &ocsfv1.Service{ + Name: "redpanda-cloud", + }, + }, + Cloud: &ocsfv1.Cloud{ + Provider: "AWS", + Region: "us-east-1", + }, + Metadata: &ocsfv1.Metadata{ + Version: "1.8.0", + Product: &ocsfv1.Product{ + Name: "Redpanda Cloud", + VendorName: "Redpanda Data", + }, + Profiles: []string{"cloud", "security_control"}, + }, + SrcEndpoint: &ocsfv1.NetworkEndpoint{ + Ip: "10.0.1.42", + }, + DispositionId: ocsfv1.AuditEvent_DISPOSITION_ID_ALLOWED, + StatusId: ocsfv1.AuditEvent_STATUS_ID_SUCCESS, + Authorizations: []*ocsfv1.Authorization{ + { + Decision: "Permit", + Policy: &ocsfv1.Policy{ + Uid: "policy:cluster-readonly-v1", + Name: "ClusterReadOnly", + }, + }, + }, + Resources: []*ocsfv1.ResourceDetails{ + { + Uid: "rn:redpanda:cluster:prod-cluster-1", + Name: "prod-cluster-1", + Type: "cluster", + }, + }, + Message: "DescribeTopics authorised for alice", + } +} + +// buildMergedEntityManagement mirrors buildEntityManagement on AuditEvent. +func buildMergedEntityManagement() *ocsfv1.AuditEvent { + return &ocsfv1.AuditEvent{ + ClassUid: ocsfv1.AuditEvent_CLASS_UID_ENTITY_MANAGEMENT, // 3004 + CategoryUid: ocsfv1.AuditEvent_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT, + TypeUid: ocsfv1.AuditEvent_TYPE_UID_ENTITY_MANAGEMENT_CREATE, + ActivityId: 1, // Create + SeverityId: ocsfv1.AuditEvent_SEVERITY_ID_INFORMATIONAL, + Time: 1751313600000, + + Entity: &ocsfv1.ManagedEntity{ + TypeId: ocsfv1.ManagedEntity_TYPE_ID_POLICY, + Type: "policy", + Name: "cluster-readonly-v1", + Uid: "policy:cluster-readonly-v1", + Policy: &ocsfv1.Policy{ + Uid: "policy:cluster-readonly-v1", + Name: "ClusterReadOnly", + }, + }, + Cloud: &ocsfv1.Cloud{ + Provider: "AWS", + Region: "us-east-1", + }, + Metadata: &ocsfv1.Metadata{ + Version: "1.8.0", + Product: &ocsfv1.Product{ + Name: "Redpanda Cloud", + VendorName: "Redpanda Data", + }, + Profiles: []string{"cloud"}, + }, + Actor: &ocsfv1.Actor{ + User: &ocsfv1.User{ + Uid: "user:admin@example.com", + Name: "admin", + }, + }, + Message: "Policy cluster-readonly-v1 created", + } +} + +// TestMergedProtoRoundTrip proves wire round-trip on the AuditEvent bindings. +func TestMergedProtoRoundTrip(t *testing.T) { + t.Run("ApiActivity", func(t *testing.T) { + roundtrip(t, buildMergedApiActivityAllowed(), &ocsfv1.AuditEvent{}) + }) + t.Run("EntityManagement", func(t *testing.T) { + roundtrip(t, buildMergedEntityManagement(), &ocsfv1.AuditEvent{}) + }) +} + +// TestMergedJSONEquivalence proves the central single-topic property: the +// merged AuditEvent exports OCSF JSON deeply equal to the per-class message +// carrying the same event. (Byte order differs — field numbers differ between +// the two layouts and the exporter emits in tag order — but the parsed +// objects are identical, and OCSF JSON is the interchange format.) +func TestMergedJSONEquivalence(t *testing.T) { + cases := []struct { + name string + merged proto.Message + perClass proto.Message + }{ + {"ApiActivity", buildMergedApiActivityAllowed(), buildApiActivityAllowed()}, + {"EntityManagement", buildMergedEntityManagement(), buildEntityManagement()}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + mergedJSON, err := exporter.ToOCSFJSON(tc.merged) + require.NoError(t, err) + perClassJSON, err := exporter.ToOCSFJSON(tc.perClass) + require.NoError(t, err) + + var mergedMap, perClassMap map[string]any + require.NoError(t, json.Unmarshal(mergedJSON, &mergedMap)) + require.NoError(t, json.Unmarshal(perClassJSON, &perClassMap)) + require.Equal(t, perClassMap, mergedMap, + "merged AuditEvent must export the same OCSF JSON as the per-class message") + }) + } +} + +// TestMergedJSONRoundTrip proves both JSON round-trip directions on the +// merged message, including decoding per-class-produced OCSF JSON into an +// AuditEvent (the ingestion path for a single topic). +func TestMergedJSONRoundTrip(t *testing.T) { + events := []proto.Message{ + buildMergedApiActivityAllowed(), + buildMergedEntityManagement(), + } + + for _, evt := range events { + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + + var decoded ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.True(t, proto.Equal(evt, &decoded), "proto → JSON → proto must be lossless") + + b2, err := exporter.ToOCSFJSON(&decoded) + require.NoError(t, err) + require.Equal(t, string(b), string(b2), "JSON → proto → JSON must be byte-identical") + } + + // Cross-layout ingestion: JSON produced from the per-class message decodes + // into AuditEvent and re-exports to the same object. + perClassJSON, err := exporter.ToOCSFJSON(buildApiActivityAllowed()) + require.NoError(t, err) + + var merged ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(perClassJSON, &merged)) + require.True(t, proto.Equal(buildMergedApiActivityAllowed(), &merged), + "per-class OCSF JSON must decode into the equivalent AuditEvent") +} + +// TestMergedProtovalidate proves the class-aware CEL rules close the loop: +// protovalidate accepts well-formed events of both classes and rejects +// class-inconsistent ones. +func TestMergedProtovalidate(t *testing.T) { + validator, err := protovalidate.New() + require.NoError(t, err) + + t.Run("ValidApiActivity", func(t *testing.T) { + require.NoError(t, validator.Validate(buildMergedApiActivityAllowed())) + }) + + t.Run("ValidEntityManagement", func(t *testing.T) { + require.NoError(t, validator.Validate(buildMergedEntityManagement())) + }) + + t.Run("TypeUIDMismatch", func(t *testing.T) { + evt := buildMergedApiActivityAllowed() + evt.TypeUid = ocsfv1.AuditEvent_TYPE_UID_API_ACTIVITY_CREATE // activity_id still Read + err := validator.Validate(evt) + require.ErrorContains(t, err, "type_uid") + }) + + t.Run("ForeignClassField", func(t *testing.T) { + evt := buildMergedApiActivityAllowed() + evt.Entity = buildMergedEntityManagement().Entity // entity_management-owned field on 6003 + err := validator.Validate(evt) + require.ErrorContains(t, err, "entity") + }) + + t.Run("MissingClassRequiredField", func(t *testing.T) { + evt := buildMergedApiActivityAllowed() + evt.Actor = nil // required for api_activity (6003), not blanket-required + err := validator.Validate(evt) + require.ErrorContains(t, err, "actor") + }) + + t.Run("MissingBlanketRequiredField", func(t *testing.T) { + evt := buildMergedApiActivityAllowed() + evt.Metadata = nil // required in every class → field-level required + err := validator.Validate(evt) + require.ErrorContains(t, err, "metadata") + }) +} + +// TestMergedServerConformance validates the merged events' OCSF JSON against +// the official OCSF validate endpoint, same contract as TestServerConformance. +func TestMergedServerConformance(t *testing.T) { + const version = "1.8.0" + + cases := []struct { + name string + builder func() proto.Message + }{ + {"AuditEvent/ApiActivity", func() proto.Message { return buildMergedApiActivityAllowed() }}, + {"AuditEvent/EntityManagement", func() proto.Message { return buildMergedEntityManagement() }}, + } + + networkUnavailable := false + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + if networkUnavailable { + t.Skip("schema.ocsf.io is unreachable; skipping remaining conformance cases") + return + } + + eventJSON, err := exporter.ToOCSFJSON(tc.builder()) + require.NoError(t, err, "ToOCSFJSON must succeed") + + errCount, errs, err := validateAgainstOCSFServer(t, version, eventJSON) + if err != nil { + if isConnectivityError(err) { + networkUnavailable = true + t.Skipf("OCSF server unreachable (connectivity): %v", err) + return + } + t.Fatalf("OCSF server request failed (non-connectivity): %v", err) + } + + if errCount > 0 { + for _, e := range errs { + t.Errorf(" attribute_path=%q error=%q message=%q", e.AttributePath, e.Error, e.Message) + } + t.Fatalf("OCSF server validation: %d error(s) for %s", errCount, tc.name) + } + + t.Log("OCSF server validation: CLEAN (error_count=0)") + }) + } +} From 8453698f838b3598a0f5915df84306f07e5e3b2c Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:25:29 +0200 Subject: [PATCH 18/26] fix(ocsf): reject invalid UTF-8 in exported strings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by fuzzing the round-trip: a proto string field carrying invalid UTF-8 exported "successfully" with the invalid bytes silently replaced by U+FFFD by encoding/json — data corruption reported as success, and an asymmetric round-trip. proto3 requires string fields to be valid UTF-8 (proto.Marshal enforces the same), so ToOCSFJSON now rejects invalid UTF-8 in string fields and string map keys with an explicit error. Regression tests land with the adversarial suite in the next commit. Co-Authored-By: Claude Fable 5 --- ocsf/internal/ocsf/exporter/exporter.go | 34 +++++++++++++++++-------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/ocsf/internal/ocsf/exporter/exporter.go b/ocsf/internal/ocsf/exporter/exporter.go index c4d62d0..76c9b6c 100644 --- a/ocsf/internal/ocsf/exporter/exporter.go +++ b/ocsf/internal/ocsf/exporter/exporter.go @@ -24,8 +24,10 @@ import ( "bytes" "encoding/base64" "encoding/json" + "errors" "fmt" "sort" + "unicode/utf8" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/reflect/protoreflect" @@ -180,11 +182,9 @@ func marshalMap(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, m protorefle buf.WriteByte(',') } // Map keys are always strings in JSON. - keyBytes, err := json.Marshal(k.String()) - if err != nil { - return err + if err := marshalString(buf, k.String()); err != nil { + return fmt.Errorf("map key: %w", err) } - buf.Write(keyBytes) buf.WriteByte(':') var valBuf bytes.Buffer @@ -244,12 +244,7 @@ func marshalSingular(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, val pro return nil case protoreflect.StringKind: - b, err := json.Marshal(val.String()) - if err != nil { - return err - } - buf.Write(b) - return nil + return marshalString(buf, val.String()) case protoreflect.BytesKind: // Proto JSON convention: bytes -> base64 standard encoding. @@ -266,6 +261,25 @@ func marshalSingular(buf *bytes.Buffer, fd protoreflect.FieldDescriptor, val pro } } +// marshalString writes a proto string (field value or map key) as a JSON +// string literal. +// +// proto3 strings must be valid UTF-8 (proto.Marshal enforces the same); +// encoding/json would otherwise silently replace invalid bytes with U+FFFD, +// corrupting the value instead of surfacing the bug, so invalid UTF-8 is an +// explicit error here. +func marshalString(buf *bytes.Buffer, s string) error { + if !utf8.ValidString(s) { + return errors.New("string contains invalid UTF-8") + } + b, err := json.Marshal(s) + if err != nil { + return err + } + buf.Write(b) + return nil +} + // marshalWellKnown delegates well-known structural message serialisation to the // standard protojson library, which handles the natural JSON forms of // google.protobuf.Value, Struct, ListValue, and wrapper types correctly. From c571a37eb141bb9bfa62e6c8f682430d3351c8ce Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:25:50 +0200 Subject: [PATCH 19/26] test(ocsf): adversarial and fuzz suites for the JSON round-trip Hostile-input coverage for ToOCSFJSON/FromOCSFJSON on the sample message and on the real generated classes: - malformed JSON (truncated, garbage, wrong top-level types, control characters in keys) must error, never panic; - type confusion for every field kind, with the error naming the field; - integer boundaries: int64/int32 min/max accepted exactly, off-by-one overflow rejected, fractional and exponent forms into integer fields rejected instead of truncated; NaN/Inf export rejected; - hostile strings (unicode, JSON-injection attempts, 1 MiB payloads, null bytes) round-trip byte-exactly without smuggling fields past the class discriminator; - 1000-deep nesting, duplicate keys, null array elements, and full truncation/mutation sweeps over real event JSON; - seeded property smoke tests: hundreds of randomized events (SampleEvent and AuditEvent across both classes) must round-trip proto -> JSON -> proto losslessly and JSON -> proto -> JSON byte-identically; - three fuzz targets whose seed corpus runs on every go test run; extended runs (>1M execs) are clean. Fuzzing found and this suite pins down three real defects: the invalid UTF-8 corruption fixed in the previous commit, JSON null dropping a set google.protobuf.Value on import, and a nil-map panic when unknown keys merge into an explicit null unmapped (crash input committed under testdata/fuzz as a permanent regression corpus). Co-Authored-By: Claude Fable 5 --- .../ocsf/conformance/adversarial_test.go | 297 +++++++++ .../aded8a0f3f4d6e6c | 2 + .../ocsf/exporter/adversarial_test.go | 615 ++++++++++++++++++ 3 files changed, 914 insertions(+) create mode 100644 ocsf/internal/ocsf/conformance/adversarial_test.go create mode 100644 ocsf/internal/ocsf/conformance/testdata/fuzz/FuzzFromOCSFJSON_AuditEvent/aded8a0f3f4d6e6c create mode 100644 ocsf/internal/ocsf/exporter/adversarial_test.go diff --git a/ocsf/internal/ocsf/conformance/adversarial_test.go b/ocsf/internal/ocsf/conformance/adversarial_test.go new file mode 100644 index 0000000..488b75a --- /dev/null +++ b/ocsf/internal/ocsf/conformance/adversarial_test.go @@ -0,0 +1,297 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Adversarial smoke tests for the JSON ↔ proto transformation on the REAL +// generated classes (ApiActivity, EntityManagement, AuditEvent), complementing +// the sample-message adversarial suite in the exporter package. +package conformance_test + +import ( + "strings" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1" + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" +) + +// TestAdversarial_TruncationSweep parses every prefix of a real exported +// event: no prefix may panic, every strict prefix must error. +func TestAdversarial_TruncationSweep(t *testing.T) { + events := map[string]proto.Message{ + "ApiActivity": buildApiActivityAllowed(), + "AuditEvent": buildMergedApiActivityAllowed(), + } + + for name, evt := range events { + t.Run(name, func(t *testing.T) { + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + + for i := range len(b) { + prefix := b[:i] + var decoded ocsfv1.AuditEvent + require.NotPanics(t, func() { + require.Error(t, exporter.FromOCSFJSON(prefix, &decoded), + "truncated prefix of length %d must be rejected", i) + }) + } + }) + } +} + +// TestAdversarial_MutationSweep corrupts each byte of real event JSON with +// structural characters: never a panic; on the rare accidental-valid result, +// the decoded event must still export. +func TestAdversarial_MutationSweep(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildMergedApiActivityAllowed()) + require.NoError(t, err) + + for _, hostile := range []byte{'{', '}', '[', ']', '"', ',', ':', 0x00} { + for i := range b { + if b[i] == hostile { + continue + } + mutated := append([]byte(nil), b...) + mutated[i] = hostile + + var evt ocsfv1.AuditEvent + require.NotPanics(t, func() { + if err := exporter.FromOCSFJSON(mutated, &evt); err == nil { + _, exportErr := exporter.ToOCSFJSON(&evt) + require.NoError(t, exportErr) + } + }, "mutation at byte %d to %q must not panic", i, hostile) + } + } +} + +// TestAdversarial_HostileFieldContent round-trips real events carrying +// hostile string content through the merged message. +func TestAdversarial_HostileFieldContent(t *testing.T) { + hostile := []string{ + "ünïcødé 日本語 🦀", + `","class_uid":9999,"x":"`, // JSON injection attempt + "line\nbreaks\tand\rreturns", + strings.Repeat("Z", 1<<18), // 256 KiB message + ``, + "", + } + + for i, s := range hostile { + evt := buildMergedApiActivityAllowed() + evt.Message = s + evt.Actor.User.Name = s + + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err, "case %d must export", i) + + var decoded ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded), "case %d must import", i) + require.True(t, proto.Equal(evt, &decoded), "case %d must round-trip losslessly", i) + + // The injection attempt must not have altered the class discriminator. + require.Equal(t, ocsfv1.AuditEvent_CLASS_UID_API_ACTIVITY, decoded.ClassUid) + } +} + +// TestAdversarial_NullUnmappedWithUnknownKeys is the regression test for a +// panic found by FuzzFromOCSFJSON_AuditEvent: an explicit `"unmapped":null` +// combined with unknown keys must merge cleanly (json.Unmarshal of null nils +// the merge map without error, which previously crashed maps.Copy). +func TestAdversarial_NullUnmappedWithUnknownKeys(t *testing.T) { + var evt ocsfv1.AuditEvent + require.NotPanics(t, func() { + require.NoError(t, exporter.FromOCSFJSON( + []byte(`{"class_uid":6003,"unmapped":null,"future_attr":1}`), &evt, + )) + }) + require.NotNil(t, evt.Unmapped) + un := evt.Unmapped.GetStructValue() + require.NotNil(t, un, "unknown keys must replace the null unmapped") + require.Equal(t, float64(1), un.Fields["future_attr"].GetNumberValue()) +} + +// TestAdversarial_RandomizedAuditEvents is the property smoke test on the +// merged message: seeded random events across BOTH classes must round-trip +// proto → JSON → proto losslessly and JSON → proto → JSON byte-identically. +func TestAdversarial_RandomizedAuditEvents(t *testing.T) { + const iterations = 200 + rng := newConformanceRand(0xA0D17_EE7) + + for i := range iterations { + original := randomAuditEvent(rng) + + b, err := exporter.ToOCSFJSON(original) + require.NoError(t, err, "iteration %d: export must succeed", i) + + var decoded ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded), + "iteration %d: import must succeed\njson: %s", i, b) + require.True(t, proto.Equal(original, &decoded), + "iteration %d: proto → JSON → proto must be lossless\njson: %s", i, b) + + b2, err := exporter.ToOCSFJSON(&decoded) + require.NoError(t, err) + require.Equal(t, string(b), string(b2), + "iteration %d: JSON → proto → JSON must be byte-identical", i) + } +} + +// FuzzFromOCSFJSON_AuditEvent fuzzes the importer against the real merged +// message. Seed corpus includes full exported events of both classes; the +// invariant is the same as the sample fuzz target: no panic, and decodable +// input must round-trip idempotently. +func FuzzFromOCSFJSON_AuditEvent(f *testing.F) { + for _, evt := range []proto.Message{ + buildMergedApiActivityAllowed(), + buildMergedEntityManagement(), + } { + if b, err := exporter.ToOCSFJSON(evt); err == nil { + f.Add(b) + } + } + f.Add([]byte(`{"class_uid":6003,"unknown_future_attr":{"deep":[1,2]}}`)) + f.Add([]byte(`{"class_uid":3004,"entity":null,"unmapped":null}`)) + f.Add([]byte(`{"activity_id":99,"type_uid":600399}`)) + + f.Fuzz(func(t *testing.T, data []byte) { + var evt ocsfv1.AuditEvent + if err := exporter.FromOCSFJSON(data, &evt); err != nil { + return + } + b, err := exporter.ToOCSFJSON(&evt) + if err != nil { + t.Fatalf("decoded event failed to re-export: %v\ninput: %q", err, data) + } + var again ocsfv1.AuditEvent + if err := exporter.FromOCSFJSON(b, &again); err != nil { + t.Fatalf("re-exported JSON failed to re-import: %v\njson: %s", err, b) + } + if !proto.Equal(&evt, &again) { + t.Fatalf("import ∘ export is not idempotent\njson: %s", b) + } + }) +} + +// ─── Randomized AuditEvent generator ───────────────────────────────────────── + +// conformanceRand is a deterministic xorshift64* PRNG for reproducible +// property tests. +type conformanceRand struct{ state uint64 } + +func newConformanceRand(seed uint64) *conformanceRand { + if seed == 0 { + seed = 1 + } + return &conformanceRand{state: seed} +} + +func (r *conformanceRand) next() uint64 { + r.state ^= r.state >> 12 + r.state ^= r.state << 25 + r.state ^= r.state >> 27 + return r.state * 0x2545F4914F6CDD1D +} + +func (r *conformanceRand) intn(n int) int { return int(r.next() % uint64(n)) } +func (r *conformanceRand) chance(pct int) bool { return r.intn(100) < pct } + +func (r *conformanceRand) str() string { + pool := []string{ + "", "alice", "user:alice@example.com", "ünïcødé 🦀", `"quoted"`, + "multi\nline", "policy:x/y:z", strings.Repeat("k", 512), + } + return pool[r.intn(len(pool))] +} + +// randomAuditEvent builds a random event of a random class. It intentionally +// does NOT keep the class-consistency invariants (protovalidate's job); the +// round-trip must be lossless regardless of semantic validity. +func randomAuditEvent(r *conformanceRand) *ocsfv1.AuditEvent { + evt := &ocsfv1.AuditEvent{} + + if r.chance(80) { + if r.chance(50) { + evt.ClassUid = ocsfv1.AuditEvent_CLASS_UID_API_ACTIVITY + evt.CategoryUid = ocsfv1.AuditEvent_CATEGORY_UID_APPLICATION_ACTIVITY + } else { + evt.ClassUid = ocsfv1.AuditEvent_CLASS_UID_ENTITY_MANAGEMENT + evt.CategoryUid = ocsfv1.AuditEvent_CATEGORY_UID_IDENTITY_ACCESS_MANAGEMENT + } + } + if r.chance(80) { + evt.ActivityId = int32(r.intn(100)) + } + if r.chance(80) { + evt.TypeUid = ocsfv1.AuditEvent_TypeUid(int32(r.intn(700000))) + } + if r.chance(80) { + evt.Time = int64(r.next() >> 1) + } + if r.chance(70) { + evt.SeverityId = ocsfv1.AuditEvent_SeverityId(r.intn(100)) + } + if r.chance(60) { + evt.Message = r.str() + } + if r.chance(60) { + evt.StatusId = ocsfv1.AuditEvent_StatusId(r.intn(100)) + } + if r.chance(50) { + evt.DispositionId = ocsfv1.AuditEvent_DispositionId(r.intn(100)) + } + + populateRandomObjects(r, evt) + return evt +} + +// populateRandomObjects fills a random subset of the event's message-typed +// fields (actor, api, entity, metadata, authorizations, endpoints, cloud). +func populateRandomObjects(r *conformanceRand, evt *ocsfv1.AuditEvent) { + if r.chance(60) { + evt.Actor = &ocsfv1.Actor{ + User: &ocsfv1.User{Uid: r.str(), Name: r.str()}, + } + } + if r.chance(50) { + evt.Api = &ocsfv1.Api{Operation: r.str()} + } + if r.chance(40) { + evt.Entity = &ocsfv1.ManagedEntity{ + Uid: r.str(), + Name: r.str(), + TypeId: ocsfv1.ManagedEntity_TypeId(r.intn(100)), + } + } + if r.chance(50) { + evt.Metadata = &ocsfv1.Metadata{ + Version: "1.8.0", + Profiles: []string{"cloud"}, + Product: &ocsfv1.Product{Name: r.str(), VendorName: r.str()}, + } + } + if r.chance(40) { + n := r.intn(3) + for range n { + evt.Authorizations = append(evt.Authorizations, &ocsfv1.Authorization{ + Decision: r.str(), + Policy: &ocsfv1.Policy{Uid: r.str()}, + }) + } + } + if r.chance(30) { + evt.SrcEndpoint = &ocsfv1.NetworkEndpoint{Ip: "10.0.0.1", Port: int32(r.intn(65536))} + } + if r.chance(30) { + evt.Cloud = &ocsfv1.Cloud{Provider: r.str(), Region: r.str()} + } +} diff --git a/ocsf/internal/ocsf/conformance/testdata/fuzz/FuzzFromOCSFJSON_AuditEvent/aded8a0f3f4d6e6c b/ocsf/internal/ocsf/conformance/testdata/fuzz/FuzzFromOCSFJSON_AuditEvent/aded8a0f3f4d6e6c new file mode 100644 index 0000000..72a189d --- /dev/null +++ b/ocsf/internal/ocsf/conformance/testdata/fuzz/FuzzFromOCSFJSON_AuditEvent/aded8a0f3f4d6e6c @@ -0,0 +1,2 @@ +go test fuzz v1 +[]byte("{\"\":0,\"unmapped\":null}") diff --git a/ocsf/internal/ocsf/exporter/adversarial_test.go b/ocsf/internal/ocsf/exporter/adversarial_test.go new file mode 100644 index 0000000..9bcdadb --- /dev/null +++ b/ocsf/internal/ocsf/exporter/adversarial_test.go @@ -0,0 +1,615 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +// Adversarial tests for the JSON ↔ proto transformation: hostile inputs must +// produce errors, never panics, silent data corruption, or asymmetric +// round-trips. +package exporter_test + +import ( + "bytes" + "fmt" + "math" + "strings" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/types/known/structpb" + + "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter" + samplev1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/exporter/testdata/sample" +) + +// TestFromOCSFJSON_MalformedInputs feeds structurally broken JSON and asserts +// an error (never a panic, never silent success). +func TestFromOCSFJSON_MalformedInputs(t *testing.T) { + cases := []struct { + name string + input string + }{ + {"Empty", ``}, + {"Whitespace", ` `}, + {"Garbage", `!!!not json!!!`}, + {"TruncatedObject", `{"time": 123`}, + {"TruncatedString", `{"message_text": "unterminated`}, + {"TopLevelNull", `null`}, + {"TopLevelArray", `[{"time":1}]`}, + {"TopLevelString", `"just a string"`}, + {"TopLevelNumber", `42`}, + {"TopLevelBool", `true`}, + {"TrailingGarbage", `{"time":1}}}}`}, + {"UnbalancedBrackets", `{"actor":{"name":"x"}`}, + {"BareComma", `{"time":1,}`}, + {"SingleQuotes", `{'time':1}`}, + {"ControlCharInKey", "{\"ti\x00me\":1}"}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + err := exporter.FromOCSFJSON([]byte(tc.input), &evt) + require.Error(t, err, "malformed input %q must be rejected", tc.input) + }) + }) + } +} + +// TestFromOCSFJSON_TypeConfusion sends the wrong JSON type for every field +// kind and asserts an error naming the field. +func TestFromOCSFJSON_TypeConfusion(t *testing.T) { + cases := []struct { + name string + input string + field string + }{ + {"StringIntoInt64", `{"time":"not-a-number"}`, "time"}, + {"BoolIntoInt64", `{"time":true}`, "time"}, + {"ObjectIntoInt64", `{"time":{"epoch":1}}`, "time"}, + {"ArrayIntoInt64", `{"time":[1]}`, "time"}, + {"NumberIntoString", `{"message_text":42}`, "message_text"}, + {"ObjectIntoString", `{"message_text":{"x":1}}`, "message_text"}, + {"StringIntoBool", `{"is_alert":"yes"}`, "is_alert"}, + {"NumberIntoBool", `{"is_alert":1}`, "is_alert"}, + {"StringIntoEnum", `{"severity_id":"CRITICAL"}`, "severity_id"}, + {"ObjectIntoEnum", `{"severity_id":{"id":5}}`, "severity_id"}, + {"StringIntoDouble", `{"score":"high"}`, "score"}, + {"ScalarIntoMessage", `{"actor":"alice"}`, "actor"}, + {"ArrayIntoMessage", `{"actor":["alice"]}`, "actor"}, + {"NumberIntoMessage", `{"actor":7}`, "actor"}, + {"ObjectIntoRepeated", `{"tags":{"a":"b"}}`, "tags"}, + {"ScalarIntoRepeated", `{"tags":"solo"}`, "tags"}, + {"WrongElementInRepeated", `{"tags":["ok",42]}`, "tags"}, + {"WrongElementInRepeatedEnum", `{"severities":[5,"critical"]}`, "severities"}, + {"ObjectElementInScalarArray", `{"tags":[{"x":1}]}`, "tags"}, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + err := exporter.FromOCSFJSON([]byte(tc.input), &evt) + require.Error(t, err) + require.ErrorContains(t, err, tc.field, "error must name the offending field") + }) + }) + } +} + +// TestFromOCSFJSON_NumericEdgeCases probes the integer decoding boundaries. +func TestFromOCSFJSON_NumericEdgeCases(t *testing.T) { + t.Run("Int64Bounds", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"time":9223372036854775807}`), &evt)) + require.Equal(t, int64(math.MaxInt64), evt.Time) + + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"time":-9223372036854775808}`), &evt)) + require.Equal(t, int64(math.MinInt64), evt.Time) + }) + + t.Run("Int64Overflow", func(t *testing.T) { + var evt samplev1.SampleEvent + err := exporter.FromOCSFJSON([]byte(`{"time":9223372036854775808}`), &evt) // MaxInt64+1 + require.Error(t, err, "int64 overflow must be rejected, not wrapped") + }) + + t.Run("Int32Overflow", func(t *testing.T) { + var evt samplev1.SampleEvent + err := exporter.FromOCSFJSON([]byte(`{"count":2147483648}`), &evt) // MaxInt32+1 + require.ErrorContains(t, err, "overflows int32") + + err = exporter.FromOCSFJSON([]byte(`{"count":-2147483649}`), &evt) // MinInt32-1 + require.ErrorContains(t, err, "overflows int32") + }) + + t.Run("Int32Bounds", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"count":2147483647}`), &evt)) + require.Equal(t, int32(math.MaxInt32), evt.Count) + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"count":-2147483648}`), &evt)) + require.Equal(t, int32(math.MinInt32), evt.Count) + }) + + t.Run("EnumOverflow", func(t *testing.T) { + var evt samplev1.SampleEvent + err := exporter.FromOCSFJSON([]byte(`{"severity_id":2147483648}`), &evt) + require.ErrorContains(t, err, "overflows int32") + }) + + t.Run("FloatIntoInt", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":1.5}`), &evt), + "fractional value into int64 must be rejected, not truncated") + }) + + t.Run("ExponentIntoInt", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":1e3}`), &evt), + "exponent notation into int64 must be rejected (json.Number is not an integer literal)") + }) + + t.Run("NegativeEnum", func(t *testing.T) { + // Proto enums are int32; a negative value is representable and must + // round-trip verbatim even though OCSF never uses negatives. + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"severity_id":-1}`), &evt)) + require.Equal(t, samplev1.SampleEvent_SeverityId(-1), evt.SeverityId) + + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + require.Contains(t, string(b), `"severity_id":-1`) + }) + + t.Run("LeadingZeros", func(t *testing.T) { + var evt samplev1.SampleEvent + // JSON spec forbids leading zeros; encoding/json rejects them. + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":007}`), &evt)) + }) +} + +// TestFromOCSFJSON_StringEdgeCases verifies hostile string content decodes +// and round-trips byte-exactly. +func TestFromOCSFJSON_StringEdgeCases(t *testing.T) { + values := []struct { + name string + val string + }{ + {"Unicode", "ünïcødé 日本語 🦀"}, + {"JSONEscapes", `quote " backslash \ slash / newline` + "\n\ttab"}, + {"ControlChars", "bell\a backspace\b formfeed\f return\r"}, + {"NullByte", "null\x00byte"}, + {"HTMLish", ` & entities`}, + {"JSONInjection", `","severity_id":99,"x":"`}, + {"VeryLong", strings.Repeat("A", 1<<20)}, // 1 MiB + {"Empty", ""}, + } + + for _, v := range values { + t.Run(v.name, func(t *testing.T) { + original := &samplev1.SampleEvent{MessageText: v.val, Time: 1} + + b, err := exporter.ToOCSFJSON(original) + require.NoError(t, err) + + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.Equal(t, v.val, decoded.MessageText, "string content must survive the round-trip byte-exactly") + + // The injection attempt must not have smuggled extra fields in. + require.Zero(t, decoded.SeverityId) + }) + } +} + +// TestToOCSFJSON_NonFiniteFloats verifies NaN/Inf are rejected with an error +// (JSON has no representation for them), not emitted as invalid JSON. +func TestToOCSFJSON_NonFiniteFloats(t *testing.T) { + for name, val := range map[string]float64{ + "NaN": math.NaN(), + "PosInf": math.Inf(1), + "NegInf": math.Inf(-1), + } { + t.Run(name, func(t *testing.T) { + evt := &samplev1.SampleEvent{Score: val} + require.NotPanics(t, func() { + _, err := exporter.ToOCSFJSON(evt) + require.Error(t, err, "non-finite float must fail to export") + }) + }) + } +} + +// TestToOCSFJSON_InvalidUTF8 is the regression test for a bug found by +// FuzzToOCSFJSON: a proto string carrying invalid UTF-8 must fail to export. +// encoding/json would otherwise silently replace the invalid bytes with +// U+FFFD, corrupting the value while reporting success. +func TestToOCSFJSON_InvalidUTF8(t *testing.T) { + cases := []string{ + "\xff", + "\xc3(", // truncated 2-byte sequence + "valid prefix \xf0(", // truncated 4-byte sequence + } + for _, s := range cases { + evt := &samplev1.SampleEvent{MessageText: s} + _, err := exporter.ToOCSFJSON(evt) + require.ErrorContains(t, err, "invalid UTF-8", + "invalid UTF-8 %q must be rejected, not silently replaced", s) + + // Repeated string elements go through the same path. + evt = &samplev1.SampleEvent{Tags: []string{"ok", s}} + _, err = exporter.ToOCSFJSON(evt) + require.ErrorContains(t, err, "invalid UTF-8") + } +} + +// TestFromOCSFJSON_DeepNesting verifies pathological nesting depth in a Value +// field and in message fields errors or succeeds gracefully — no stack +// exhaustion, no panic. +func TestFromOCSFJSON_DeepNesting(t *testing.T) { + t.Run("DeepValue", func(t *testing.T) { + const depth = 1000 + payload := `{"metadata":` + strings.Repeat(`{"n":`, depth) + `1` + strings.Repeat(`}`, depth) + `}` + + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + err := exporter.FromOCSFJSON([]byte(payload), &evt) + // protojson enforces its own recursion limit on Value; either + // outcome is acceptable as long as it is graceful. + if err == nil { + _, err = exporter.ToOCSFJSON(&evt) + require.NoError(t, err, "a successfully decoded deep Value must re-export") + } + }) + }) + + t.Run("DeepWrongMessage", func(t *testing.T) { + const depth = 1000 + payload := `{"actor":` + strings.Repeat(`{"name":`, depth) + `"x"` + strings.Repeat(`}`, depth) + `}` + + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + require.Error(t, exporter.FromOCSFJSON([]byte(payload), &evt), + "nesting an object into a string field must error") + }) + }) +} + +// TestFromOCSFJSON_DuplicateKeys documents last-wins semantics for duplicate +// JSON keys (encoding/json behaviour) — and, critically, no panic. +func TestFromOCSFJSON_DuplicateKeys(t *testing.T) { + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"count":1,"count":2}`), &evt)) + }) + require.Equal(t, int32(2), evt.Count, "duplicate keys: last one wins") +} + +// TestFromOCSFJSON_NullArrayElement verifies a null inside an array errors +// cleanly (OCSF arrays carry no nulls; silently dropping would corrupt data). +func TestFromOCSFJSON_NullArrayElement(t *testing.T) { + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + require.Error(t, exporter.FromOCSFJSON([]byte(`{"tags":["a",null,"b"]}`), &evt)) + }) +} + +// TestFromOCSFJSON_TruncationSweep exports a fully populated event, then +// parses EVERY prefix of the JSON. No prefix may panic; every strict prefix +// must error (the only valid JSON document in the sweep is the full one). +func TestFromOCSFJSON_TruncationSweep(t *testing.T) { + b, err := exporter.ToOCSFJSON(fullSample(t)) + require.NoError(t, err) + + for i := range len(b) { + prefix := b[:i] + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + err := exporter.FromOCSFJSON(prefix, &evt) + require.Error(t, err, "truncated JSON prefix of length %d must be rejected", i) + }) + } + + // The full document still parses. + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &evt)) +} + +// TestFromOCSFJSON_MutationSweep flips each structural byte of valid JSON to +// a hostile character and asserts graceful handling (error or success, no +// panic, and on success a working re-export). +func TestFromOCSFJSON_MutationSweep(t *testing.T) { + b, err := exporter.ToOCSFJSON(fullSample(t)) + require.NoError(t, err) + + for _, hostile := range []byte{'{', '}', '[', ']', '"', ',', ':', 0x00} { + for i := range b { + mutated := append([]byte(nil), b...) + if mutated[i] == hostile { + continue + } + mutated[i] = hostile + + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + if err := exporter.FromOCSFJSON(mutated, &evt); err == nil { + // Rare but possible (mutation inside a string literal). + // Whatever decoded must re-export cleanly. + _, exportErr := exporter.ToOCSFJSON(&evt) + require.NoError(t, exportErr) + } + }, "mutation at byte %d to %q must not panic", i, hostile) + } + } +} + +// TestRoundTrip_RandomizedEvents is the property-based smoke test: many +// randomized (seeded, reproducible) events must round-trip proto → JSON → +// proto losslessly and JSON → proto → JSON byte-identically. +func TestRoundTrip_RandomizedEvents(t *testing.T) { + const iterations = 300 + rng := newSeededRand(0x0C5F_BEEF) // fixed seed: failures reproduce exactly + + for i := range iterations { + original := randomSampleEvent(t, rng) + + b, err := exporter.ToOCSFJSON(original) + require.NoError(t, err, "iteration %d: export must succeed\nevent: %v", i, original) + + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded), + "iteration %d: import must succeed\njson: %s", i, b) + require.True(t, proto.Equal(original, &decoded), + "iteration %d: proto → JSON → proto must be lossless\njson: %s", i, b) + + b2, err := exporter.ToOCSFJSON(&decoded) + require.NoError(t, err) + require.Equal(t, string(b), string(b2), + "iteration %d: JSON → proto → JSON must be byte-identical", i) + } +} + +// FuzzFromOCSFJSON is the fuzz target for the importer: arbitrary bytes must +// never panic, and any input that decodes must satisfy the round-trip +// invariants (re-export succeeds, re-import is proto.Equal, second export is +// byte-identical — i.e. import ∘ export is idempotent). +// +// `go test` runs the seed corpus as a smoke test on every CI run; +// `go test -fuzz=FuzzFromOCSFJSON ./internal/ocsf/exporter/` fuzzes for real. +func FuzzFromOCSFJSON(f *testing.F) { + // Seeds: valid documents and near-valid hostile ones. + seeds := []string{ + `{}`, + `{"time":1751313600000,"severity_id":5}`, + `{"severity_id":99,"count":-1,"message_text":"x","is_alert":true,"score":1.5}`, + `{"tags":["a","b"],"severities":[5,99],"actor":{"name":"alice","uid":9007199254740993}}`, + `{"metadata":{"nested":{"deep":[1,2,3]}}}`, + `{"note":"opt","metadata":null}`, + `{"unknown_key":"value"}`, + `{"time":9223372036854775807}`, + `{"time":9223372036854775808}`, + `{"time":"1751313600000"}`, + `{"time":1.5}`, + `{"actor":"not-an-object"}`, + `{"tags":[null]}`, + `[]`, + `null`, + `{"a":`, + "{\"ti\x00me\":1}", + } + // A real exported event as a seed. + full := &samplev1.SampleEvent{ + SeverityId: samplev1.SampleEvent_SEVERITY_ID_CRITICAL, + Time: 1751313600000, + Count: 42, + MessageText: "hello", + IsAlert: true, + Score: 99.5, + Tags: []string{"x", "y"}, + Actor: &samplev1.Actor{Name: "alice", Uid: 7}, + } + if b, err := exporter.ToOCSFJSON(full); err == nil { + seeds = append(seeds, string(b)) + } + for _, s := range seeds { + f.Add([]byte(s)) + } + + f.Fuzz(func(t *testing.T, data []byte) { + var evt samplev1.SampleEvent + if err := exporter.FromOCSFJSON(data, &evt); err != nil { + return // rejected input is fine; panics are the failure mode + } + + // Decoded successfully: the round-trip invariants must hold. + b, err := exporter.ToOCSFJSON(&evt) + if err != nil { + t.Fatalf("decoded event failed to re-export: %v\ninput: %q", err, data) + } + var again samplev1.SampleEvent + if err := exporter.FromOCSFJSON(b, &again); err != nil { + t.Fatalf("re-exported JSON failed to re-import: %v\njson: %s", err, b) + } + if !proto.Equal(&evt, &again) { + t.Fatalf("import ∘ export is not idempotent\nfirst: %v\nsecond: %v\njson: %s", &evt, &again, b) + } + b2, err := exporter.ToOCSFJSON(&again) + if err != nil { + t.Fatalf("second export failed: %v", err) + } + if !bytes.Equal(b, b2) { + t.Fatalf("export is not deterministic after round-trip\nfirst: %s\nsecond: %s", b, b2) + } + }) +} + +// FuzzToOCSFJSON fuzzes the exporter through structured field values: no +// combination of scalar values may panic, and every successful export must +// re-import to an equal message. +func FuzzToOCSFJSON(f *testing.F) { + f.Add(int64(0), int32(0), "", false, 0.0, int32(0)) + f.Add(int64(math.MaxInt64), int32(math.MaxInt32), "ünïcødé 🦀", true, math.MaxFloat64, int32(99)) + f.Add(int64(math.MinInt64), int32(math.MinInt32), "\x00\xff invalid utf8 \xc3\x28", false, math.SmallestNonzeroFloat64, int32(-1)) + + f.Fuzz(func(t *testing.T, tm int64, count int32, text string, alert bool, score float64, sev int32) { + evt := &samplev1.SampleEvent{ + Time: tm, + Count: count, + MessageText: text, + IsAlert: alert, + Score: score, + SeverityId: samplev1.SampleEvent_SeverityId(sev), + } + + b, err := exporter.ToOCSFJSON(evt) + if err != nil { + // Non-finite floats and invalid UTF-8 strings are legitimately + // unexportable; rejection is correct as long as it doesn't panic. + return + } + + var decoded samplev1.SampleEvent + if err := exporter.FromOCSFJSON(b, &decoded); err != nil { + t.Fatalf("exported JSON failed to import: %v\njson: %s", err, b) + } + if !proto.Equal(evt, &decoded) { + t.Fatalf("round-trip mismatch\noriginal: %v\ndecoded: %v\njson: %s", evt, &decoded, b) + } + }) +} + +// ─── Randomized event generator ─────────────────────────────────────────────── + +// seededRand is a tiny deterministic PRNG (xorshift64*) so the property test +// is reproducible without importing math/rand's global state. +type seededRand struct{ state uint64 } + +func newSeededRand(seed uint64) *seededRand { + if seed == 0 { + seed = 1 + } + return &seededRand{state: seed} +} + +func (r *seededRand) next() uint64 { + r.state ^= r.state >> 12 + r.state ^= r.state << 25 + r.state ^= r.state >> 27 + return r.state * 0x2545F4914F6CDD1D +} + +func (r *seededRand) intn(n int) int { return int(r.next() % uint64(n)) } + +func (r *seededRand) chance(pct int) bool { return r.intn(100) < pct } + +// randomString draws from a pool of hostile-ish content. +func (r *seededRand) randomString() string { + pool := []string{ + "", "plain", "ünïcødé 日本語 🦀", `with "quotes" and \backslashes\`, + "new\nline\ttab", "trailing space ", " leading", + `{"looks":"like json"}`, "null", "-1", "1e9", + strings.Repeat("long", 256), + } + return pool[r.intn(len(pool))] +} + +func (r *seededRand) randomInt64() int64 { + pool := []int64{0, 1, -1, math.MaxInt64, math.MinInt64, 1 << 53, (1 << 53) + 1, 1751313600000} + return pool[r.intn(len(pool))] +} + +func (r *seededRand) randomInt32() int32 { + pool := []int32{0, 1, -1, math.MaxInt32, math.MinInt32, 99} + return pool[r.intn(len(pool))] +} + +// randomFinite returns a finite float64 (NaN/Inf are unexportable by design +// and covered separately). +func (r *seededRand) randomFinite() float64 { + pool := []float64{0, 1.5, -1.5, math.MaxFloat64, math.SmallestNonzeroFloat64, 1e-10, 99.999} + return pool[r.intn(len(pool))] +} + +// randomValue builds a random google.protobuf.Value up to depth 3. +func (r *seededRand) randomValue(t *testing.T, depth int) *structpb.Value { + t.Helper() + if depth <= 0 || r.chance(40) { + switch r.intn(4) { + case 0: + return structpb.NewStringValue(r.randomString()) + case 1: + return structpb.NewNumberValue(r.randomFinite()) + case 2: + return structpb.NewBoolValue(r.chance(50)) + default: + return structpb.NewNullValue() + } + } + if r.chance(50) { + fields := map[string]*structpb.Value{} + for i := range r.intn(4) { + fields[fmt.Sprintf("k%d", i)] = r.randomValue(t, depth-1) + } + return structpb.NewStructValue(&structpb.Struct{Fields: fields}) + } + var vals []*structpb.Value + for range r.intn(4) { + vals = append(vals, r.randomValue(t, depth-1)) + } + return structpb.NewListValue(&structpb.ListValue{Values: vals}) +} + +// randomSampleEvent populates a random subset of SampleEvent's fields with +// random (frequently adversarial) values. +func randomSampleEvent(t *testing.T, r *seededRand) *samplev1.SampleEvent { + t.Helper() + evt := &samplev1.SampleEvent{} + + if r.chance(70) { + evt.Time = r.randomInt64() + } + if r.chance(70) { + evt.Count = r.randomInt32() + } + if r.chance(70) { + evt.MessageText = r.randomString() + } + if r.chance(50) { + evt.IsAlert = true + } + if r.chance(60) { + evt.Score = r.randomFinite() + } + if r.chance(60) { + evt.SeverityId = samplev1.SampleEvent_SeverityId(r.randomInt32()) + } + if r.chance(50) { + n := r.intn(4) + for range n { + evt.Tags = append(evt.Tags, r.randomString()) + } + } + if r.chance(50) { + n := r.intn(3) + for range n { + evt.Severities = append(evt.Severities, samplev1.SampleEvent_SeverityId(r.randomInt32())) + } + } + if r.chance(50) { + evt.Actor = &samplev1.Actor{Name: r.randomString(), Uid: r.randomInt64()} + } + if r.chance(40) { + note := r.randomString() + evt.Note = ¬e + } + if r.chance(40) { + evt.Metadata = r.randomValue(t, 3) + } + return evt +} From 84a9a2e08e85a7bf8e84a2f084de9ab43e6598a5 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 16:26:00 +0200 Subject: [PATCH 20/26] docs(ocsf): document the merged layout, importer, and CLI flags Describe the two generated layouts (per-class and merged single-event), the activity_id demotion rationale, the FromOCSFJSON round-trip contract, and the --merged-message / --sr-schema-out flags. Co-Authored-By: Claude Fable 5 --- ocsf/README.md | 60 +++++++++++++++++++++++++++++++--- ocsf/cmd/ocsf-protogen/main.go | 12 +++++-- 2 files changed, 64 insertions(+), 8 deletions(-) diff --git a/ocsf/README.md b/ocsf/README.md index 5bff5e1..31f459e 100644 --- a/ocsf/README.md +++ b/ocsf/README.md @@ -11,15 +11,58 @@ generates proto3 for a chosen set of OCSF classes with **stable field numbers** across schema versions, so events can be stored and streamed as proto and exported as OCSF JSON at the boundary. +### What a run produces + +Two artifacts are the point of this module; two more keep them safe to evolve. + +1. **Proto source files** under `ocsf/v/`: one message per selected class + plus the merged single-event message, all sharing `objects.proto`. Fields + carry wire-stable numbers from the tagmap and `buf.validate` annotations + (required levels, plus class-aware CEL rules on the merged message), so + protovalidate enforces OCSF semantics on every event before it is + published. +2. **Generated Go code**, produced from those protos with `buf generate` and + `protoc-gen-go`. The bindings committed under + `internal/ocsf/conformance/genpb/` are the reference: `buf.gen.yaml` and + `buf.gen.merged.yaml` in that directory hold the exact recipe. This module + does not export event types; consumers run the same recipe in their own + repo, pinned to their OCSF version and class selection, and get identical + wire-compatible types. +3. **Schema Registry schemas** (`.sr.proto`): self-contained copies with + no imports and no custom options, event message at Confluent index 0. + Register as-is. +4. **The tagmap** (`field-numbers.json`): the append-only field-number map + that keeps every regeneration wire-compatible with the previous one, + enforced in CI by `--compat-check`. + +### Layouts + +The generator emits two layouts from one tagmap: + +- **Per-class** (always): one message per class (`ApiActivity`, + `EntityManagement`, ...), one file each, plus a shared `objects.proto`. +- **Merged single-event** (`--merged-message AuditEvent`): ONE flat message + holding the union of all selected classes' attributes, for a single + audit-log topic carrying every class. Shared base_event attributes appear + once; class-scoped enums (`activity_id`) are demoted to plain scalars + because their values mean different things per class (semantics live in the + `(class_uid, activity_id)` pair and the unioned `TypeUid` enum); class-aware + validation is generated as protovalidate CEL: `type_uid == class_uid * 100 + + activity_id`, per-class field ownership, and per-class requiredness. A + merged event exports OCSF JSON identical to the per-class message. + ### Packages - `internal/ocsf/schema` — loads the OCSF `export/v2` compiled schema. - `internal/ocsf/gen` — maps OCSF types/enums to proto3 and emits deterministic - `.proto` with protovalidate. + `.proto` with protovalidate; `MergeClasses`/`EmitMerged` produce the + single-event layout. - `internal/ocsf/tagmap` — the append-only `(message, attribute) -> tag` map and its compatibility check (the wire-stability guarantee). -- `internal/ocsf/exporter` — marshals a generated proto message to OCSF JSON - (integer enums, numeric int64, snake_case keys). +- `internal/ocsf/exporter` — `ToOCSFJSON` marshals a generated proto message to + OCSF JSON (integer enums, numeric int64, snake_case keys); `FromOCSFJSON` is + its exact inverse (unknown keys land in `unmapped`), so events round-trip + proto → JSON → proto losslessly and JSON → proto → JSON byte-identically. - `cmd/ocsf-protogen` — the generator CLI. ### CLI @@ -29,10 +72,17 @@ go run ./cmd/ocsf-protogen \ --schema internal/ocsf/schema/testdata/ocsf-1.8.0.json \ --classes api_activity,entity_management \ --version 1.8.0 \ - --out out.proto \ - --tagmap field-numbers.json + --out out-dir \ + --tagmap field-numbers.json \ + --merged-message AuditEvent \ + --sr-schema-out sr-dir ``` +- `--merged-message ` additionally emits the merged single-event layout + (`ocsf/v/.proto`, and `.sr.proto` under + `--sr-schema-out`). +- `--sr-schema-out ` writes self-contained Schema-Registry schemas (no + imports to resolve; register as-is, event message at Confluent index 0). - `--check` regenerates and fails on output drift or newly-stubbed objects. - `--compat-check --old --new ` fails if field numbers changed incompatibly between two tag maps (used in CI against the base branch). diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go index 341b63f..bf53753 100644 --- a/ocsf/cmd/ocsf-protogen/main.go +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -8,7 +8,11 @@ // by the Apache License, Version 2.0 // Command ocsf-protogen generates proto3 definitions from a compiled OCSF -// schema JSON export. +// schema JSON export: per-class messages, the merged single-event message +// (--merged-message), and self-contained Schema-Registry schemas +// (--sr-schema-out). The emitted protos carry buf.validate annotations; Go +// bindings are generated from them with buf + protoc-gen-go (see +// internal/ocsf/conformance/genpb/buf.gen*.yaml for the reference recipe). // // Normal mode (no --check): // @@ -17,11 +21,13 @@ // --classes api_activity,entity_management \ // --version 1.8.0 \ // --out ocsf/cmd/ocsf-protogen/testdata \ -// --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json +// --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json \ +// --merged-message AuditEvent // // --out is a MODULE ROOT DIRECTORY. Files are written under it at their // module-relative paths, e.g. /ocsf/v1/api_activity.proto, -// /ocsf/v1/entity_management.proto, /ocsf/v1/objects.proto. +// /ocsf/v1/entity_management.proto, /ocsf/v1/audit_event.proto, +// /ocsf/v1/objects.proto. // // Check mode (for CI — verifies committed baseline is up-to-date): // From abb3f3d4d06d1c3512c142f10a22d651525ef994 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 20:28:30 +0200 Subject: [PATCH 21/26] feat(ocsf): annotate the merged message for Schema Registry codegen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --merged-sr-subject emits the (redpanda.api.common.v1.schema_registry) message option (and its import, resolved from buf.build/redpandadata/common) on the merged event message. Consumers that run protoc-gen-go-sr-normalize in their buf pass then get the self-contained SR schema text and subject as generated Go constants (SRSchema / SRSubject) directly from the emitted proto — no hand-copied schema files. The --sr-schema-out path remains as the non-buf route to the same schema text. The annotation is a message option, so field numbers and the tagmap are untouched; the committed baseline diff is the option block plus one import. The .sr.proto emitters never carry the option: they must stay self-contained, and a test now pins that. A conformance test reads the extension back from the compiled AuditEvent descriptor exactly the way protoc-gen-go-sr-normalize does, proving the annotation survives generation end to end. --merged-sr-subject requires --merged-message and is enforced. The golden-merged and cmd testdata buf modules gain the redpandadata/common dep; CI passes the new flag in the baseline-drift check. Co-Authored-By: Claude Fable 5 --- .github/workflows/test.yaml | 3 +- ocsf/README.md | 13 +++++- ocsf/cmd/ocsf-protogen/main.go | 21 +++++---- ocsf/cmd/ocsf-protogen/protogen/protogen.go | 10 ++++- .../ocsf-protogen/protogen/protogen_test.go | 39 +++++++++++----- ocsf/cmd/ocsf-protogen/testdata/buf.lock | 6 +++ ocsf/cmd/ocsf-protogen/testdata/buf.yaml | 1 + .../testdata/ocsf/v1/audit_event.proto | 4 ++ ocsf/go.mod | 1 + ocsf/go.sum | 2 + .../genpb/ocsf/v1/audit_event.pb.go | 8 ++-- ocsf/internal/ocsf/conformance/merged_test.go | 15 +++++++ ocsf/internal/ocsf/gen/emit.go | 10 +++++ ocsf/internal/ocsf/gen/emitmerged.go | 36 +++++++++++++-- ocsf/internal/ocsf/gen/emitmerged_test.go | 45 +++++++++++++++---- .../ocsf/gen/testdata/golden-merged/buf.lock | 6 +++ .../ocsf/gen/testdata/golden-merged/buf.yaml | 1 + .../golden-merged/ocsf/v1/audit_event.proto | 4 ++ 18 files changed, 189 insertions(+), 36 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 91941cb..3d0f551 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -91,7 +91,8 @@ jobs: --version 1.8.0 \ --out cmd/ocsf-protogen/testdata \ --tagmap cmd/ocsf-protogen/testdata/field-numbers.json \ - --merged-message AuditEvent + --merged-message AuditEvent \ + --merged-sr-subject redpanda.ocsf.audit-events-value # buf lint + build on the committed proto baseline. - name: buf lint (ocsf testdata) diff --git a/ocsf/README.md b/ocsf/README.md index 31f459e..fb9b45b 100644 --- a/ocsf/README.md +++ b/ocsf/README.md @@ -20,7 +20,9 @@ Two artifacts are the point of this module; two more keep them safe to evolve. carry wire-stable numbers from the tagmap and `buf.validate` annotations (required levels, plus class-aware CEL rules on the merged message), so protovalidate enforces OCSF semantics on every event before it is - published. + published. With `--merged-sr-subject`, the merged message also carries the + `(redpanda.api.common.v1.schema_registry)` annotation that drives + `protoc-gen-go-sr-normalize`. 2. **Generated Go code**, produced from those protos with `buf generate` and `protoc-gen-go`. The bindings committed under `internal/ocsf/conformance/genpb/` are the reference: `buf.gen.yaml` and @@ -81,8 +83,17 @@ go run ./cmd/ocsf-protogen \ - `--merged-message ` additionally emits the merged single-event layout (`ocsf/v/.proto`, and `.sr.proto` under `--sr-schema-out`). +- `--merged-sr-subject ` annotates the merged message with + `(redpanda.api.common.v1.schema_registry) = { subject: "..." }` (from + `buf.build/redpandadata/common`). Consumers that run + [`protoc-gen-go-sr-normalize`](../protoc-gen-go-sr-normalize) in their buf + pass then get the self-contained SR schema and subject as Go constants + (`SRSchema`, `SRSubject`) with no hand-copied proto. Requires + `--merged-message`. - `--sr-schema-out ` writes self-contained Schema-Registry schemas (no imports to resolve; register as-is, event message at Confluent index 0). + This is the non-buf path to the same schema text; Go consumers should + prefer the annotation plus `protoc-gen-go-sr-normalize`. - `--check` regenerates and fails on output drift or newly-stubbed objects. - `--compat-check --old --new ` fails if field numbers changed incompatibly between two tag maps (used in CI against the base branch). diff --git a/ocsf/cmd/ocsf-protogen/main.go b/ocsf/cmd/ocsf-protogen/main.go index bf53753..42cc966 100644 --- a/ocsf/cmd/ocsf-protogen/main.go +++ b/ocsf/cmd/ocsf-protogen/main.go @@ -22,7 +22,8 @@ // --version 1.8.0 \ // --out ocsf/cmd/ocsf-protogen/testdata \ // --tagmap ocsf/cmd/ocsf-protogen/testdata/field-numbers.json \ -// --merged-message AuditEvent +// --merged-message AuditEvent \ +// --merged-sr-subject redpanda.ocsf.audit-events-value // // --out is a MODULE ROOT DIRECTORY. Files are written under it at their // module-relative paths, e.g. /ocsf/v1/api_activity.proto, @@ -93,6 +94,7 @@ func run(args []string) error { newFlag := fs.String("new", "", "path to the PR tagmap JSON (for --compat-check)") srSchemaOutFlag := fs.String("sr-schema-out", "", "optional directory for self-contained Schema-Registry schemas (.sr.proto); empty disables SR emission") mergedMessageFlag := fs.String("merged-message", "", "optional message name (e.g. AuditEvent) for a single flat message unioning all selected classes, emitted alongside the per-class files; empty disables merged emission") + mergedSRSubjectFlag := fs.String("merged-sr-subject", "", "optional Schema Registry subject; annotates the merged message with (redpanda.api.common.v1.schema_registry) for protoc-gen-go-sr-normalize (requires --merged-message)") if err := fs.Parse(args); err != nil { return err @@ -127,14 +129,15 @@ func run(args []string) error { } cfg := protogen.Config{ - SchemaPath: *schemaFlag, - Classes: classes, - Version: *versionFlag, - OutDir: *outFlag, - TagmapPath: *tagmapFlag, - Check: *checkFlag, - SRSchemaOutDir: *srSchemaOutFlag, - MergedMessage: *mergedMessageFlag, + SchemaPath: *schemaFlag, + Classes: classes, + Version: *versionFlag, + OutDir: *outFlag, + TagmapPath: *tagmapFlag, + Check: *checkFlag, + SRSchemaOutDir: *srSchemaOutFlag, + MergedMessage: *mergedMessageFlag, + MergedSRSubject: *mergedSRSubjectFlag, } if cfg.Check { diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go index fe65890..b251e39 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -47,6 +47,11 @@ type Config struct { // When SRSchemaOutDir is also set, a merged .sr.proto is // written there too. Empty disables merged emission. MergedMessage string + // MergedSRSubject, when non-empty, annotates the merged message with the + // (redpanda.api.common.v1.schema_registry) option carrying this subject, + // so protoc-gen-go-sr-normalize generates the SR schema and subject + // constants from the emitted proto. Requires MergedMessage. + MergedSRSubject string } // Generate loads the schema, emits the proto, writes --out and --tagmap. @@ -108,10 +113,13 @@ func emitAll(s *schema.Schema, cfg Config, tm *tagmap.TagMap) (files []gen.Gener } if strings.TrimSpace(cfg.MergedMessage) == "" { + if strings.TrimSpace(cfg.MergedSRSubject) != "" { + return nil, nil, errors.New("--merged-sr-subject requires --merged-message") + } return files, stubbed, nil } - mergedFiles, mergedStubbed, err := gen.EmitMerged(s, cfg.Classes, tm, cfg.Version, cfg.MergedMessage) + mergedFiles, mergedStubbed, err := gen.EmitMerged(s, cfg.Classes, tm, cfg.Version, cfg.MergedMessage, cfg.MergedSRSubject) if err != nil { return nil, nil, fmt.Errorf("emit merged proto: %w", err) } diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go index 624b98a..ff64f8e 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -332,9 +332,11 @@ func TestCheckAgainstCommittedBaseline(t *testing.T) { TagmapPath: tagmapPath, Check: true, // The committed baseline includes the merged single-event layout - // (audit_event.proto); --check must be configured identically to the - // generation run (see the ocsf-checks CI job). - MergedMessage: "AuditEvent", + // (audit_event.proto) with the Schema-Registry annotation; --check must + // be configured identically to the generation run (see the ocsf-checks + // CI job). + MergedMessage: "AuditEvent", + MergedSRSubject: "redpanda.ocsf.audit-events-value", } err := protogen.Check(cfg) @@ -352,13 +354,14 @@ func TestGenerateMergedThenCheck(t *testing.T) { tagmapPath := filepath.Join(dir, "field-numbers.json") cfg := protogen.Config{ - SchemaPath: schemaFixture(), - Classes: []string{"api_activity", "entity_management"}, - Version: "1.8.0", - OutDir: dir, - TagmapPath: tagmapPath, - SRSchemaOutDir: srDir, - MergedMessage: "AuditEvent", + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + MergedMessage: "AuditEvent", + MergedSRSubject: "redpanda.ocsf.audit-events-value", } _, err := protogen.Generate(cfg) @@ -381,6 +384,22 @@ func TestGenerateMergedThenCheck(t *testing.T) { "--check must pass immediately after Generate on the same merged baseline") } +// TestGenerateSRSubjectRequiresMergedMessage verifies the flag dependency: +// --merged-sr-subject without --merged-message is a configuration error. +func TestGenerateSRSubjectRequiresMergedMessage(t *testing.T) { + dir := t.TempDir() + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: filepath.Join(dir, "field-numbers.json"), + MergedSRSubject: "redpanda.ocsf.audit-events-value", + } + _, err := protogen.Generate(cfg) + require.ErrorContains(t, err, "--merged-sr-subject requires --merged-message") +} + // TestCheckFailsWithoutMergedFlagOnMergedBaseline verifies that a baseline // generated WITH MergedMessage fails --check when the flag is omitted (the // merged file is then a stray), so CI cannot silently drop the merged layout. diff --git a/ocsf/cmd/ocsf-protogen/testdata/buf.lock b/ocsf/cmd/ocsf-protogen/testdata/buf.lock index 709ae02..0e50437 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/buf.lock +++ b/ocsf/cmd/ocsf-protogen/testdata/buf.lock @@ -4,3 +4,9 @@ deps: - name: buf.build/bufbuild/protovalidate commit: 50325440f8f24053b047484a6bf60b76 digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31 + - name: buf.build/googleapis/googleapis + commit: 004180b77378443887d3b55cabc00384 + digest: b5:e8f475fe3330f31f5fd86ac689093bcd274e19611a09db91f41d637cb9197881ce89882b94d13a58738e53c91c6e4bae7dc1feba85f590164c975a89e25115dc + - name: buf.build/redpandadata/common + commit: 6e06f84ad8234f5d9040a34f8c602fd4 + digest: b5:0563e29d0453fbe44363e88223651626d627fc61302a84ce26b1c67e787b937b136c6fd2549ee79e516c8e189e759e6387efac7081132953032c685921f3c780 diff --git a/ocsf/cmd/ocsf-protogen/testdata/buf.yaml b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml index 5e2f6a2..d54b860 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/buf.yaml +++ b/ocsf/cmd/ocsf-protogen/testdata/buf.yaml @@ -3,6 +3,7 @@ modules: - path: . deps: - buf.build/bufbuild/protovalidate + - buf.build/redpandadata/common lint: use: - STANDARD diff --git a/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto index 5527372..a0d5c6d 100644 --- a/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto +++ b/ocsf/cmd/ocsf-protogen/testdata/ocsf/v1/audit_event.proto @@ -8,8 +8,12 @@ package ocsf.v1; import "buf/validate/validate.proto"; import "google/protobuf/struct.proto"; import "ocsf/v1/objects.proto"; +import "redpanda/api/common/v1/schema_registry.proto"; message AuditEvent { + option (redpanda.api.common.v1.schema_registry) = { + subject: "redpanda.ocsf.audit-events-value" + }; option (buf.validate.message).cel = { id: "AuditEvent.type_uid", message: "type_uid must equal class_uid * 100 + activity_id", diff --git a/ocsf/go.mod b/ocsf/go.mod index 356bdad..d4415fa 100644 --- a/ocsf/go.mod +++ b/ocsf/go.mod @@ -4,6 +4,7 @@ go 1.24.3 require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 + buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 buf.build/go/protovalidate v1.2.0 github.com/stretchr/testify v1.11.1 google.golang.org/protobuf v1.36.11 diff --git a/ocsf/go.sum b/ocsf/go.sum index 5cd8f52..a394afd 100644 --- a/ocsf/go.sum +++ b/ocsf/go.sum @@ -1,5 +1,7 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg= buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= +buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 h1:AZVH8d9Xh0ar1BbxDiY+2urib65GfAcT8rPZfM++N/Q= +buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1/go.mod h1:3w7EzexwlL6PIFGbbeKZ0yHfUlAmI0aBVzF/QoFb8Cg= buf.build/go/protovalidate v1.2.0 h1:DQVrUWkmGTBij+kOYv/x2LLxwcLaGKMdzShj1/6/3H0= buf.build/go/protovalidate v1.2.0/go.mod h1:7rYiQEhqvAipoazpVNBBH2S2f8bjG4huMVy1V2Yofn4= cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4= diff --git a/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go index 8ee9227..33fd895 100644 --- a/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go +++ b/ocsf/internal/ocsf/conformance/genpb/ocsf/v1/audit_event.pb.go @@ -24,6 +24,7 @@ import ( unsafe "unsafe" _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + _ "buf.build/gen/go/redpandadata/common/protocolbuffers/go/redpanda/api/common/v1" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" structpb "google.golang.org/protobuf/types/known/structpb" @@ -1231,7 +1232,7 @@ var File_ocsf_v1_audit_event_proto protoreflect.FileDescriptor const file_ocsf_v1_audit_event_proto_rawDesc = "" + "\n" + - "\x19ocsf/v1/audit_event.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x15ocsf/v1/objects.proto\"\xe1;\n" + + "\x19ocsf/v1/audit_event.proto\x12\aocsf.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x15ocsf/v1/objects.proto\x1a,redpanda/api/common/v1/schema_registry.proto\"\x87<\n" + "\n" + "AuditEvent\x12\x1f\n" + "\vaccess_list\x18\x01 \x03(\tR\n" + @@ -1409,7 +1410,7 @@ const file_ocsf_v1_audit_event_proto_rawDesc = "" + "\x1aTYPE_UID_API_ACTIVITY_READ\x10\xee\xd1$\x12\"\n" + "\x1cTYPE_UID_API_ACTIVITY_UPDATE\x10\xef\xd1$\x12\"\n" + "\x1cTYPE_UID_API_ACTIVITY_DELETE\x10\xf0\xd1$\x12!\n" + - "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$:\x94\x0f\xbaH\x90\x0f\x1a\x82\x01\n" + + "\x1bTYPE_UID_API_ACTIVITY_OTHER\x10\xcf\xd2$:\xba\x0f\xbaH\x90\x0f\x1a\x82\x01\n" + "\x13AuditEvent.type_uid\x121type_uid must equal class_uid * 100 + activity_id\x1a8this.type_uid == this.class_uid * 100 + this.activity_id\x1a|\n" + "\x1aAuditEvent.own.access_list\x12,access_list is only valid for class_uid 3004\x1a0!has(this.access_list) || this.class_uid == 3004\x1a|\n" + "\x1aAuditEvent.own.access_mask\x12,access_mask is only valid for class_uid 3004\x1a0!has(this.access_mask) || this.class_uid == 3004\x1as\n" + @@ -1424,7 +1425,8 @@ const file_ocsf_v1_audit_event_proto_rawDesc = "" + "!AuditEvent.req.api_activity.actor\x127actor is required when class_uid == 6003 (api_activity)\x1a)this.class_uid != 6003 || has(this.actor)\x1a\x81\x01\n" + "\x1fAuditEvent.req.api_activity.api\x125api is required when class_uid == 6003 (api_activity)\x1a'this.class_uid != 6003 || has(this.api)\x1a\x9c\x01\n" + "(AuditEvent.req.api_activity.src_endpoint\x12>src_endpoint is required when class_uid == 6003 (api_activity)\x1a0this.class_uid != 6003 || has(this.src_endpoint)\x1a\x94\x01\n" + - "'AuditEvent.req.entity_management.entity\x12=entity is required when class_uid == 3004 (entity_management)\x1a*this.class_uid != 3004 || has(this.entity)b\x06proto3" + "'AuditEvent.req.entity_management.entity\x12=entity is required when class_uid == 3004 (entity_management)\x1a*this.class_uid != 3004 || has(this.entity)\x82\xc0\a\"\n" + + " redpanda.ocsf.audit-events-valueb\x06proto3" var ( file_ocsf_v1_audit_event_proto_rawDescOnce sync.Once diff --git a/ocsf/internal/ocsf/conformance/merged_test.go b/ocsf/internal/ocsf/conformance/merged_test.go index c9e6372..b677ab4 100644 --- a/ocsf/internal/ocsf/conformance/merged_test.go +++ b/ocsf/internal/ocsf/conformance/merged_test.go @@ -26,6 +26,7 @@ import ( "encoding/json" "testing" + commonv1 "buf.build/gen/go/redpandadata/common/protocolbuffers/go/redpanda/api/common/v1" protovalidate "buf.build/go/protovalidate" "github.com/stretchr/testify/require" "google.golang.org/protobuf/proto" @@ -254,6 +255,20 @@ func TestMergedProtovalidate(t *testing.T) { }) } +// TestMergedSRAnnotation proves the Schema-Registry annotation survives into +// the compiled descriptor exactly as protoc-gen-go-sr-normalize reads it: the +// (redpanda.api.common.v1.schema_registry) extension is present on AuditEvent +// with the generated subject. +func TestMergedSRAnnotation(t *testing.T) { + opts := (&ocsfv1.AuditEvent{}).ProtoReflect().Descriptor().Options() + require.True(t, proto.HasExtension(opts, commonv1.E_SchemaRegistry), + "AuditEvent must carry the schema_registry message option") + + sr, ok := proto.GetExtension(opts, commonv1.E_SchemaRegistry).(*commonv1.SchemaRegistryOptions) + require.True(t, ok) + require.Equal(t, "redpanda.ocsf.audit-events-value", sr.GetSubject()) +} + // TestMergedServerConformance validates the merged events' OCSF JSON against // the official OCSF validate endpoint, same contract as TestServerConformance. func TestMergedServerConformance(t *testing.T) { diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go index f94f976..58ce5f6 100644 --- a/ocsf/internal/ocsf/gen/emit.go +++ b/ocsf/internal/ocsf/gen/emit.go @@ -506,10 +506,16 @@ func resolveFieldSpec(s *schema.Schema, tm *tagmap.TagMap, msgName, attrName str // // extraCEL holds pre-rendered (buf.validate.message).cel option blocks emitted // after the constraint-derived ones. Suppressed when omitValidate is set. +// +// headOptions holds pre-rendered message-level option blocks emitted before +// everything else in the message body (e.g. the Schema-Registry annotation). +// Unlike extraCEL these are not tied to buf.validate; the SR-schema emitters +// simply never set them, keeping .sr.proto files self-contained. type emitOptions struct { omitValidate bool fieldComments map[string]string extraCEL []string + headOptions []string } // emitMessage generates one proto message block for the given message name, @@ -553,6 +559,10 @@ func emitMessage(s *schema.Schema, tm *tagmap.TagMap, msgName string, attrs map[ var sb strings.Builder sb.WriteString("message " + msgName + " {\n") + for _, opt := range opts.headOptions { + sb.WriteString(opt) + } + emitMessageCEL(&sb, msgName, constraints, opts) // Emit nested enums. diff --git a/ocsf/internal/ocsf/gen/emitmerged.go b/ocsf/internal/ocsf/gen/emitmerged.go index 44926cb..f3791ef 100644 --- a/ocsf/internal/ocsf/gen/emitmerged.go +++ b/ocsf/internal/ocsf/gen/emitmerged.go @@ -48,8 +48,16 @@ const demotedComment = "Class-scoped enum: value semantics depend on class_uid; // Object messages reuse their existing (object, attribute) keys, so object // tags are identical between Emit and EmitMerged output. // +// srSubject, when non-empty, annotates the merged message with +// (redpanda.api.common.v1.schema_registry) = { subject: "" } and +// imports redpanda/api/common/v1/schema_registry.proto, so +// protoc-gen-go-sr-normalize can generate the self-contained SR schema and +// subject constants alongside the standard Go bindings. Empty disables the +// annotation. The .sr.proto emitters never carry it: they must stay +// self-contained. +// // stubbed follows the same contract as Emit. -func EmitMerged(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version, msgName string) (files []GeneratedFile, stubbed []string, err error) { +func EmitMerged(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version, msgName, srSubject string) (files []GeneratedFile, stubbed []string, err error) { merged, err := MergeClasses(s, classNames, msgName) if err != nil { return nil, nil, err @@ -71,7 +79,7 @@ func EmitMerged(s *schema.Schema, classNames []string, tm *tagmap.TagMap, versio stubs := collectStubs(s, classes, objects) hasObjects := len(objects) > 0 || len(stubs) > 0 - classFile, err := emitMergedClassFile(s, tm, merged, version, pkgSuffix, dir, hasObjects) + classFile, err := emitMergedClassFile(s, tm, merged, version, pkgSuffix, dir, hasObjects, srSubject) if err != nil { return nil, nil, err } @@ -167,12 +175,31 @@ func EmitMergedSRSchema(s *schema.Schema, classNames []string, tm *tagmap.TagMap return GeneratedFile{Path: msgFileBase(msgName) + ".sr.proto", Content: content}, nil } +// srSchemaImport is the import that provides the +// (redpanda.api.common.v1.schema_registry) message option. Resolved from +// buf.build/redpandadata/common at build time. +const srSchemaImport = `import "redpanda/api/common/v1/schema_registry.proto";` + +// srSubjectOption renders the Schema-Registry message option consumed by +// protoc-gen-go-sr-normalize. +func srSubjectOption(subject string) string { + return fmt.Sprintf( + " option (redpanda.api.common.v1.schema_registry) = {\n"+ + " subject: %q\n"+ + " };\n", + subject, + ) +} + // emitMergedClassFile builds the proto file holding the merged event message. -func emitMergedClassFile(s *schema.Schema, tm *tagmap.TagMap, merged *Merged, version, pkgSuffix, dir string, hasObjects bool) (GeneratedFile, error) { +func emitMergedClassFile(s *schema.Schema, tm *tagmap.TagMap, merged *Merged, version, pkgSuffix, dir string, hasObjects bool, srSubject string) (GeneratedFile, error) { opts := emitOptions{ fieldComments: demotedFieldComments(merged), extraCEL: mergedCEL(merged), } + if srSubject != "" { + opts.headOptions = append(opts.headOptions, srSubjectOption(srSubject)) + } msg, err := emitMessage(s, tm, merged.Name, merged.Attributes, nil, opts) if err != nil { @@ -193,6 +220,9 @@ func emitMergedClassFile(s *schema.Schema, tm *tagmap.TagMap, merged *Merged, ve if needValidate { imports = append(imports, `import "buf/validate/validate.proto";`) } + if srSubject != "" { + imports = append(imports, srSchemaImport) + } content := fileHeader(version, pkgSuffix) + importBlock(imports) + msg + "\n" return GeneratedFile{Path: dir + "/" + msgFileBase(merged.Name) + ".proto", Content: content}, nil diff --git a/ocsf/internal/ocsf/gen/emitmerged_test.go b/ocsf/internal/ocsf/gen/emitmerged_test.go index a1c9f88..b1d91b9 100644 --- a/ocsf/internal/ocsf/gen/emitmerged_test.go +++ b/ocsf/internal/ocsf/gen/emitmerged_test.go @@ -28,6 +28,7 @@ const ( mergedGoldenDir = "testdata/golden-merged" mergedSRGoldenDir = "testdata/golden-merged/sr" mergedMsgName = "AuditEvent" + mergedSRSubject = "redpanda.ocsf.audit-events-value" ) // emitMergedJoined runs EmitMerged and concatenates the generated files in @@ -36,7 +37,7 @@ func emitMergedJoined(t *testing.T, classNames []string) string { t.Helper() s := loadFixture(t) tm := tagmap.New() - files, _, err := gen.EmitMerged(s, classNames, tm, "1.8.0", mergedMsgName) + files, _, err := gen.EmitMerged(s, classNames, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) var sb strings.Builder for _, f := range files { @@ -52,7 +53,7 @@ func TestEmitMerged_Golden(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - files, stubbed, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + files, stubbed, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) require.Empty(t, stubbed, "full 1.8.0 snapshot must not produce stubs") require.Len(t, files, 2) @@ -94,7 +95,7 @@ func TestEmitMerged_Paths(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) paths := []string{files[0].Path, files[1].Path} @@ -107,7 +108,7 @@ func TestEmitMerged_SingleMessage(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) var classFile string @@ -200,7 +201,7 @@ func TestEmitMerged_TagStability(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - _, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + _, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) // Record every AuditEvent tag after the first run. Assign is idempotent, @@ -217,7 +218,7 @@ func TestEmitMerged_TagStability(t *testing.T) { // Second run with an additional class (authentication conflicts with // api_activity on activity_id, exercising demotion too). wider := append([]string{"authentication"}, mergedClasses...) - _, _, err = gen.EmitMerged(s, wider, tm, "1.8.0", mergedMsgName) + _, _, err = gen.EmitMerged(s, wider, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) for name, want := range before { @@ -238,8 +239,35 @@ func TestEmitMerged_ConflictingClassDemotes(t *testing.T) { require.Contains(t, content, "CLASS_UID_AUTHENTICATION = 3002") } +// TestEmitMerged_SRSubjectAnnotation verifies the Schema-Registry message +// option and its import are emitted when a subject is provided, and absent +// when it is empty. +func TestEmitMerged_SRSubjectAnnotation(t *testing.T) { + s := loadFixture(t) + + files, _, err := gen.EmitMerged(s, mergedClasses, tagmap.New(), "1.8.0", mergedMsgName, mergedSRSubject) + require.NoError(t, err) + var classFile string + for _, f := range files { + if strings.HasSuffix(f.Path, "audit_event.proto") { + classFile = f.Content + } + } + require.Contains(t, classFile, `import "redpanda/api/common/v1/schema_registry.proto";`) + require.Contains(t, classFile, "option (redpanda.api.common.v1.schema_registry) = {") + require.Contains(t, classFile, `subject: "redpanda.ocsf.audit-events-value"`) + + // Empty subject: no annotation, no import. + bare, _, err := gen.EmitMerged(s, mergedClasses, tagmap.New(), "1.8.0", mergedMsgName, "") + require.NoError(t, err) + for _, f := range bare { + require.NotContains(t, f.Content, "schema_registry") + } +} + // TestEmitMergedSRSchema_Shape verifies the SR schema: merged message first, -// self-contained, no buf.validate anywhere. +// self-contained, no buf.validate anywhere, and no Schema-Registry annotation +// (the .sr.proto must not depend on redpanda/api/common options). func TestEmitMergedSRSchema_Shape(t *testing.T) { s := loadFixture(t) tm := tagmap.New() @@ -250,6 +278,7 @@ func TestEmitMergedSRSchema_Shape(t *testing.T) { require.Equal(t, "audit_event.sr.proto", f.Path) require.NotContains(t, f.Content, "buf.validate") require.NotContains(t, f.Content, `import "ocsf/`) + require.NotContains(t, f.Content, "schema_registry") // Merged message must be the FIRST message (Confluent index 0). firstMsg := strings.Index(f.Content, "message ") @@ -264,7 +293,7 @@ func TestEmitMergedSRSchema_FieldNumberParity(t *testing.T) { s := loadFixture(t) tm := tagmap.New() - files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName) + files, _, err := gen.EmitMerged(s, mergedClasses, tm, "1.8.0", mergedMsgName, mergedSRSubject) require.NoError(t, err) srFile, err := gen.EmitMergedSRSchema(s, mergedClasses, tm, "1.8.0", mergedMsgName) require.NoError(t, err) diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock index 709ae02..0e50437 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.lock @@ -4,3 +4,9 @@ deps: - name: buf.build/bufbuild/protovalidate commit: 50325440f8f24053b047484a6bf60b76 digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31 + - name: buf.build/googleapis/googleapis + commit: 004180b77378443887d3b55cabc00384 + digest: b5:e8f475fe3330f31f5fd86ac689093bcd274e19611a09db91f41d637cb9197881ce89882b94d13a58738e53c91c6e4bae7dc1feba85f590164c975a89e25115dc + - name: buf.build/redpandadata/common + commit: 6e06f84ad8234f5d9040a34f8c602fd4 + digest: b5:0563e29d0453fbe44363e88223651626d627fc61302a84ce26b1c67e787b937b136c6fd2549ee79e516c8e189e759e6387efac7081132953032c685921f3c780 diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml index 3c34751..d5a7411 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/buf.yaml @@ -9,6 +9,7 @@ modules: - sr deps: - buf.build/bufbuild/protovalidate + - buf.build/redpandadata/common lint: use: - STANDARD diff --git a/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto index 5527372..a0d5c6d 100644 --- a/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto +++ b/ocsf/internal/ocsf/gen/testdata/golden-merged/ocsf/v1/audit_event.proto @@ -8,8 +8,12 @@ package ocsf.v1; import "buf/validate/validate.proto"; import "google/protobuf/struct.proto"; import "ocsf/v1/objects.proto"; +import "redpanda/api/common/v1/schema_registry.proto"; message AuditEvent { + option (redpanda.api.common.v1.schema_registry) = { + subject: "redpanda.ocsf.audit-events-value" + }; option (buf.validate.message).cel = { id: "AuditEvent.type_uid", message: "type_uid must equal class_uid * 100 + activity_id", From 275f7e6f753d19109fd43ff838b2694be7c2e660 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 20:42:21 +0200 Subject: [PATCH 22/26] test(ocsf): extend adversarial coverage of the JSON round-trip Exporter/importer scenarios added: - Unicode escapes: escaped JSON keys must resolve to proto fields, surrogate pairs round-trip, and a lone surrogate (which encoding/json replaces with U+FFFD) must decode to valid UTF-8 and re-export cleanly. - Document-level oddities: BOM prefix, comments, and concatenated JSON documents are rejected; exotic-whitespace documents parse. - More number formats: -0 into int64, float-valued enums (5.0) rejected rather than coerced, float64 overflow (1e309) errors instead of becoming +Inf, plus-sign/hex/NaN/Infinity literals rejected. - Presence semantics pinned: implicit-presence zeros are accepted on import and canonicalized away on export; explicit-presence (optional) empty values keep byte-exact round-trips. - 1000-deep array nesting, backslash added to the mutation sweep, a concurrent round-trip smoke test for the race detector, and new fuzz seeds for all of the above. Conformance (real AuditEvent) scenarios added: - unmapped stress: 500+ hostile unknown keys (empty, unicode, quoted, 4 KiB names) all land in unmapped and stay idempotent. - unmapped conflict semantics pinned: non-object unmapped plus unknown keys errors; top-level unknown keys win over duplicate entries in an explicit unmapped object; scalar unmapped without unknowns decodes. - Importer-to-CEL loop: hostile-but-well-formed JSON (foreign-class field, type_uid mismatch, missing class-required field) must DECODE losslessly and then fail protovalidate on exactly the right generated rule, asserted via structured violation rule ids rather than error text. The empty event decodes, exports back to {}, and fails blanket-required validation. - Property test variant splicing random unknown keys into random events: decode, unmapped population, and post-splice idempotence. Suite passes under -race; fuzz targets re-run clean on the extended seed corpus. Co-Authored-By: Claude Fable 5 --- .../ocsf/conformance/adversarial_test.go | 189 ++++++++++++++++ .../ocsf/exporter/adversarial_test.go | 207 +++++++++++++++++- 2 files changed, 395 insertions(+), 1 deletion(-) diff --git a/ocsf/internal/ocsf/conformance/adversarial_test.go b/ocsf/internal/ocsf/conformance/adversarial_test.go index 488b75a..dfe7fe4 100644 --- a/ocsf/internal/ocsf/conformance/adversarial_test.go +++ b/ocsf/internal/ocsf/conformance/adversarial_test.go @@ -13,9 +13,12 @@ package conformance_test import ( + "encoding/json" + "fmt" "strings" "testing" + protovalidate "buf.build/go/protovalidate" "github.com/stretchr/testify/require" "google.golang.org/protobuf/proto" @@ -120,6 +123,134 @@ func TestAdversarial_NullUnmappedWithUnknownKeys(t *testing.T) { require.Equal(t, float64(1), un.Fields["future_attr"].GetNumberValue()) } +// TestAdversarial_UnmappedStress floods an event with hostile unknown keys: +// all must land in unmapped, survive re-export, and stay idempotent. +func TestAdversarial_UnmappedStress(t *testing.T) { + b, err := exporter.ToOCSFJSON(buildMergedApiActivityAllowed()) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + hostileKeys := []string{ + "", "ünïcødé🔑", `key"with"quotes`, "key.with.dots", "key with spaces", + "UPPER_SNAKE", "0numeric", strings.Repeat("k", 4096), + } + for _, k := range hostileKeys { + m["x_"+k] = k // prefix avoids the empty-key collision with itself + } + for i := range 500 { + m[fmt.Sprintf("future_%d", i)] = i + } + spliced, err := json.Marshal(m) + require.NoError(t, err) + + var evt ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(spliced, &evt)) + un := evt.Unmapped.GetStructValue() + require.NotNil(t, un) + require.Len(t, un.Fields, 500+len(hostileKeys), "every unknown key must land in unmapped") + + // Idempotence from here on: export → import → export byte-identical. + b1, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + var again ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(b1, &again)) + b2, err := exporter.ToOCSFJSON(&again) + require.NoError(t, err) + require.Equal(t, string(b1), string(b2)) +} + +// TestAdversarial_UnmappedConflicts pins the unmapped merge semantics when +// the input carries its own unmapped value alongside unknown keys. +func TestAdversarial_UnmappedConflicts(t *testing.T) { + t.Run("NonObjectUnmappedErrors", func(t *testing.T) { + for _, unmapped := range []string{`"a string"`, `[1,2]`, `42`, `true`} { + var evt ocsfv1.AuditEvent + payload := []byte(`{"class_uid":6003,"unmapped":` + unmapped + `,"future_attr":1}`) + require.NotPanics(t, func() { + require.Error(t, exporter.FromOCSFJSON(payload, &evt), + "non-object unmapped %s cannot absorb unknown keys", unmapped) + }) + } + }) + + t.Run("UnknownKeyWinsOverExplicitUnmapped", func(t *testing.T) { + // Both the explicit unmapped object and the top level carry "a": the + // top-level unknown key wins (it is the newer OCSF-side signal). + var evt ocsfv1.AuditEvent + payload := []byte(`{"unmapped":{"a":1,"keep":true},"a":2}`) + require.NoError(t, exporter.FromOCSFJSON(payload, &evt)) + un := evt.Unmapped.GetStructValue() + require.NotNil(t, un) + require.Equal(t, float64(2), un.Fields["a"].GetNumberValue()) + require.True(t, un.Fields["keep"].GetBoolValue(), "existing unmapped entries must survive the merge") + }) + + t.Run("NonObjectUnmappedWithoutUnknownKeysIsFine", func(t *testing.T) { + // A scalar unmapped with no unknown keys to merge decodes verbatim. + var evt ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"unmapped":"raw"}`), &evt)) + require.Equal(t, "raw", evt.Unmapped.GetStringValue()) + }) +} + +// TestAdversarial_DecodesButFailsValidation closes the loop between the +// importer and the generated CEL: hostile-but-well-formed JSON must decode +// losslessly (the importer's job) and then be rejected by protovalidate with +// the RIGHT rule (the generator's job). Rejecting at decode time would be +// wrong; the class semantics live in validation. +func TestAdversarial_DecodesButFailsValidation(t *testing.T) { + validator, err := protovalidate.New() + require.NoError(t, err) + + base, err := exporter.ToOCSFJSON(buildMergedApiActivityAllowed()) + require.NoError(t, err) + + splice := func(t *testing.T, mutate func(map[string]any)) *ocsfv1.AuditEvent { + t.Helper() + var m map[string]any + require.NoError(t, json.Unmarshal(base, &m)) + mutate(m) + payload, err := json.Marshal(m) + require.NoError(t, err) + var evt ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(payload, &evt), "well-formed JSON must decode") + return &evt + } + + t.Run("ForeignClassFieldViaJSON", func(t *testing.T) { + evt := splice(t, func(m map[string]any) { + m["entity"] = map[string]any{"uid": "policy:x", "name": "x"} // 3004-owned on a 6003 event + }) + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.own.entity") + }) + + t.Run("TypeUIDMismatchViaJSON", func(t *testing.T) { + evt := splice(t, func(m map[string]any) { + m["type_uid"] = float64(600301) // Create, but activity_id stays Read + }) + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.type_uid") + }) + + t.Run("MissingClassRequiredViaJSON", func(t *testing.T) { + evt := splice(t, func(m map[string]any) { + delete(m, "actor") // required for 6003 via conditional CEL + }) + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.req.api_activity.actor") + }) + + t.Run("EmptyEventFailsBlanketRequired", func(t *testing.T) { + var evt ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{}`), &evt)) + require.Error(t, validator.Validate(&evt), "the zero event must fail required-field validation") + + // And {} round-trips byte-identically. + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + require.Equal(t, "{}", string(b)) + }) +} + // TestAdversarial_RandomizedAuditEvents is the property smoke test on the // merged message: seeded random events across BOTH classes must round-trip // proto → JSON → proto losslessly and JSON → proto → JSON byte-identically. @@ -146,6 +277,49 @@ func TestAdversarial_RandomizedAuditEvents(t *testing.T) { } } +// TestAdversarial_RandomizedWithUnknownKeys extends the property test with +// OCSF forward-compat noise: random events plus random unknown keys spliced +// into their JSON must decode (unknowns into unmapped) and then round-trip +// idempotently. +func TestAdversarial_RandomizedWithUnknownKeys(t *testing.T) { + const iterations = 100 + rng := newConformanceRand(0xF0DDE12) + + for i := range iterations { + b, err := exporter.ToOCSFJSON(randomAuditEvent(rng)) + require.NoError(t, err) + + var m map[string]any + require.NoError(t, json.Unmarshal(b, &m)) + if _, hasUnmapped := m["unmapped"]; hasUnmapped { + continue // generator never sets unmapped today; guard anyway + } + nKeys := 1 + rng.intn(5) + for k := range nKeys { + m[fmt.Sprintf("future_%d_%d", i, k)] = rng.str() + } + spliced, err := json.Marshal(m) + require.NoError(t, err) + + var evt ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(spliced, &evt), + "iteration %d: spliced JSON must decode", i) + require.NotNil(t, evt.Unmapped, "iteration %d: unknown keys must land in unmapped", i) + require.Len(t, evt.Unmapped.GetStructValue().GetFields(), nKeys) + + b1, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + var again ocsfv1.AuditEvent + require.NoError(t, exporter.FromOCSFJSON(b1, &again)) + require.True(t, proto.Equal(&evt, &again), + "iteration %d: post-splice round-trip must be lossless", i) + b2, err := exporter.ToOCSFJSON(&again) + require.NoError(t, err) + require.Equal(t, string(b1), string(b2), + "iteration %d: post-splice export must be idempotent", i) + } +} + // FuzzFromOCSFJSON_AuditEvent fuzzes the importer against the real merged // message. Seed corpus includes full exported events of both classes; the // invariant is the same as the sample fuzz target: no panic, and decodable @@ -182,6 +356,21 @@ func FuzzFromOCSFJSON_AuditEvent(f *testing.F) { }) } +// requireViolatedRule asserts err is a protovalidate ValidationError carrying +// a violation of exactly the named CEL rule id. This pins the failure to the +// specific generated rule instead of matching any error text. +func requireViolatedRule(t *testing.T, err error, ruleID string) { + t.Helper() + require.Error(t, err) + var verr *protovalidate.ValidationError + require.ErrorAs(t, err, &verr, "error must be a protovalidate ValidationError") + ids := make([]string, 0, len(verr.Violations)) + for _, v := range verr.Violations { + ids = append(ids, v.Proto.GetRuleId()) + } + require.Contains(t, ids, ruleID, "expected rule %q among violations %v", ruleID, ids) +} + // ─── Randomized AuditEvent generator ───────────────────────────────────────── // conformanceRand is a deterministic xorshift64* PRNG for reproducible diff --git a/ocsf/internal/ocsf/exporter/adversarial_test.go b/ocsf/internal/ocsf/exporter/adversarial_test.go index 9bcdadb..dd41a00 100644 --- a/ocsf/internal/ocsf/exporter/adversarial_test.go +++ b/ocsf/internal/ocsf/exporter/adversarial_test.go @@ -17,7 +17,9 @@ import ( "fmt" "math" "strings" + "sync" "testing" + "unicode/utf8" "github.com/stretchr/testify/require" "google.golang.org/protobuf/proto" @@ -328,7 +330,7 @@ func TestFromOCSFJSON_MutationSweep(t *testing.T) { b, err := exporter.ToOCSFJSON(fullSample(t)) require.NoError(t, err) - for _, hostile := range []byte{'{', '}', '[', ']', '"', ',', ':', 0x00} { + for _, hostile := range []byte{'{', '}', '[', ']', '"', ',', ':', '\\', 0x00} { for i := range b { mutated := append([]byte(nil), b...) if mutated[i] == hostile { @@ -349,6 +351,203 @@ func TestFromOCSFJSON_MutationSweep(t *testing.T) { } } +// TestFromOCSFJSON_UnicodeEscapes probes JSON escape handling in keys and +// values. +func TestFromOCSFJSON_UnicodeEscapes(t *testing.T) { + t.Run("EscapedKeyResolvesToField", func(t *testing.T) { + // "time" unescapes to "time": it must set the field, not land in + // unknown keys. + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"tim\u0065":42}`), &evt)) + require.Equal(t, int64(42), evt.Time) + }) + + t.Run("ValidSurrogatePair", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"message_text":"😀"}`), &evt)) + require.Equal(t, "😀", evt.MessageText) + + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + var again samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &again)) + require.True(t, proto.Equal(&evt, &again)) + }) + + t.Run("LoneSurrogate", func(t *testing.T) { + // encoding/json replaces a lone surrogate with U+FFFD. That input is + // not byte-round-trippable by definition; what matters is that the + // decode result is valid UTF-8 and re-exports cleanly. + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + if err := exporter.FromOCSFJSON([]byte(`{"message_text":"\ud800"}`), &evt); err == nil { + require.True(t, utf8.ValidString(evt.MessageText), + "decoded lone surrogate must be replaced with valid UTF-8") + _, exportErr := exporter.ToOCSFJSON(&evt) + require.NoError(t, exportErr) + } + }) + }) +} + +// TestFromOCSFJSON_ExoticDocuments covers document-level oddities: BOM, +// unusual whitespace, comments, concatenated documents. +func TestFromOCSFJSON_ExoticDocuments(t *testing.T) { + t.Run("BOMPrefix", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte("\xef\xbb\xbf{\"time\":1}"), &evt), + "a UTF-8 BOM is not valid JSON and must be rejected") + }) + + t.Run("ExoticWhitespace", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte("\r\n\t {\r\n\t\"time\" :\t1 ,\n\"count\": 2\r}\n"), &evt)) + require.Equal(t, int64(1), evt.Time) + require.Equal(t, int32(2), evt.Count) + }) + + t.Run("Comments", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{/*c*/"time":1}`), &evt)) + require.Error(t, exporter.FromOCSFJSON([]byte("{\"time\":1} // trailing"), &evt)) + }) + + t.Run("ConcatenatedDocuments", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":1}{"time":2}`), &evt), + "trailing second document must be rejected, not silently ignored") + }) +} + +// TestFromOCSFJSON_MoreNumberFormats extends the numeric-edge coverage with +// JSON-spec oddities. +func TestFromOCSFJSON_MoreNumberFormats(t *testing.T) { + t.Run("NegativeZeroInt", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"time":-0}`), &evt)) + require.Zero(t, evt.Time) + }) + + t.Run("FloatValuedEnum", func(t *testing.T) { + // 5.0 is numerically 5 but not an integer literal; OCSF enums are + // integers, so this is rejected rather than silently coerced. + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"severity_id":5.0}`), &evt)) + }) + + t.Run("DoubleOverflow", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + require.Error(t, exporter.FromOCSFJSON([]byte(`{"score":1e309}`), &evt), + "a float64 out-of-range literal must error, not become +Inf") + }) + }) + + t.Run("ExponentIntoDouble", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"score":1.5e2}`), &evt)) + require.Equal(t, 150.0, evt.Score) + }) + + t.Run("PlusSign", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":+1}`), &evt)) + }) + + t.Run("HexLiteral", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"time":0x10}`), &evt)) + }) + + t.Run("BareNaNLiterals", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"score":NaN}`), &evt)) + require.Error(t, exporter.FromOCSFJSON([]byte(`{"score":Infinity}`), &evt)) + }) +} + +// TestFromOCSFJSON_ExplicitZerosCanonicalize documents the canonical-form +// contract for proto3 implicit-presence fields: explicit zero values are +// accepted on import but omitted on export (the exporter emits set fields +// only), so JSON→proto→JSON byte-identity holds exactly for canonical inputs. +func TestFromOCSFJSON_ExplicitZerosCanonicalize(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON( + []byte(`{"count":0,"is_alert":false,"message_text":"","time":1}`), &evt)) + require.True(t, proto.Equal(&samplev1.SampleEvent{Time: 1}, &evt), + "explicit zeros must decode to the zero value") + + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + require.Equal(t, `{"time":1}`, string(b), + "re-export must canonicalize: implicit-presence zeros are omitted") +} + +// TestFromOCSFJSON_OptionalPresenceRoundTrip verifies explicit-presence +// (optional) fields keep the set-to-zero vs absent distinction through both +// directions. +func TestFromOCSFJSON_OptionalPresenceRoundTrip(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"note":""}`), &evt)) + require.NotNil(t, evt.Note, "optional field set to empty string must have presence") + require.Empty(t, *evt.Note) + + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + require.Equal(t, `{"note":""}`, string(b), + "present-but-empty optional must survive export") + + var again samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &again)) + require.True(t, proto.Equal(&evt, &again)) +} + +// TestFromOCSFJSON_DeepArrayNesting mirrors the deep-object test with arrays. +func TestFromOCSFJSON_DeepArrayNesting(t *testing.T) { + const depth = 1000 + payload := `{"metadata":` + strings.Repeat(`[`, depth) + `1` + strings.Repeat(`]`, depth) + `}` + + var evt samplev1.SampleEvent + require.NotPanics(t, func() { + if err := exporter.FromOCSFJSON([]byte(payload), &evt); err == nil { + _, exportErr := exporter.ToOCSFJSON(&evt) + require.NoError(t, exportErr) + } + }) +} + +// TestRoundTrip_Concurrent exercises the exporter and importer from many +// goroutines to surface shared-state bugs under the race detector. +func TestRoundTrip_Concurrent(t *testing.T) { + const goroutines = 8 + var wg sync.WaitGroup + for g := range goroutines { + wg.Add(1) + go func() { + defer wg.Done() + rng := newSeededRand(uint64(g) + 1) + for range 50 { + original := randomSampleEvent(t, rng) + b, err := exporter.ToOCSFJSON(original) + if err != nil { + t.Errorf("goroutine %d: export: %v", g, err) + return + } + var decoded samplev1.SampleEvent + if err := exporter.FromOCSFJSON(b, &decoded); err != nil { + t.Errorf("goroutine %d: import: %v", g, err) + return + } + if !proto.Equal(original, &decoded) { + t.Errorf("goroutine %d: round-trip mismatch", g) + return + } + } + }() + } + wg.Wait() +} + // TestRoundTrip_RandomizedEvents is the property-based smoke test: many // randomized (seeded, reproducible) events must round-trip proto → JSON → // proto losslessly and JSON → proto → JSON byte-identically. @@ -402,6 +601,12 @@ func FuzzFromOCSFJSON(f *testing.F) { `null`, `{"a":`, "{\"ti\x00me\":1}", + `{"message_text":"\ud800"}`, // lone surrogate + "\xef\xbb\xbf{\"time\":1}", // BOM prefix + `{"score":1e309}`, // float64 overflow + `{"time":1}{"time":2}`, // concatenated documents + `{"tim\u0065":42,"not\u0065":"x"}`, // escaped keys + `{"count":-0,"severity_id":5.0}`, // negative zero + float enum } // A real exported event as a seed. full := &samplev1.SampleEvent{ From 81cdf43a36c87d4c08b8bbdf22924d4bd5d2112e Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 20:50:12 +0200 Subject: [PATCH 23/26] test(ocsf): close coverage gaps found by test review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Findings from a dedicated test-coverage review, in priority order: - Six proto field kinds (map, bytes, float, uint32/64, fixed, sint) had zero reachability anywhere in the module: OCSF's type system never produces them, but ToOCSFJSON/FromOCSFJSON are documented generic over proto.Message. The sample fixture now declares all of them, the randomized generator populates them, and dedicated cases cover base64 round-trip and malformed input, uint64/fixed32 bounds and overflow, negative-into-unsigned, sint64 extremes, float32 quantization, hostile map keys, null/mistyped map values, duplicate-key semantics, and key-sorted deterministic map export. - Tag stability is now proven across a real on-disk tagmap save/load cycle with a widened class set (the exact --compat-check workflow), including tagmap.CheckCompat on the persisted maps; the previous test only covered one in-memory tagmap. - New genpb sync guard: field name→tag maps parsed from the committed golden protos must equal the compiled descriptors of the committed Go bindings, so editing a golden without regenerating genpb can no longer leave conformance tests passing against stale bindings. - The string-keyed and mixed-kind branches of the enum union in MergeClasses (previously dead in tests) get conflict, union, and kind-mismatch cases. - TestMergedProtovalidate now asserts structured violation rule ids instead of error-text substrings, matching the adversarial suite. - SR subjects are validated against [A-Za-z0-9._-] at emit time instead of trusting Go %q escaping to be proto-literal-legal for exotic input, with hostile-subject rejection tests. Co-Authored-By: Claude Fable 5 --- .../ocsf/conformance/genpb_sync_test.go | 121 ++++++++++++++++ ocsf/internal/ocsf/conformance/merged_test.go | 9 +- .../ocsf/exporter/adversarial_test.go | 136 ++++++++++++++++++ ocsf/internal/ocsf/exporter/importer_test.go | 6 + .../exporter/testdata/sample/sample.pb.go | 92 ++++++++++-- .../exporter/testdata/sample/sample.proto | 22 +++ ocsf/internal/ocsf/gen/emitmerged.go | 22 +++ ocsf/internal/ocsf/gen/emitmerged_test.go | 82 ++++++++++- ocsf/internal/ocsf/gen/merge_test.go | 70 +++++++++ 9 files changed, 535 insertions(+), 25 deletions(-) create mode 100644 ocsf/internal/ocsf/conformance/genpb_sync_test.go diff --git a/ocsf/internal/ocsf/conformance/genpb_sync_test.go b/ocsf/internal/ocsf/conformance/genpb_sync_test.go new file mode 100644 index 0000000..4af4eed --- /dev/null +++ b/ocsf/internal/ocsf/conformance/genpb_sync_test.go @@ -0,0 +1,121 @@ +// Copyright 2026 Redpanda Data, Inc. +// +// Use of this software is governed by the Business Source License +// included in the file licenses/BSL.md +// +// As of the Change Date specified in that file, in accordance with +// the Business Source License, use of this software will be governed +// by the Apache License, Version 2.0 + +package conformance_test + +import ( + "os" + "path/filepath" + "regexp" + "strings" + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" + + ocsfv1 "github.com/redpanda-data/common-go/ocsf/internal/ocsf/conformance/genpb/ocsf/v1" +) + +// TestGenPBInSyncWithGolden guards the manual `buf generate` step that +// produces the committed genpb bindings: for each event message, every field +// (name and tag) in the compiled descriptor must match the committed golden +// .proto exactly. Without this, editing a golden and forgetting to regenerate +// genpb would leave every conformance test passing against STALE bindings. +func TestGenPBInSyncWithGolden(t *testing.T) { + cases := []struct { + goldenPath string + msgName string + msg proto.Message + }{ + {"../gen/testdata/golden-merged/ocsf/v1/audit_event.proto", "AuditEvent", &ocsfv1.AuditEvent{}}, + {"../gen/testdata/golden/ocsf/v1/api_activity.proto", "ApiActivity", &ocsfv1.ApiActivity{}}, + {"../gen/testdata/golden/ocsf/v1/entity_management.proto", "EntityManagement", &ocsfv1.EntityManagement{}}, + } + + for _, tc := range cases { + t.Run(tc.msgName, func(t *testing.T) { + goldenTags := parseGoldenFieldTags(t, tc.goldenPath, tc.msgName) + require.NotEmpty(t, goldenTags) + + fields := tc.msg.ProtoReflect().Descriptor().Fields() + descTags := make(map[string]int32, fields.Len()) + for i := range fields.Len() { + fd := fields.Get(i) + descTags[string(fd.Name())] = int32(fd.Number()) + } + + require.Equal(t, goldenTags, descTags, + "genpb bindings are out of sync with %s — run `buf generate` with the genpb templates and commit the diff", + tc.goldenPath) + }) + } +} + +// TestGenPBObjectsInSyncWithGolden extends the sync guard to a load-bearing +// shared object (Metadata) from objects.proto, so a stale objects.pb.go is +// caught too. +func TestGenPBObjectsInSyncWithGolden(t *testing.T) { + goldenTags := parseGoldenFieldTags(t, "../gen/testdata/golden/ocsf/v1/objects.proto", "Metadata") + require.NotEmpty(t, goldenTags) + + fields := (&ocsfv1.Metadata{}).ProtoReflect().Descriptor().Fields() + descTags := make(map[string]int32, fields.Len()) + for i := range fields.Len() { + fd := fields.Get(i) + descTags[string(fd.Name())] = int32(fd.Number()) + } + require.Equal(t, goldenTags, descTags, + "genpb objects.pb.go is out of sync with the golden objects.proto") +} + +// fieldLineRE matches a proto field declaration line inside a message body: +// optional "repeated", a type name (possibly dotted), a snake_case field +// name, and the tag. Options in [...] and trailing comments are tolerated. +var fieldLineRE = regexp.MustCompile(`^\s*(?:repeated\s+)?[A-Za-z0-9_.]+\s+([a-z0-9_]+)\s*=\s*(\d+)\s*[;\[]`) + +// parseGoldenFieldTags extracts field name -> tag from the named top-level +// message in a golden .proto file. +func parseGoldenFieldTags(t *testing.T, path, msgName string) map[string]int32 { + t.Helper() + raw, err := os.ReadFile(filepath.Clean(path)) + require.NoError(t, err, "golden proto %s must be readable", path) + + content := string(raw) + start := strings.Index(content, "message "+msgName+" {") + require.GreaterOrEqual(t, start, 0, "message %s not found in %s", msgName, path) + end := strings.Index(content[start:], "\n}\n") + require.GreaterOrEqual(t, end, 0) + body := content[start : start+end] + + tags := make(map[string]int32) + depth := 0 + for line := range strings.SplitSeq(body, "\n") { + trimmed := strings.TrimSpace(line) + // Skip nested enum bodies and option blocks. + if strings.HasPrefix(trimmed, "enum ") || strings.HasPrefix(trimmed, "option ") { + depth++ + } + if depth > 0 { + if strings.HasSuffix(trimmed, "}") || strings.HasSuffix(trimmed, "};") { + depth-- + } + continue + } + m := fieldLineRE.FindStringSubmatch(line) + if m == nil { + continue + } + var tag int32 + for _, c := range m[2] { + tag = tag*10 + c - '0' + } + tags[m[1]] = tag + } + return tags +} diff --git a/ocsf/internal/ocsf/conformance/merged_test.go b/ocsf/internal/ocsf/conformance/merged_test.go index b677ab4..d388eb6 100644 --- a/ocsf/internal/ocsf/conformance/merged_test.go +++ b/ocsf/internal/ocsf/conformance/merged_test.go @@ -229,22 +229,19 @@ func TestMergedProtovalidate(t *testing.T) { t.Run("TypeUIDMismatch", func(t *testing.T) { evt := buildMergedApiActivityAllowed() evt.TypeUid = ocsfv1.AuditEvent_TYPE_UID_API_ACTIVITY_CREATE // activity_id still Read - err := validator.Validate(evt) - require.ErrorContains(t, err, "type_uid") + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.type_uid") }) t.Run("ForeignClassField", func(t *testing.T) { evt := buildMergedApiActivityAllowed() evt.Entity = buildMergedEntityManagement().Entity // entity_management-owned field on 6003 - err := validator.Validate(evt) - require.ErrorContains(t, err, "entity") + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.own.entity") }) t.Run("MissingClassRequiredField", func(t *testing.T) { evt := buildMergedApiActivityAllowed() evt.Actor = nil // required for api_activity (6003), not blanket-required - err := validator.Validate(evt) - require.ErrorContains(t, err, "actor") + requireViolatedRule(t, validator.Validate(evt), "AuditEvent.req.api_activity.actor") }) t.Run("MissingBlanketRequiredField", func(t *testing.T) { diff --git a/ocsf/internal/ocsf/exporter/adversarial_test.go b/ocsf/internal/ocsf/exporter/adversarial_test.go index dd41a00..a9200e4 100644 --- a/ocsf/internal/ocsf/exporter/adversarial_test.go +++ b/ocsf/internal/ocsf/exporter/adversarial_test.go @@ -516,6 +516,113 @@ func TestFromOCSFJSON_DeepArrayNesting(t *testing.T) { }) } +// TestFromOCSFJSON_NewKindEdgeCases covers the field kinds with no OCSF +// source type (map, bytes, float, uint64, fixed32, sint64): the transform is +// documented generic over proto.Message, so they must behave. +func TestFromOCSFJSON_NewKindEdgeCases(t *testing.T) { + t.Run("BytesRoundTrip", func(t *testing.T) { + evt := &samplev1.SampleEvent{Raw: []byte{0x00, 0xff, 0xde, 0xad}} + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + require.Contains(t, string(b), `"raw":"AP/erQ=="`, "bytes must export as std base64") + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.True(t, proto.Equal(evt, &decoded)) + }) + + t.Run("BytesMalformedBase64", func(t *testing.T) { + var evt samplev1.SampleEvent + for _, bad := range []string{`"!!!"`, `"AP/er"`, `"AP/erQ"`, `42`, `["QQ=="]`} { + require.Error(t, exporter.FromOCSFJSON([]byte(`{"raw":`+bad+`}`), &evt), + "malformed base64 %s must be rejected", bad) + } + }) + + t.Run("Uint64Bounds", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"counter":18446744073709551615}`), &evt)) + require.Equal(t, uint64(math.MaxUint64), evt.Counter) + + b, err := exporter.ToOCSFJSON(&evt) + require.NoError(t, err) + require.Contains(t, string(b), `"counter":18446744073709551615`, + "uint64 max must export as an unquoted number") + + require.Error(t, exporter.FromOCSFJSON([]byte(`{"counter":18446744073709551616}`), &evt), + "uint64 overflow must be rejected") + require.Error(t, exporter.FromOCSFJSON([]byte(`{"counter":-1}`), &evt), + "negative into unsigned must be rejected") + }) + + t.Run("Fixed32Bounds", func(t *testing.T) { + var evt samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"checksum":4294967295}`), &evt)) + require.Equal(t, uint32(math.MaxUint32), evt.Checksum) + require.Error(t, exporter.FromOCSFJSON([]byte(`{"checksum":4294967296}`), &evt), + "uint32 overflow must be rejected") + require.Error(t, exporter.FromOCSFJSON([]byte(`{"checksum":-1}`), &evt)) + }) + + t.Run("Sint64RoundTrip", func(t *testing.T) { + evt := &samplev1.SampleEvent{Deltas: math.MinInt64} + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.Equal(t, int64(math.MinInt64), decoded.Deltas) + }) + + t.Run("Float32Quantization", func(t *testing.T) { + // 0.1 is not representable in float32; the exporter emits the + // quantized float32 value and the round-trip must converge on it. + evt := &samplev1.SampleEvent{Ratio: 0.1} + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.Equal(t, evt.Ratio, decoded.Ratio, "float32 must survive the round-trip exactly") + }) + + t.Run("MapRoundTrip", func(t *testing.T) { + evt := &samplev1.SampleEvent{LabelsMap: map[string]string{ + "": "empty key", + "ünïcødé": "värlue", + `k"quoted"`: `v\slashed`, + "plain": "", + }} + b, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + var decoded samplev1.SampleEvent + require.NoError(t, exporter.FromOCSFJSON(b, &decoded)) + require.True(t, proto.Equal(evt, &decoded), "hostile map keys must round-trip\njson: %s", b) + }) + + t.Run("MapHostileValues", func(t *testing.T) { + var evt samplev1.SampleEvent + require.Error(t, exporter.FromOCSFJSON([]byte(`{"labels_map":{"k":null}}`), &evt), + "null map value must be rejected, not silently zeroed") + require.Error(t, exporter.FromOCSFJSON([]byte(`{"labels_map":{"k":42}}`), &evt)) + require.Error(t, exporter.FromOCSFJSON([]byte(`{"labels_map":["k","v"]}`), &evt), + "array where map object expected must be rejected") + + // Duplicate keys: last one wins (encoding/json semantics), no panic. + require.NoError(t, exporter.FromOCSFJSON([]byte(`{"labels_map":{"k":"a","k":"b"}}`), &evt)) + require.Equal(t, "b", evt.LabelsMap["k"]) + }) + + t.Run("MapDeterministicExport", func(t *testing.T) { + evt := &samplev1.SampleEvent{LabelsMap: map[string]string{"z": "1", "a": "2", "m": "3"}} + b1, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + for range 10 { + b2, err := exporter.ToOCSFJSON(evt) + require.NoError(t, err) + require.Equal(t, string(b1), string(b2), "map export must be key-sorted deterministic") + } + require.Contains(t, string(b1), `{"a":"2","m":"3","z":"1"}`) + }) +} + // TestRoundTrip_Concurrent exercises the exporter and importer from many // goroutines to surface shared-state bugs under the race detector. func TestRoundTrip_Concurrent(t *testing.T) { @@ -816,5 +923,34 @@ func randomSampleEvent(t *testing.T, r *seededRand) *samplev1.SampleEvent { if r.chance(40) { evt.Metadata = r.randomValue(t, 3) } + populateNonOCSFKinds(r, evt) return evt } + +// populateNonOCSFKinds fills the field kinds that have no OCSF source type +// (map, bytes, float, uint64, fixed32, sint64) with random values. +func populateNonOCSFKinds(r *seededRand, evt *samplev1.SampleEvent) { + if r.chance(40) { + evt.LabelsMap = map[string]string{} + for range r.intn(4) { + evt.LabelsMap[r.randomString()] = r.randomString() + } + } + if r.chance(40) { + evt.Raw = []byte{byte(r.intn(256)), byte(r.intn(256)), byte(r.intn(256))} + } + if r.chance(40) { + // float32-safe pool: a float64 like MaxFloat64 would overflow to +Inf. + pool := []float32{0, 1.5, -1.5, math.MaxFloat32, math.SmallestNonzeroFloat32, 99.25} + evt.Ratio = pool[r.intn(len(pool))] + } + if r.chance(40) { + evt.Counter = r.next() + } + if r.chance(40) { + evt.Checksum = uint32(r.next()) + } + if r.chance(40) { + evt.Deltas = r.randomInt64() + } +} diff --git a/ocsf/internal/ocsf/exporter/importer_test.go b/ocsf/internal/ocsf/exporter/importer_test.go index 08a301f..e452774 100644 --- a/ocsf/internal/ocsf/exporter/importer_test.go +++ b/ocsf/internal/ocsf/exporter/importer_test.go @@ -48,6 +48,12 @@ func fullSample(t *testing.T) *samplev1.SampleEvent { samplev1.SampleEvent_SEVERITY_ID_CRITICAL, samplev1.SampleEvent_SEVERITY_ID_OTHER, }, + LabelsMap: map[string]string{"env": "prod", "tëam": "adp", "": "empty-key"}, + Raw: []byte{0x00, 0xff, 0x10, 0x20}, + Ratio: 1.5, // exactly representable in float32 + Counter: 18446744073709551615, + Checksum: 4294967295, + Deltas: -9007199254740993, // < -2^53 } } diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go index 8356e3c..455a97d 100644 --- a/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go +++ b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go @@ -1,4 +1,4 @@ -// Copyright 2026 Redpanda Data, Inc. +// Copyright 2024 Redpanda Data, Inc. // // Use of this software is governed by the Business Source License // included in the file licenses/BSL.md @@ -108,7 +108,19 @@ type SampleEvent struct { Note *string `protobuf:"bytes,10,opt,name=note,proto3,oneof" json:"note,omitempty"` // severities is a repeated enum field; must marshal to a JSON array of // integers (e.g. [5,99]), never name strings. - Severities []SampleEvent_SeverityId `protobuf:"varint,11,rep,packed,name=severities,proto3,enum=ocsf.exporter.sample.v1.SampleEvent_SeverityId" json:"severities,omitempty"` + Severities []SampleEvent_SeverityId `protobuf:"varint,11,rep,packed,name=severities,proto3,enum=ocsf.exporter.sample.v1.SampleEvent_SeverityId" json:"severities,omitempty"` + // labels_map exercises map -> JSON object. + LabelsMap map[string]string `protobuf:"bytes,12,rep,name=labels_map,json=labelsMap,proto3" json:"labels_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + // raw exercises bytes -> base64 string. + Raw []byte `protobuf:"bytes,13,opt,name=raw,proto3" json:"raw,omitempty"` + // ratio exercises float (32-bit) -> JSON number with float32 quantization. + Ratio float32 `protobuf:"fixed32,14,opt,name=ratio,proto3" json:"ratio,omitempty"` + // counter exercises uint64 -> unquoted JSON number. + Counter uint64 `protobuf:"varint,15,opt,name=counter,proto3" json:"counter,omitempty"` + // checksum exercises fixed32 -> JSON number. + Checksum uint32 `protobuf:"fixed32,16,opt,name=checksum,proto3" json:"checksum,omitempty"` + // deltas exercises sint64 (zigzag) -> JSON number. + Deltas int64 `protobuf:"zigzag64,17,opt,name=deltas,proto3" json:"deltas,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -220,6 +232,48 @@ func (x *SampleEvent) GetSeverities() []SampleEvent_SeverityId { return nil } +func (x *SampleEvent) GetLabelsMap() map[string]string { + if x != nil { + return x.LabelsMap + } + return nil +} + +func (x *SampleEvent) GetRaw() []byte { + if x != nil { + return x.Raw + } + return nil +} + +func (x *SampleEvent) GetRatio() float32 { + if x != nil { + return x.Ratio + } + return 0 +} + +func (x *SampleEvent) GetCounter() uint64 { + if x != nil { + return x.Counter + } + return 0 +} + +func (x *SampleEvent) GetChecksum() uint32 { + if x != nil { + return x.Checksum + } + return 0 +} + +func (x *SampleEvent) GetDeltas() int64 { + if x != nil { + return x.Deltas + } + return 0 +} + type Actor struct { state protoimpl.MessageState `protogen:"open.v1"` Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` @@ -276,7 +330,7 @@ var File_sample_proto protoreflect.FileDescriptor const file_sample_proto_rawDesc = "" + "\n" + - "\fsample.proto\x12\x17ocsf.exporter.sample.v1\x1a\x1cgoogle/protobuf/struct.proto\"\xa6\x04\n" + + "\fsample.proto\x12\x17ocsf.exporter.sample.v1\x1a\x1cgoogle/protobuf/struct.proto\"\xae\x06\n" + "\vSampleEvent\x12P\n" + "\vseverity_id\x18\x01 \x01(\x0e2/.ocsf.exporter.sample.v1.SampleEvent.SeverityIdR\n" + "severityId\x12\x12\n" + @@ -292,7 +346,17 @@ const file_sample_proto_rawDesc = "" + " \x01(\tH\x00R\x04note\x88\x01\x01\x12O\n" + "\n" + "severities\x18\v \x03(\x0e2/.ocsf.exporter.sample.v1.SampleEvent.SeverityIdR\n" + - "severities\"V\n" + + "severities\x12R\n" + + "\n" + + "labels_map\x18\f \x03(\v23.ocsf.exporter.sample.v1.SampleEvent.LabelsMapEntryR\tlabelsMap\x12\x10\n" + + "\x03raw\x18\r \x01(\fR\x03raw\x12\x14\n" + + "\x05ratio\x18\x0e \x01(\x02R\x05ratio\x12\x18\n" + + "\acounter\x18\x0f \x01(\x04R\acounter\x12\x1a\n" + + "\bchecksum\x18\x10 \x01(\aR\bchecksum\x12\x16\n" + + "\x06deltas\x18\x11 \x01(\x12R\x06deltas\x1a<\n" + + "\x0eLabelsMapEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"V\n" + "\n" + "SeverityId\x12\x17\n" + "\x13SEVERITY_ID_UNKNOWN\x10\x00\x12\x18\n" + @@ -316,23 +380,25 @@ func file_sample_proto_rawDescGZIP() []byte { } var file_sample_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_sample_proto_msgTypes = make([]protoimpl.MessageInfo, 2) +var file_sample_proto_msgTypes = make([]protoimpl.MessageInfo, 3) var file_sample_proto_goTypes = []any{ (SampleEvent_SeverityId)(0), // 0: ocsf.exporter.sample.v1.SampleEvent.SeverityId (*SampleEvent)(nil), // 1: ocsf.exporter.sample.v1.SampleEvent (*Actor)(nil), // 2: ocsf.exporter.sample.v1.Actor - (*structpb.Value)(nil), // 3: google.protobuf.Value + nil, // 3: ocsf.exporter.sample.v1.SampleEvent.LabelsMapEntry + (*structpb.Value)(nil), // 4: google.protobuf.Value } var file_sample_proto_depIdxs = []int32{ 0, // 0: ocsf.exporter.sample.v1.SampleEvent.severity_id:type_name -> ocsf.exporter.sample.v1.SampleEvent.SeverityId - 3, // 1: ocsf.exporter.sample.v1.SampleEvent.metadata:type_name -> google.protobuf.Value + 4, // 1: ocsf.exporter.sample.v1.SampleEvent.metadata:type_name -> google.protobuf.Value 2, // 2: ocsf.exporter.sample.v1.SampleEvent.actor:type_name -> ocsf.exporter.sample.v1.Actor 0, // 3: ocsf.exporter.sample.v1.SampleEvent.severities:type_name -> ocsf.exporter.sample.v1.SampleEvent.SeverityId - 4, // [4:4] is the sub-list for method output_type - 4, // [4:4] is the sub-list for method input_type - 4, // [4:4] is the sub-list for extension type_name - 4, // [4:4] is the sub-list for extension extendee - 0, // [0:4] is the sub-list for field type_name + 3, // 4: ocsf.exporter.sample.v1.SampleEvent.labels_map:type_name -> ocsf.exporter.sample.v1.SampleEvent.LabelsMapEntry + 5, // [5:5] is the sub-list for method output_type + 5, // [5:5] is the sub-list for method input_type + 5, // [5:5] is the sub-list for extension type_name + 5, // [5:5] is the sub-list for extension extendee + 0, // [0:5] is the sub-list for field type_name } func init() { file_sample_proto_init() } @@ -347,7 +413,7 @@ func file_sample_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_sample_proto_rawDesc), len(file_sample_proto_rawDesc)), NumEnums: 1, - NumMessages: 2, + NumMessages: 3, NumExtensions: 0, NumServices: 0, }, diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto b/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto index 360c5e5..79839eb 100644 --- a/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto +++ b/ocsf/internal/ocsf/exporter/testdata/sample/sample.proto @@ -57,6 +57,28 @@ message SampleEvent { // severities is a repeated enum field; must marshal to a JSON array of // integers (e.g. [5,99]), never name strings. repeated SeverityId severities = 11; + + // The fields below have no OCSF source type (MapType never produces them), + // but ToOCSFJSON/FromOCSFJSON are documented as generic over proto.Message, + // so every kind the transform supports needs test reachability. + + // labels_map exercises map -> JSON object. + map labels_map = 12; + + // raw exercises bytes -> base64 string. + bytes raw = 13; + + // ratio exercises float (32-bit) -> JSON number with float32 quantization. + float ratio = 14; + + // counter exercises uint64 -> unquoted JSON number. + uint64 counter = 15; + + // checksum exercises fixed32 -> JSON number. + fixed32 checksum = 16; + + // deltas exercises sint64 (zigzag) -> JSON number. + sint64 deltas = 17; } message Actor { diff --git a/ocsf/internal/ocsf/gen/emitmerged.go b/ocsf/internal/ocsf/gen/emitmerged.go index f3791ef..6edd989 100644 --- a/ocsf/internal/ocsf/gen/emitmerged.go +++ b/ocsf/internal/ocsf/gen/emitmerged.go @@ -11,6 +11,7 @@ package gen import ( "fmt" + "regexp" "sort" "strings" @@ -58,6 +59,10 @@ const demotedComment = "Class-scoped enum: value semantics depend on class_uid; // // stubbed follows the same contract as Emit. func EmitMerged(s *schema.Schema, classNames []string, tm *tagmap.TagMap, version, msgName, srSubject string) (files []GeneratedFile, stubbed []string, err error) { + if err := validateSRSubject(srSubject); err != nil { + return nil, nil, err + } + merged, err := MergeClasses(s, classNames, msgName) if err != nil { return nil, nil, err @@ -191,6 +196,23 @@ func srSubjectOption(subject string) string { ) } +// validSRSubject constrains subjects to characters that are unambiguous in a +// proto string literal AND legal in Kafka topic / Schema Registry subject +// names. Rejecting up front beats trusting Go %q escaping to coincide with +// proto3 string-literal escaping for exotic input. +var validSRSubject = regexp.MustCompile(`^[A-Za-z0-9._-]+$`) + +// validateSRSubject rejects subjects that could not be emitted verbatim. +func validateSRSubject(subject string) error { + if subject == "" { + return nil + } + if !validSRSubject.MatchString(subject) { + return fmt.Errorf("ocsf emit: SR subject %q contains characters outside [A-Za-z0-9._-]", subject) + } + return nil +} + // emitMergedClassFile builds the proto file holding the merged event message. func emitMergedClassFile(s *schema.Schema, tm *tagmap.TagMap, merged *Merged, version, pkgSuffix, dir string, hasObjects bool, srSubject string) (GeneratedFile, error) { opts := emitOptions{ diff --git a/ocsf/internal/ocsf/gen/emitmerged_test.go b/ocsf/internal/ocsf/gen/emitmerged_test.go index b1d91b9..4d1dc2e 100644 --- a/ocsf/internal/ocsf/gen/emitmerged_test.go +++ b/ocsf/internal/ocsf/gen/emitmerged_test.go @@ -228,6 +228,58 @@ func TestEmitMerged_TagStability(t *testing.T) { } } +// TestEmitMerged_TagStabilityAcrossSaveLoad verifies the production +// workflow end to end: generate, persist the tagmap to disk, load it back, +// regenerate with an ADDITIONAL class, and assert no previously assigned +// AuditEvent tag moved. This is the file-backed variant of +// TestEmitMerged_TagStability and the exact scenario --compat-check gates. +func TestEmitMerged_TagStabilityAcrossSaveLoad(t *testing.T) { + s := loadFixture(t) + tagmapPath := filepath.Join(t.TempDir(), "field-numbers.json") + + // First generation: two classes, persist to disk. + tm1, err := tagmap.Load(tagmapPath) + require.NoError(t, err) + files1, _, err := gen.EmitMerged(s, mergedClasses, tm1, "1.8.0", mergedMsgName, mergedSRSubject) + require.NoError(t, err) + require.NoError(t, tm1.Save(tagmapPath)) + + before := extractFieldTags(extractMessage(t, mergedFileContent(t, files1))) + require.NotEmpty(t, before) + + // Second generation: load the persisted tagmap, widen the class set. + tm2, err := tagmap.Load(tagmapPath) + require.NoError(t, err) + wider := append([]string{"authentication"}, mergedClasses...) + files2, _, err := gen.EmitMerged(s, wider, tm2, "1.8.0", mergedMsgName, mergedSRSubject) + require.NoError(t, err) + require.NoError(t, tm2.Save(tagmapPath)) + + after := extractFieldTags(extractMessage(t, mergedFileContent(t, files2))) + for name, tag := range before { + require.Equal(t, tag, after[name], + "tag for %q moved after adding a class through a save/load cycle", name) + } + + // And the on-disk maps must be compatible per the CI gate itself. + oldTM, err := tagmap.Load(tagmapPath) + require.NoError(t, err) + require.NoError(t, tagmap.CheckCompat(oldTM, tm2)) +} + +// mergedFileContent returns the audit_event.proto content from an EmitMerged +// file list. +func mergedFileContent(t *testing.T, files []gen.GeneratedFile) string { + t.Helper() + for _, f := range files { + if strings.HasSuffix(f.Path, "audit_event.proto") { + return f.Content + } + } + t.Fatal("audit_event.proto not found in generated files") + return "" +} + // TestEmitMerged_ConflictingClassDemotes verifies EmitMerged succeeds when a // genuinely conflicting class (authentication) is selected, with activity_id // demoted rather than erroring. @@ -265,6 +317,24 @@ func TestEmitMerged_SRSubjectAnnotation(t *testing.T) { } } +// TestEmitMerged_SRSubjectValidation verifies hostile subjects are rejected +// up front instead of trusting Go %q escaping to be proto-literal-legal. +func TestEmitMerged_SRSubjectValidation(t *testing.T) { + s := loadFixture(t) + + for _, bad := range []string{ + `with"quote`, `back\slash`, "new\nline", "ünïcødé", "spa ce", "semi;colon", + } { + _, _, err := gen.EmitMerged(s, mergedClasses, tagmap.New(), "1.8.0", mergedMsgName, bad) + require.ErrorContains(t, err, "SR subject", "subject %q must be rejected", bad) + } + + // The legal charset passes. + _, _, err := gen.EmitMerged(s, mergedClasses, tagmap.New(), "1.8.0", mergedMsgName, + "redpanda.ocsf.audit-events_value-1") + require.NoError(t, err) +} + // TestEmitMergedSRSchema_Shape verifies the SR schema: merged message first, // self-contained, no buf.validate anywhere, and no Schema-Registry annotation // (the .sr.proto must not depend on redpanda/api/common options). @@ -305,8 +375,8 @@ func TestEmitMergedSRSchema_FieldNumberParity(t *testing.T) { } } - mainMsg := extractMessage(t, classFile, "AuditEvent") - srMsg := extractMessage(t, srFile.Content, "AuditEvent") + mainMsg := extractMessage(t, classFile) + srMsg := extractMessage(t, srFile.Content) mainTags := extractFieldTags(mainMsg) srTags := extractFieldTags(srMsg) @@ -321,11 +391,11 @@ func TestEmitMerged_Deterministic(t *testing.T) { require.Equal(t, a, b) } -// extractMessage returns the body of the named top-level message. -func extractMessage(t *testing.T, content, name string) string { +// extractMessage returns the body of the merged top-level message. +func extractMessage(t *testing.T, content string) string { t.Helper() - start := strings.Index(content, "message "+name+" {") - require.GreaterOrEqual(t, start, 0, "message %s not found", name) + start := strings.Index(content, "message "+mergedMsgName+" {") + require.GreaterOrEqual(t, start, 0, "message %s not found", mergedMsgName) // Top-level messages end at the first "\n}\n" after their start. end := strings.Index(content[start:], "\n}\n") require.GreaterOrEqual(t, end, 0) diff --git a/ocsf/internal/ocsf/gen/merge_test.go b/ocsf/internal/ocsf/gen/merge_test.go index b75c075..433dfca 100644 --- a/ocsf/internal/ocsf/gen/merge_test.go +++ b/ocsf/internal/ocsf/gen/merge_test.go @@ -137,6 +137,76 @@ func TestMergeClasses_EnumPresenceMismatchDemotes(t *testing.T) { require.Contains(t, m.Demoted, "state_id") } +// TestMergeClasses_StringKeyedEnumConflictDemotes exercises the string-keyed +// (StrKey) branch of the enum union: same key, different caption demotes. +func TestMergeClasses_StringKeyedEnumConflictDemotes(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "tlp": {Name: "tlp", Type: "string_t", Enum: []schema.EnumMember{ + {StrKey: "RED", Caption: "Red"}, + {StrKey: "AMBER", Caption: "Amber"}, + }}, + }, + map[string]*schema.Attribute{ + "tlp": {Name: "tlp", Type: "string_t", Enum: []schema.EnumMember{ + {StrKey: "RED", Caption: "Restricted"}, // same key, different meaning + }}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.Contains(t, m.Demoted, "tlp") + require.Empty(t, m.Attributes["tlp"].Enum) +} + +// TestMergeClasses_StringKeyedEnumUnions verifies non-conflicting string-keyed +// enums union by key. +func TestMergeClasses_StringKeyedEnumUnions(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "tlp": {Name: "tlp", Type: "string_t", Enum: []schema.EnumMember{ + {StrKey: "RED", Caption: "Red"}, + }}, + }, + map[string]*schema.Attribute{ + "tlp": {Name: "tlp", Type: "string_t", Enum: []schema.EnumMember{ + {StrKey: "RED", Caption: "Red"}, + {StrKey: "GREEN", Caption: "Green"}, + }}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.NotContains(t, m.Demoted, "tlp") + require.Len(t, m.Attributes["tlp"].Enum, 2) +} + +// TestMergeClasses_MixedEnumKindDemotes exercises the kind-mismatch branch: +// one class integer-keyed, the other string-keyed for the same attribute. +func TestMergeClasses_MixedEnumKindDemotes(t *testing.T) { + s := syntheticSchema( + t, + map[string]*schema.Attribute{ + "state": {Name: "state", Type: "string_t", Enum: []schema.EnumMember{ + {Key: 1, IntKey: true, Caption: "Active"}, + }}, + }, + map[string]*schema.Attribute{ + "state": {Name: "state", Type: "string_t", Enum: []schema.EnumMember{ + {StrKey: "ACTIVE", Caption: "Active"}, + }}, + }, + ) + + m, err := gen.MergeClasses(s, []string{"alpha", "beta"}, "AuditEvent") + require.NoError(t, err) + require.Contains(t, m.Demoted, "state") +} + // TestMergeClasses_TypeMismatchErrors verifies that the same attribute name // with different OCSF types across classes is a hard error. func TestMergeClasses_TypeMismatchErrors(t *testing.T) { From b88f56339d1b24e7722215d0e0a5ee93166e526f Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 20:54:14 +0200 Subject: [PATCH 24/26] fix(ocsf): harden importer and generator edges from code review Three low-severity findings from a dedicated correctness review (which found no high-severity issues and confirmed enum-slice aliasing, CEL semantics, importer reflection, UTF-8 rejection, objects.proto dedupe, and wire stability all sound): - decodeUint parsed via fmt.Sscanf %d, which accepts a fractional JSON number like 12.9 and silently truncates it to 12. Latent for OCSF types (no OCSF attribute maps to an unsigned kind) but FromOCSFJSON is generic over proto.Message; now strconv.ParseUint rejects it, with regression tests on the uint64 and fixed32 fixture fields. - diffSRSchemas only checked generated-vs-committed one way: dropping a class from --classes left its stale .sr.proto committed and CI green. Stray *.sr.proto files now fail --check, mirroring the main tree's stray-file detection. - --merged-message naming a selected class's PascalCase message name (e.g. ApiActivity) would silently share one (message, attribute) tag lineage between two distinct messages. Now rejected with an explicit error via the exported gen.ClassMessageName. Also bumps the regenerated sample.pb.go license header year, which the Format Check's licenseupdater rewrites (the previous push's only CI failure). Co-Authored-By: Claude Fable 5 --- ocsf/cmd/ocsf-protogen/protogen/protogen.go | 50 ++++++++++++++++++- .../ocsf-protogen/protogen/protogen_test.go | 49 ++++++++++++++++++ .../ocsf/exporter/adversarial_test.go | 6 +++ ocsf/internal/ocsf/exporter/importer.go | 7 ++- .../exporter/testdata/sample/sample.pb.go | 2 +- ocsf/internal/ocsf/gen/emit.go | 6 +++ 6 files changed, 116 insertions(+), 4 deletions(-) diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen.go b/ocsf/cmd/ocsf-protogen/protogen/protogen.go index b251e39..8eebd76 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen.go @@ -119,6 +119,10 @@ func emitAll(s *schema.Schema, cfg Config, tm *tagmap.TagMap) (files []gen.Gener return files, stubbed, nil } + if err := checkMergedNameCollision(cfg.MergedMessage, cfg.Classes); err != nil { + return nil, nil, err + } + mergedFiles, mergedStubbed, err := gen.EmitMerged(s, cfg.Classes, tm, cfg.Version, cfg.MergedMessage, cfg.MergedSRSubject) if err != nil { return nil, nil, fmt.Errorf("emit merged proto: %w", err) @@ -145,6 +149,21 @@ func emitAll(s *schema.Schema, cfg Config, tm *tagmap.TagMap) (files []gen.Gener return files, stubbed, nil } +// checkMergedNameCollision rejects a merged message name that collides with a +// selected class's PascalCase message name: the two distinct messages would +// silently share one (name, attribute) tag lineage in the tagmap. +func checkMergedNameCollision(mergedMessage string, classes []string) error { + for _, class := range classes { + if gen.ClassMessageName(class) == mergedMessage { + return fmt.Errorf( + "--merged-message %q collides with the message name of class %q; choose a distinct name", + mergedMessage, class, + ) + } + } + return nil +} + // emitAllSRSchemas runs the per-class EmitSRSchemas plus, when // cfg.MergedMessage is set, the merged EmitMergedSRSchema. func emitAllSRSchemas(s *schema.Schema, cfg Config, tm *tagmap.TagMap) ([]gen.GeneratedFile, error) { @@ -260,9 +279,13 @@ func Check(cfg Config) error { // diffSRSchemas compares freshly generated SR schema files against their // committed counterparts under srOutDir and returns a descriptive error on any -// missing or changed file. +// missing, changed, or stray file. Stray detection mirrors diffTree: a +// committed *.sr.proto the generator no longer produces (e.g. after a class is +// dropped from --classes) must fail the check rather than rot silently. func diffSRSchemas(srOutDir string, files []gen.GeneratedFile) error { + want := make(map[string]struct{}, len(files)) for _, f := range files { + want[f.Path] = struct{}{} p := filepath.Join(srOutDir, filepath.FromSlash(f.Path)) b, err := os.ReadFile(filepath.Clean(p)) switch { @@ -283,6 +306,31 @@ func diffSRSchemas(srOutDir string, files []gen.GeneratedFile) error { ) } } + + entries, err := os.ReadDir(srOutDir) + if os.IsNotExist(err) { + return nil + } + if err != nil { + return fmt.Errorf("read committed SR schema dir %q: %w", srOutDir, err) + } + var stray []string + for _, e := range entries { + if e.IsDir() || !strings.HasSuffix(e.Name(), ".sr.proto") { + continue + } + if _, ok := want[e.Name()]; !ok { + stray = append(stray, e.Name()) + } + } + if len(stray) > 0 { + sort.Strings(stray) + return fmt.Errorf( + "SR schema dir %q contains files not produced by the generator: %s "+ + "(run ocsf-protogen without --check to regenerate, then commit the diff)", + srOutDir, strings.Join(stray, ", "), + ) + } return nil } diff --git a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go index ff64f8e..50bb48c 100644 --- a/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go +++ b/ocsf/cmd/ocsf-protogen/protogen/protogen_test.go @@ -175,6 +175,55 @@ func TestCheckFailsOnSRSchemaDrift(t *testing.T) { require.Contains(t, err.Error(), "differs") } +// TestCheckFailsOnStraySRSchema verifies --check detects a committed +// *.sr.proto the generator no longer produces (e.g. after a class is dropped +// from --classes), mirroring the stray-file detection of the main tree. +func TestCheckFailsOnStraySRSchema(t *testing.T) { + dir := t.TempDir() + srDir := t.TempDir() + tagmapPath := filepath.Join(dir, "field-numbers.json") + + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: tagmapPath, + SRSchemaOutDir: srDir, + } + + _, err := protogen.Generate(cfg) + require.NoError(t, err) + + // A leftover SR schema from a since-dropped class. + require.NoError(t, os.WriteFile(filepath.Join(srDir, "dropped_class.sr.proto"), + []byte("syntax = \"proto3\";\n"), 0o644)) + + checkCfg := cfg + checkCfg.Check = true + err = protogen.Check(checkCfg) + require.Error(t, err, "--check must fail on a stray committed SR schema") + require.Contains(t, err.Error(), "dropped_class.sr.proto") +} + +// TestGenerateMergedNameCollision verifies a merged message name that matches +// a selected class's PascalCase message name is rejected: the two messages +// would silently share one tag lineage. +func TestGenerateMergedNameCollision(t *testing.T) { + dir := t.TempDir() + cfg := protogen.Config{ + SchemaPath: schemaFixture(), + Classes: []string{"api_activity", "entity_management"}, + Version: "1.8.0", + OutDir: dir, + TagmapPath: filepath.Join(dir, "field-numbers.json"), + MergedMessage: "ApiActivity", // collides with class api_activity + } + _, err := protogen.Generate(cfg) + require.ErrorContains(t, err, "collides") + require.ErrorContains(t, err, "api_activity") +} + // TestCheckFailsOnMissingSRSchema verifies that --check reports a missing SR file. func TestCheckFailsOnMissingSRSchema(t *testing.T) { dir := t.TempDir() diff --git a/ocsf/internal/ocsf/exporter/adversarial_test.go b/ocsf/internal/ocsf/exporter/adversarial_test.go index a9200e4..3f1e573 100644 --- a/ocsf/internal/ocsf/exporter/adversarial_test.go +++ b/ocsf/internal/ocsf/exporter/adversarial_test.go @@ -552,6 +552,12 @@ func TestFromOCSFJSON_NewKindEdgeCases(t *testing.T) { "uint64 overflow must be rejected") require.Error(t, exporter.FromOCSFJSON([]byte(`{"counter":-1}`), &evt), "negative into unsigned must be rejected") + // Regression (code review): fmt.Sscanf %d accepted 12.9 as 12 with no + // error; strconv.ParseUint must reject fractional literals outright. + require.Error(t, exporter.FromOCSFJSON([]byte(`{"counter":12.9}`), &evt), + "fractional value into uint64 must be rejected, not truncated") + require.Error(t, exporter.FromOCSFJSON([]byte(`{"checksum":8080.5}`), &evt), + "fractional value into fixed32 must be rejected, not truncated") }) t.Run("Fixed32Bounds", func(t *testing.T) { diff --git a/ocsf/internal/ocsf/exporter/importer.go b/ocsf/internal/ocsf/exporter/importer.go index 5e1da26..c36a346 100644 --- a/ocsf/internal/ocsf/exporter/importer.go +++ b/ocsf/internal/ocsf/exporter/importer.go @@ -16,6 +16,7 @@ import ( "fmt" "maps" "math" + "strconv" "google.golang.org/protobuf/encoding/protojson" "google.golang.org/protobuf/proto" @@ -395,13 +396,15 @@ func decodeUint32(data json.RawMessage) (uint32, error) { } // decodeUint parses a JSON number (or quoted decimal string) as uint64. +// strconv.ParseUint (not Sscanf) so a fractional literal like 12.9 is +// rejected instead of silently truncated to 12. func decodeUint(data json.RawMessage) (uint64, error) { n, err := decodeNumber(data) if err != nil { return 0, err } - var u uint64 - if _, err := fmt.Sscanf(n.String(), "%d", &u); err != nil { + u, err := strconv.ParseUint(n.String(), 10, 64) + if err != nil { return 0, fmt.Errorf("parse %q as uint64: %w", n.String(), err) } return u, nil diff --git a/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go index 455a97d..5623e57 100644 --- a/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go +++ b/ocsf/internal/ocsf/exporter/testdata/sample/sample.pb.go @@ -1,4 +1,4 @@ -// Copyright 2024 Redpanda Data, Inc. +// Copyright 2026 Redpanda Data, Inc. // // Use of this software is governed by the Business Source License // included in the file licenses/BSL.md diff --git a/ocsf/internal/ocsf/gen/emit.go b/ocsf/internal/ocsf/gen/emit.go index 58ce5f6..68fad79 100644 --- a/ocsf/internal/ocsf/gen/emit.go +++ b/ocsf/internal/ocsf/gen/emit.go @@ -40,6 +40,12 @@ func toPascalCase(s string) string { return b.String() } +// ClassMessageName returns the proto message name a class emits as +// (PascalCase of its snake_case name): "api_activity" → "ApiActivity". +func ClassMessageName(className string) string { + return toPascalCase(className) +} + // SelectClosure returns the named classes (sorted by name) plus every object // transitively referenced through attributes whose MapType yields a Message. // From 4f3eb50ef235ee91bb8e36404d19a3bc6f579e5b Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 22:56:19 +0200 Subject: [PATCH 25/26] fix(ocsf): pin protovalidate to v1.0.0 for consumer compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The conformance suite's protovalidate dependency was added at @latest (v1.2.0, requiring cel-go 0.28). Consumers that pin this module as a Go tool (cloudv2) then get MVS-bumped to protovalidate v1.2.0, whose violation MESSAGE WORDING changed (e.g. "value must contain at least 1 item(s)" became "must contain at least 1 item(s)"), breaking every downstream test that asserts exact violation strings — ~15 failures across unrelated cloudv2 services. Pin to v1.0.0 / cel-go 0.26.1, matching cloudv2's resolution. The suite's own assertions use structured rule ids, not message text, and pass unchanged on both versions; v1.0.0 just stops this module from forcing a protovalidate behavior change on consumers. Revisit when the ecosystem moves to v1.2+ deliberately. Co-Authored-By: Claude Fable 5 --- ocsf/go.mod | 5 +++-- ocsf/go.sum | 24 ++++++++++++++---------- 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/ocsf/go.mod b/ocsf/go.mod index d4415fa..2b262f6 100644 --- a/ocsf/go.mod +++ b/ocsf/go.mod @@ -5,7 +5,7 @@ go 1.24.3 require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 - buf.build/go/protovalidate v1.2.0 + buf.build/go/protovalidate v1.0.0 github.com/stretchr/testify v1.11.1 google.golang.org/protobuf v1.36.11 ) @@ -14,8 +14,9 @@ require ( cel.dev/expr v0.25.1 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/google/cel-go v0.28.0 // indirect + github.com/google/cel-go v0.26.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect + github.com/stoewer/go-strcase v1.3.1 // indirect golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect golang.org/x/text v0.28.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect diff --git a/ocsf/go.sum b/ocsf/go.sum index a394afd..4c8d66f 100644 --- a/ocsf/go.sum +++ b/ocsf/go.sum @@ -2,18 +2,17 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-202604152011 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 h1:AZVH8d9Xh0ar1BbxDiY+2urib65GfAcT8rPZfM++N/Q= buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1/go.mod h1:3w7EzexwlL6PIFGbbeKZ0yHfUlAmI0aBVzF/QoFb8Cg= -buf.build/go/protovalidate v1.2.0 h1:DQVrUWkmGTBij+kOYv/x2LLxwcLaGKMdzShj1/6/3H0= -buf.build/go/protovalidate v1.2.0/go.mod h1:7rYiQEhqvAipoazpVNBBH2S2f8bjG4huMVy1V2Yofn4= +buf.build/go/protovalidate v1.0.0 h1:IAG1etULddAy93fiBsFVhpj7es5zL53AfB/79CVGtyY= +buf.build/go/protovalidate v1.0.0/go.mod h1:KQmEUrcQuC99hAw+juzOEAmILScQiKBP1Oc36vvCLW8= cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4= cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ= github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw= -github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4= -github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc= -github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8= +github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ= +github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= @@ -22,12 +21,16 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8= -github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0= +github.com/stoewer/go-strcase v1.3.1 h1:iS0MdW+kVTxgMoE1LAZyMiYJFKlOzLooE4MxjirtkAs= +github.com/stoewer/go-strcase v1.3.1/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE= golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4= golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= @@ -41,5 +44,6 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= From 4bc7521c5c0a080d3893d178071d320557c42411 Mon Sep 17 00:00:00 2001 From: santiago Date: Fri, 3 Jul 2026 23:16:20 +0200 Subject: [PATCH 26/26] fix(ocsf): pin the protovalidate schema snapshot consumers resolve Same consumer-compatibility rationale as the protovalidate-go pin: the buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go snapshot carries the rule MESSAGE TEXT protovalidate renders, and the 2026-04 snapshot rewrote it (e.g. "value must be a valid HTTP header value" became "must be a valid HTTP header value"). Any consumer pinning this module gets MVS-bumped and every downstream test asserting exact violation strings breaks. Pin to the 2025-09 snapshot cloudv2 main resolves. Our own assertions use structured rule ids and field paths, not upstream message text; the full suite passes identically. Co-Authored-By: Claude Fable 5 --- ocsf/go.mod | 2 +- ocsf/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ocsf/go.mod b/ocsf/go.mod index 2b262f6..e75213b 100644 --- a/ocsf/go.mod +++ b/ocsf/go.mod @@ -3,7 +3,7 @@ module github.com/redpanda-data/common-go/ocsf go 1.24.3 require ( - buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1 buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 buf.build/go/protovalidate v1.0.0 github.com/stretchr/testify v1.11.1 diff --git a/ocsf/go.sum b/ocsf/go.sum index 4c8d66f..f9fa4d4 100644 --- a/ocsf/go.sum +++ b/ocsf/go.sum @@ -1,5 +1,5 @@ -buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg= -buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1 h1:31on4W/yPcV4nZHL4+UCiCvLPsMqe/vJcNg8Rci0scc= +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20250912141014-52f32327d4b0.1/go.mod h1:fUl8CEN/6ZAMk6bP8ahBJPUJw7rbp+j4x+wCcYi2IG4= buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1 h1:AZVH8d9Xh0ar1BbxDiY+2urib65GfAcT8rPZfM++N/Q= buf.build/gen/go/redpandadata/common/protocolbuffers/go v1.36.11-20260323171043-6e06f84ad823.1/go.mod h1:3w7EzexwlL6PIFGbbeKZ0yHfUlAmI0aBVzF/QoFb8Cg= buf.build/go/protovalidate v1.0.0 h1:IAG1etULddAy93fiBsFVhpj7es5zL53AfB/79CVGtyY=